import { X509Certificate } from "./X509Certificate.mjs";
import { X509CertificateRevocationList } from "./X509CertificateRevocationList.mjs";
import { X509CheckCertificateRevocationOptions, X509FetchCertificateRevocationListOptions } from "./X509ServiceOptions.mjs";
import { X509CertificateSingleValidationResult } from "./X509ValidationResult.mjs";
import { X509ModuleConfig } from "./X509ModuleConfig.mjs";
import { AgentContext } from "../../agent/context/AgentContext.mjs";
import "../../agent/index.mjs";
//#region src/modules/x509/X509RevocationService.d.ts
export interface X509RevocationCheckResult {
  isValid: boolean;
  isRevoked?: boolean;
  error?: Error;
  details?: string;
  method?: 'crl';
}
export declare class X509RevocationService {
  /**
   * Check the revocation status of a single certificate using CRL.
   */
  static checkCertificateRevocation(agentContext: AgentContext, { certificate, issuerCertificate, revocationCheckOptions }: X509CheckCertificateRevocationOptions): Promise<X509RevocationCheckResult>;
  /**
   * Check the revocation status of every certificate in a chain (the leaf and, unless
   * `checkFullChain` is disabled, the intermediate CAs). The root is skipped as it is self-issued and
   * not covered by a CRL we can fetch and verify.
   *
   * The chain must be ordered from root (index 0) to leaf (last index); each certificate's issuer is
   * the certificate that precedes it in the chain.
   *
   * The same CRL handling limitations as {@link checkCertificateRevocation} apply (CRL only; delta
   * and indirect CRLs rejected; no IDP distribution-point-name matching; no `onlySomeReasons`
   * cross-check; Freshest CRL / AIA and `invalidityDate` not processed).
   */
  static checkCertificateChainRevocation(agentContext: AgentContext, certificateChain: X509Certificate[], config: X509ModuleConfig, verificationDate: Date): Promise<X509CertificateSingleValidationResult>;
  /**
   * Checks the revocation status of a certificate using CRL with proper reason partitioning
   * Based on RFC 5280 Section 5.2.5
   */
  private static checkCrl;
  /**
   * Calculate bitmask of revocation reasons covered by a distribution point
   */
  private static calculateReasonMask;
  /**
   * Calculate the union of all reasons present in distribution points
   * Used to determine the default required reasons (no point requiring reasons the issuer never published)
   */
  private static calculateAllReasonsInDPs;
  /**
   * Convert a bitmask of revocation reasons to human-readable names
   */
  private static reasonMaskToNames;
  /**
   * Check revocation status using a single distribution point (typically a "full" DP)
   */
  private static checkDistributionPoint;
  /**
   * Determine whether a verified CRL can be used to authoritatively determine the revocation status
   * of `certificate`. Uses the CRL's own extensions (RFC 5280 §5.2.4 Delta CRL Indicator and §5.2.5
   * Issuing Distribution Point) to reject CRLs we cannot correctly interpret as a complete, direct
   * CRL covering this certificate. Returns a human-readable reason when the CRL must be rejected.
   */
  private static checkCrlApplicability;
  /**
   * Fetch and verify a CRL from a list of mirror URLs
   * Tries each URL in order until one succeeds
   */
  private static fetchAndVerifyCrl;
  /**
   * Obtain a verified CRL for a URL, preferring the cached verified summary.
   *
   * A summary is only reused when the provided issuer certificate carries the same subject name and
   * public key the summary was verified against, its key usage (when present) permits cRLSign, and
   * the summary's validity window covers `verificationDate` — together these reproduce exactly the
   * issuer-dependent checks of {@link X509CertificateRevocationList.verify}, so a renewed or
   * cross-certified issuer certificate (same name and key) reuses the summary directly. A reusable
   * summary that is still fresh (`staleAt` in the future) is then trusted from the
   * (application-controlled) cache without any network I/O; a stale one is revalidated on the full
   * path, which reuses it without re-parsing when the freshly fetched bytes are unchanged.
   *
   * Anything else — a different key or subject name, a key usage without cRLSign, an out-of-window,
   * missing or malformed summary — falls through to the full fetch-parse-verify path, which
   * produces all failure results (an unreachable host is then an availability failure like any
   * other fetch, also when revalidating a stale summary). On success the full path overwrites the
   * summary with the new issuer binding.
   */
  private static fetchVerifyAndCacheCrl;
  /**
   * Download a single CRL, parse it, and verify it against the issuer. When `useCache` is enabled,
   * a successful verification also caches a derived summary so subsequent checks can skip the
   * download and the (potentially very expensive) parse via {@link fetchVerifyAndCacheCrl}.
   *
   * `staleSummary` is a cached summary that passed all reuse gates but whose `staleAt` has passed:
   * when the fetched bytes hash to its `crlSha256`, the parse and verification are skipped and the
   * summary is re-cached with a refreshed `staleAt`.
   */
  private static fetchParseVerifyAndCacheCrl;
  /**
   * Compute the cache TTL (in seconds) for a verified CRL summary: the full time until its
   * `nextUpdate` (freshness within that window is governed by the summary's `staleAt`). Returns 0
   * when the CRL is already at/after `nextUpdate` so it is not cached. A CRL without `nextUpdate`
   * gets the freshness period itself as TTL, so its entry expires instead of being revalidated.
   */
  private static computeCacheTtlSeconds;
  /**
   * Handles errors during revocation checking based on the configured mode
   */
  private static handleRevocationError;
  /**
   * Fetch a CRL from a URL and parse it into an {@link X509CertificateRevocationList}.
   *
   * When `issuerCertificate` is provided, the CRL's signature, issuer name, issuer `cRLSign` key
   * usage, and validity window are verified, and an error is thrown on failure. When omitted, the CRL
   * is returned unverified.
   *
   * Note: this is a raw fetch+parse helper. Unlike {@link checkCertificateRevocation}, it does not
   * apply revocation-scope/applicability checks (delta/indirect/IDP scope), so it will return a delta
   * or scoped CRL as-is for inspection.
   */
  static fetchCertificateRevocationList(agentContext: AgentContext, { url, issuerCertificate, timeoutMs, maxCrlSizeBytes, verificationDate }: X509FetchCertificateRevocationListOptions): Promise<X509CertificateRevocationList>;
}
//#endregion
//# sourceMappingURL=X509RevocationService.d.mts.map