import { CredoWebCrypto } from "../../crypto/webcrypto/CredoWebCrypto.mjs";
import "../../crypto/webcrypto/index.mjs";
import { X509RevocationReason } from "./X509CrlDistributionPoint.mjs";
import { X509Certificate } from "./X509Certificate.mjs";
import { X509CreateCertificateRevocationListOptions } from "./X509ServiceOptions.mjs";
import { X509CrlExtensionIdentifier } from "./utils/extensions.mjs";
import "./utils/index.mjs";
//#region src/modules/x509/X509CertificateRevocationList.d.ts
/**
 * Reason a certificate was revoked, as carried in a CRL entry's `reasonCode` extension
 * (RFC 5280 §5.3.1 `CRLReason`).
 */
export declare enum X509CertificateRevocationListEntryReason {
  Unused = 0,
  KeyCompromise = 1,
  CACompromise = 2,
  AffiliationChanged = 3,
  Superseded = 4,
  CessationOfOperation = 5,
  CertificateHold = 6,
  RemoveFromCrl = 8,
  PrivilegeWithdrawn = 9,
  AACompromise = 10
}
export interface X509CertificateRevocationListEntry {
  serialNumber: string;
  revocationDate: Date;
  reason?: X509CertificateRevocationListEntryReason;
}
/**
 * Parsed Issuing Distribution Point CRL extension (RFC 5280 §5.2.5), describing the scope of a CRL.
 */
export interface X509IssuingDistributionPoint {
  /** Distribution point name as a list of URIs (other GeneralName forms are ignored). */
  fullName: string[];
  /** Whether the CRL only covers end-entity certificates. */
  onlyContainsUserCerts: boolean;
  /** Whether the CRL only covers CA certificates. */
  onlyContainsCACerts: boolean;
  /** The revocation reasons this CRL is limited to (reasonFlags bits), if scoped. */
  onlySomeReasons?: X509RevocationReason[];
  /** Whether this is an indirect CRL (entries may carry a `certificateIssuer`). */
  indirectCRL: boolean;
  /** Whether the CRL only covers attribute certificates. */
  onlyContainsAttributeCerts: boolean;
}
/**
 * Wrapper class for X.509 Certificate Revocation List (CRL)
 * Provides a clean interface over the @peculiar/x509 CRL implementation
 */
export declare class X509CertificateRevocationList {
  private crl;
  private constructor();
  /**
   * Parse a CRL from raw bytes
   */
  static fromRaw(rawCrl: Uint8Array): X509CertificateRevocationList;
  /**
   * Parse a CRL from PEM or base64 encoded string
   */
  static fromEncoded(encodedCrl: string): X509CertificateRevocationList;
  /**
   * Create and sign a new CRL.
   *
   * Supports the CRL Number, Authority Key Identifier and Issuing Distribution Point extensions, as
   * well as indirect CRLs (per-entry `certificateIssuer`). See `options.extensions` / entry options.
   *
   * NOTE: indirect CRLs and CRLs whose Issuing Distribution Point scope does not cover the
   * certificate being checked are rejected during revocation checking (delta CRLs are likewise not
   * processed), so such CRLs are not treated as authoritative proof that a certificate is unrevoked.
   */
  static create(options: X509CreateCertificateRevocationListOptions, webCrypto: CredoWebCrypto): Promise<X509CertificateRevocationList>;
  /**
   * Get the raw CRL data
   */
  get rawCertificateRevocationList(): Uint8Array;
  /**
   * Get the issuer of the CRL
   */
  get issuer(): string;
  /**
   * Get the date this CRL was issued
   */
  get thisUpdate(): Date;
  /**
   * Get the date when the next CRL will be published
   */
  get nextUpdate(): Date | undefined;
  /**
   * Check if the CRL has expired (past nextUpdate date)
   */
  isExpired(date?: Date): boolean;
  /**
   * Check if the CRL is not yet valid (before its thisUpdate date).
   */
  isNotYetValid(date?: Date): boolean;
  private getMatchingExtensions;
  /**
   * CRL Number (RFC 5280 §5.2.3): the monotonically increasing sequence number of this CRL.
   */
  get crlNumber(): number | undefined;
  /**
   * Delta CRL Indicator (RFC 5280 §5.2.4): when present, this CRL is a delta CRL and the value is
   * the CRL Number of the base (complete) CRL it is relative to. `undefined` for a complete CRL.
   */
  get deltaCrlIndicator(): number | undefined;
  /**
   * Issuing Distribution Point (RFC 5280 §5.2.5), describing the scope of this CRL.
   *
   * NOTE: only the URI form of the distribution point name is surfaced; other GeneralName forms and
   * `nameRelativeToCRLIssuer` are ignored.
   */
  get issuingDistributionPoint(): X509IssuingDistributionPoint | undefined;
  /**
   * The object identifiers of all critical extensions on this CRL.
   */
  get criticalExtensionIds(): string[];
  /**
   * Whether the extension with the given id is marked critical. Throws if the extension is absent.
   */
  isExtensionCritical(id: X509CrlExtensionIdentifier | string): boolean;
  /**
   * Verify this CRL with the issuer's certificate.
   *
   * NOTE: the CRL summary cache fast path in `X509RevocationService` reproduces the
   * issuer-certificate-dependent checks below (public key, subject name, cRLSign key usage). If a
   * new check depending on the issuer certificate is added here, update that gate in tandem.
   */
  verify({ issuerCertificate, verificationDate: now }: {
    issuerCertificate: X509Certificate;
    verificationDate?: Date;
  }, webCrypto: CredoWebCrypto): Promise<{
    isValid: boolean;
    error?: Error;
  }>;
  /**
   * Check if a certificate is revoked in this CRL.
   *
   * We compare serial numbers ourselves (normalizing case and leading zeros) instead of
   * delegating to `@peculiar/x509`'s `X509Crl.findRevoked`. The latter eagerly resolves the
   * global crypto provider (even though it isn't needed for a serial number comparison), which
   * throws when no provider has been registered globally.
   */
  findRevoked(certificate: X509Certificate): X509CertificateRevocationListEntry | null;
  /**
   * Get all revoked certificates in this CRL
   */
  get revokedCertificates(): X509CertificateRevocationListEntry[];
  /**
   * Get the number of revoked certificates in this CRL
   */
  get revokedCount(): number;
  /**
   * @param format the format to export to, defaults to `pem`
   */
  toString(format?: 'asn' | 'pem' | 'hex' | 'base64' | 'text' | 'base64url'): string;
  equal(crl: X509CertificateRevocationList): boolean;
}
//#endregion
//# sourceMappingURL=X509CertificateRevocationList.d.mts.map