import { X509Certificate } from "./X509Certificate.mjs";
import { X509RevocationCheckOptions } from "./X509ValidationOptions.mjs";
import { SdJwtVc } from "../sd-jwt-vc/SdJwtVcService.mjs";
import { JwtPayload } from "../../crypto/jose/jwt/JwtPayload.mjs";
import { W3cJwtVerifiableCredential } from "../vc/jwt-vc/W3cJwtVerifiableCredential.mjs";
import { W3cJwtVerifiablePresentation } from "../vc/jwt-vc/W3cJwtVerifiablePresentation.mjs";
import { Mdoc } from "../mdoc/Mdoc.mjs";
import { VerificationTypeMdocReaderAuth } from "../../agent/TrustedIssuersForVerification.mjs";
import { AgentContext } from "../../agent/context/AgentContext.mjs";
//#region src/modules/x509/X509ModuleConfig.d.ts
export type X509VerificationTrustedCertificates = {
  issuance: string[];
  status?: string[];
};
export type X509VerificationTypeCredential = {
  type: 'credential';
  credential: SdJwtVc | Mdoc | W3cJwtVerifiableCredential | W3cJwtVerifiablePresentation;
  /**
   * The `id` of the `DidCommProofRecord` that this verification is bound to.
   */
  didcommProofRecordId?: string;
  /**
   * The `id` of the `OpenId4VcVerificationSessionRecord` that this verification is bound to.
   */
  openId4VcVerificationSessionId?: string;
};
/**
 * Reader authentication on an incoming mdoc request.
 *
 * There is no separate legacy shape for this verification type: reader authentication is only
 * resolved on the DC API paths that were added after this callback was deprecated, so the type of
 * the `getTrustedIssuersForVerification` callback is reused as-is.
 */
export type X509VerificationTypeMdocReaderAuth = VerificationTypeMdocReaderAuth;
export type X509VerificationTypeOauth2SecuredAuthorizationRequest = {
  type: 'oauth2SecuredAuthorizationRequest';
  authorizationRequest: {
    jwt: string;
    payload: JwtPayload;
  };
};
export type X509VerificationTypeOpenId4VciKeyAttestation = {
  type: 'openId4VciKeyAttestation';
  /**
   * The `id` of the `OpenId4VcIssuanceSessionRecord` that this key
   * attestation verification is bound to.
   */
  openId4VcIssuanceSessionId: string;
  keyAttestation: {
    jwt: string;
    payload: JwtPayload;
  };
};
export type X509VerificationTypeOpenId4VciCredentialIssuerMetadata = {
  type: 'openId4VciCredentialIssuerMetadata';
  credentialIssuerMetadata: {
    jwt: string;
    payload: JwtPayload;
  };
};
export type X509VerificationTypeOauth2ClientAttestation = {
  type: 'oauth2ClientAttestation';
  /**
   * The `id` of the `OpenId4VcIssuanceSessionRecord` that this client
   * attestation verification is bound to.
   */
  openId4VcIssuanceSessionId: string;
  clientAttestation: {
    jwt: string;
    payload: JwtPayload;
  };
};
export interface X509VerificationContext {
  /**
   * The certificate chain provided with the data to be verified. The trusted certificates
   * are determined before verification and thus it is not verified that the data was actually
   * signed by the private key associated with the leaf certificate in the certificate chain, or
   * whether the certificate chain is valid. However if the certificate
   * does not match, or is not valid, verification will always fail at a later stage
   */
  certificateChain: X509Certificate[];
  verification: X509VerificationTypeCredential | X509VerificationTypeMdocReaderAuth | X509VerificationTypeOauth2SecuredAuthorizationRequest | X509VerificationTypeOauth2ClientAttestation | X509VerificationTypeOpenId4VciKeyAttestation | X509VerificationTypeOpenId4VciCredentialIssuerMetadata;
}
export interface X509ModuleConfigOptions {
  /**
   *
   * Array of trusted base64-encoded certificate strings in the DER-format.
   */
  trustedCertificates?: Array<string | X509Certificate>;
  /**
   * Optional callback method that will be called to dynamically get trusted certificates for a verification.
   * It will provide the `agentContext` and `verificationContext` allowing to dynamically set the trusted certificates
   * for a tenant or verification context.
   *
   * If no certificates should be trusted an empty array should be returned. If `undefined` is returned
   * it will fallback to the globally registered trusted certificates
   *
   * @deprecated use the global `getTrustedIssuersForVerification` instead
   * @returns An array of base64-encoded certificate strings or PEM certificate strings.
   */
  getTrustedCertificatesForVerification?(agentContext: AgentContext, verificationContext: X509VerificationContext): Promise<string[] | undefined | X509VerificationTrustedCertificates[]> | string[] | X509VerificationTrustedCertificates[] | undefined;
  /**
   * Configuration for certificate revocation checking
   * @default
   * ```
   * {
   *  mode: X509RevocationCheckMode.SoftFail, // do not fail on network error
   *  checkFullChain: true, // check the leaf and all intermediate CAs
   *  timeoutMs: 5000, // 5 seconds
   *  maxCrlSizeBytes: 10485760, // 10MB
   *  crlCacheExpirySeconds: 3600 // 1 hour
   * }
   * ```
   */
  revocationCheck?: X509RevocationCheckOptions;
}
export declare class X509ModuleConfig {
  #private;
  constructor(options?: X509ModuleConfigOptions);
  get trustedCertificates(): string[] | undefined;
  /**
   * @deprecated use the global `getTrustedIssuersForVerification` instead
   */
  get getTrustedCertificatesForVerification(): ((agentContext: AgentContext, verificationContext: X509VerificationContext) => Promise<string[] | undefined | X509VerificationTrustedCertificates[]> | string[] | X509VerificationTrustedCertificates[] | undefined) | undefined;
  /**
   * @deprecated use the global `getTrustedIssuersForVerification` instead
   */
  setTrustedCertificatesForVerification(fn: X509ModuleConfigOptions['getTrustedCertificatesForVerification']): void;
  get revocationCheck(): X509RevocationCheckOptions | undefined;
  setRevocationCheck(options?: X509RevocationCheckOptions): void;
  setTrustedCertificates(trustedCertificates?: Array<string | X509Certificate>): void;
  addTrustedCertificate(trustedCertificate: string | X509Certificate): void;
}
//#endregion
//# sourceMappingURL=X509ModuleConfig.d.mts.map