import { X509Certificate } from "./X509Certificate.mjs";
import { X509CertificateRevocationList } from "./X509CertificateRevocationList.mjs";
import { X509CreateCertificateOptions, X509CreateCertificateRevocationListOptions, X509CreateCertificateSigningRequestOptions, X509GetLeafCertificateOptions, X509ParseCertificateOptions, X509ParseCertificateSigningRequestOptions, X509ValidateCertificateChainOptions } from "./X509ServiceOptions.mjs";
import { CertificateSigningRequest } from "./CertificateSigningRequest.mjs";
import { AgentContext } from "../../agent/context/AgentContext.mjs";
import "../../agent/index.mjs";
//#region src/modules/x509/X509Service.d.ts
export declare class X509Service {
  /**
   *
   * Validate a chain of X.509 certificates according to RFC 5280
   *
   * This function requires a list of base64 encoded certificates and, optionally, a certificate that should be found in the chain.
   * If no certificate is provided, it will just assume the leaf certificate
   *
   * The leaf certificate should be the 0th index and the root the last
   *
   * The Issuer of the certificate is found with the following algorithm:
   * - Check if there is an AuthorityKeyIdentifierExtension
   * - Go through all the other certificates and see if the SubjectKeyIdentifier is equal to the AuthorityKeyIdentifier
   * - If they are equal, the certificate signature is verified and returned as the issuer
   *
   * Validation checks performed:
   *   - Chain validation (structure, signatures, validity, trust anchor)
   *   - Basic constraints are valid for CA certificates
   *   - Key usage of issuing CA certificates includes `keyCertSign` (when the extension is present)
   *   - Path length constraints are satisfied
   *   - All critical extensions are understood and valid
   *   - Certificates have not been revoked (CRL) - if enabled
   *
   * Limitations (RFC 5280 features not enforced here):
   *   - Revocation is checked via CRL only; OCSP is not supported.
   *   - Name Constraints (§4.2.1.10), Policy Constraints (§4.2.1.11), and Certificate Policies
   *     (§4.2.1.4) are not enforced. A certificate carrying one of these as a *critical* extension is
   *     rejected (unrecognized critical extension); a non-critical occurrence is ignored.
   *   - Extended Key Usage is parsed but not enforced.
   *   - Key Usage is only enforced when the extension is present (it is optional; absent means
   *     unrestricted).
   *   - Subject/Issuer Alternative Names only surface the URI and DNS GeneralName forms.
   */
  static validateCertificateChain(agentContext: AgentContext, { certificateChain, certificate, verificationDate, trustedCertificates, allowNonRootTrustedCertificate }: X509ValidateCertificateChainOptions): Promise<X509Certificate[]>;
  /**
   *
   * Parses a base64-encoded X.509 certificate into a {@link X509Certificate}
   *
   */
  static parseCertificate(_agentContext: AgentContext, { encodedCertificate }: X509ParseCertificateOptions): X509Certificate;
  static getLeafCertificate(_agentContext: AgentContext, { certificateChain }: X509GetLeafCertificateOptions): X509Certificate;
  static createCertificate(agentContext: AgentContext, options: X509CreateCertificateOptions): Promise<X509Certificate>;
  static createCertificateSigningRequest(agentContext: AgentContext, options: X509CreateCertificateSigningRequestOptions): Promise<CertificateSigningRequest>;
  /**
   * Creates and signs a X.509 Certificate Revocation List (CRL).
   *
   * Supported CRL extensions: CRL Number (§5.2.3), Delta CRL Indicator (§5.2.4), Authority Key
   * Identifier (§5.2.1) and Issuing Distribution Point (§5.2.5), plus the per-entry
   * `certificateIssuer` extension (§5.3.3) for indirect CRLs. Other CRL extensions are not produced.
   *
   * Note: issuer/subject names built from a structured object only support the `CN`, `C`, `OU` and
   * `ST` distinguished-name attributes; pass a raw DN string to use any other attribute.
   */
  static createCertificateRevocationList(agentContext: AgentContext, options: X509CreateCertificateRevocationListOptions): Promise<X509CertificateRevocationList>;
  static parseCertificateSigningRequest({ encodedCertificateSigningRequest }: X509ParseCertificateSigningRequestOptions): CertificateSigningRequest;
  /**
   * Validates path length constraints for a certificate chain
   * Per RFC 5280 Section 4.2.1.9
   */
  private static validatePathLengthConstraints;
  /**
   * Validates basic constraints for CA certificates in the chain
   * Per RFC 5280 Section 4.2.1.9
   */
  private static validateBasicConstraintsForChain;
  /**
   * Validates the Key Usage extension of the issuing CA certificates in the chain.
   * Per RFC 5280 §4.2.1.3 / §6.1.4(n): a certificate used to sign other certificates MUST, when it
   * asserts a Key Usage extension, include the `keyCertSign` bit.
   *
   * Key Usage is optional in a certificate; when the extension is absent, all usages are permitted
   * and no constraint is enforced. Only the issuing certificates (every certificate except the leaf)
   * are checked.
   */
  private static validateKeyUsageForChain;
}
//#endregion
//# sourceMappingURL=X509Service.d.mts.map