import { CredoWebCrypto } from "../../crypto/webcrypto/CredoWebCrypto.mjs";
import "../../crypto/webcrypto/index.mjs";
import { X509CrlDistributionPoint } from "./X509CrlDistributionPoint.mjs";
import { X509CreateCertificateOptions } from "./X509ServiceOptions.mjs";
import { X509ExtensionIdentifier } from "./utils/extensions.mjs";
import "./utils/index.mjs";
import { PublicJwk } from "../kms/jwk/PublicJwk.mjs";
import "../kms/index.mjs";
import { AgentContext } from "../../agent/context/AgentContext.mjs";
import "../../agent/index.mjs";
import * as x509 from "@peculiar/x509";
//#region src/modules/x509/X509Certificate.d.ts
export declare enum X509KeyUsage {
  DigitalSignature = 1,
  NonRepudiation = 2,
  KeyEncipherment = 4,
  DataEncipherment = 8,
  KeyAgreement = 16,
  KeyCertSign = 32,
  CrlSign = 64,
  EncipherOnly = 128,
  DecipherOnly = 256
}
export declare enum X509ExtendedKeyUsage {
  ServerAuth = "1.3.6.1.5.5.7.3.1",
  ClientAuth = "1.3.6.1.5.5.7.3.2",
  CodeSigning = "1.3.6.1.5.5.7.3.3",
  EmailProtection = "1.3.6.1.5.5.7.3.4",
  TimeStamping = "1.3.6.1.5.5.7.3.8",
  OcspSigning = "1.3.6.1.5.5.7.3.9",
  MdlDs = "1.0.18013.5.1.2"
}
export type X509CertificateOptions = {
  publicJwk: PublicJwk;
  privateKey?: Uint8Array;
  x509Certificate: x509.X509Certificate;
};
export declare class X509Certificate {
  publicJwk: PublicJwk;
  privateKey?: Uint8Array;
  private x509Certificate;
  private constructor();
  set keyId(keyId: string);
  get keyId(): string;
  get hasKeyId(): boolean;
  static fromRawCertificate(rawCertificate: Uint8Array): X509Certificate;
  static fromEncodedCertificate(encodedCertificate: string): X509Certificate;
  private static parseCertificate;
  private getMatchingExtensions;
  get rawCertificate(): Uint8Array<ArrayBuffer>;
  get subjectAlternativeNames(): {
    type: x509.GeneralNameType;
    value: string;
  }[];
  get issuerAlternativeNames(): {
    type: x509.GeneralNameType;
    value: string;
  }[];
  get sanDnsNames(): string[];
  get sanUriNames(): string[];
  get ianDnsNames(): string[];
  get ianUriNames(): string[];
  get authorityKeyIdentifier(): string | undefined;
  get subjectKeyIdentifier(): string | undefined;
  get keyUsage(): X509KeyUsage[] | undefined;
  get extendedKeyUsage(): X509ExtendedKeyUsage[];
  /**
   * Whether this certificate is a certificate authority (the Basic Constraints `cA` flag is set).
   * Returns `false` when the Basic Constraints extension is absent (e.g. an end-entity certificate).
   */
  get isCertificateAuthority(): boolean;
  /**
   * Get CRL Distribution Points with full structure including URLs, reasons, and CRL issuer.
   * Based on RFC 5280 Section 4.2.1.13
   *
   * NOTE: only the URI form is surfaced for both the distribution point name (fullName) and the
   * cRLIssuer; nameRelativeToCRLIssuer and non-URI general names are ignored. Indirect CRLs
   * (those with a cRLIssuer) are surfaced here but are not verified during revocation checking.
   */
  get crlDistributionPoints(): X509CrlDistributionPoint[];
  isExtensionCritical(id: X509ExtensionIdentifier | string): boolean;
  static create(options: X509CreateCertificateOptions, webCrypto: CredoWebCrypto): Promise<X509Certificate>;
  get subject(): string;
  /**
   * The DER-encoded subject distinguished name. Use this for exact, encoding-stable name comparison
   * (e.g. binding a CRL to its issuer) rather than the string form returned by {@link subject}.
   */
  get subjectNameBytes(): Uint8Array;
  get issuer(): string;
  verify({ verificationDate, publicJwk, skipSignatureVerification }: {
    verificationDate: Date;
    publicJwk?: PublicJwk;
    /**
     * Whether to skip the verification of the signature and only perform other checks (such
     * as whether the certificate is not expired).
     *
     * This can be useful when an non-self-signed certificate is directly trusted, and it may
     * not be possible to verify the certificate as the root/intermediate certificate containing
     * the key of the signer/intermediate is not present.
     *
     * @default false
     */
    skipSignatureVerification?: boolean;
  }, webCrypto: CredoWebCrypto): Promise<void>;
  /**
   * Get the thumbprint of the X509 certificate in hex format.
   */
  getThumbprintInHex(agentContext: AgentContext): Promise<string>;
  /**
   * Get the data elements of the x509 certificate
   */
  get data(): {
    issuerName: string;
    issuer: string;
    subjectName: string;
    subject: string;
    serialNumber: string;
    pem: string;
    notBefore: Date;
    notAfter: Date;
  };
  getIssuerNameField(field: string): string[];
  getSubjectNameField(field: string): string[];
  /**
   * @param format the format to export to, defaults to `pem`
   */
  toString(format?: 'asn' | 'pem' | 'hex' | 'base64' | 'text' | 'base64url'): string;
  equal(certificate: X509Certificate): boolean;
}
//#endregion
//# sourceMappingURL=X509Certificate.d.mts.map