import type { RequestHandler } from '@sveltejs/kit';
import type { JwtConfig } from '../../types.js';
/**
 * RFC 7517 JWKS endpoint factory for `jwt.algorithm: 'ES256'` — serves
 * `{ keys: [...] }` with the **public** half of the active signing key plus
 * every `previousPublicKeys` entry, so consuming services can verify this
 * deployment's session JWTs (and keep verifying tokens signed by a retiring
 * key through its rotation window) without sharing any secret. The JWT only
 * proves identity; what a consumer lets that identity do remains the
 * consumer's own decision. Mount the returned `GET` on a route of your
 * choosing, e.g. `/.well-known/jwks.json`. When it lives outside the default
 * public prefixes, exempt it by spreading them —
 * `publicRoutes: [...DEFAULT_PUBLIC_ROUTES, '/.well-known/']` — since the
 * option replaces the defaults rather than extending them.
 *
 * The active key's `kid` is resolved exactly like the one stamped into new
 * tokens (`keyId` → the JWK's own `kid` → RFC 7638 thumbprint), so the JWKS
 * document and the token headers can never drift apart.
 *
 * Fail-loud contract — misconfiguration throws at **factory** time, never as
 * a runtime 500 or a silently empty key set:
 * - HS256 config (the default): an HMAC secret is symmetric — there is no
 *   public half to publish, and an empty `keys` array would only break
 *   consumers later at verify time.
 * - ES256 with a missing/malformed `signingKey` or malformed
 *   `previousPublicKeys` entries (same validation as the wiring entry points).
 *
 * Only public JWK members (`kty`, `crv`, `x`, `y`, `kid`, `alg`, `use`) are
 * ever emitted; the private scalar `d` cannot reach the response by
 * construction. Responses carry `Cache-Control: public, max-age=300` (see
 * {@link JWKS_HEADERS} for the rotation rationale).
 */
export declare function createJWKSHandler(config: {
    jwt: JwtConfig;
}): {
    GET: RequestHandler;
};