import type { ISmimeCertificateBundle, ISmimeCertificateMetadata, ISmimeEncryptionResult, ISmimeSignatureResult, ISmimeVerificationResult } from '../../interfaces/messaging/smimeCertificate';
/**
 * Manages S/MIME X.509 certificate lifecycle: import, export, validation,
 * and CMS encryption/signing operations.
 *
 * Wraps @peculiar/x509 for certificate parsing and pkijs for CMS operations.
 *
 * @see Requirements 6.1, 6.2, 6.4, 6.5, 6.7, 7.1, 8.1, 9.2
 */
export declare class SmimeCertificateManager {
    private _x509;
    private x509;
    /**
     * Import a PEM or DER X.509 certificate, validate structure, and extract metadata.
     *
     * @param content - PEM string or DER Uint8Array certificate data
     * @param format - Certificate format: 'pem' or 'der'
     * @returns Metadata extracted from the imported certificate
     * @throws EmailError with SMIME_INVALID_CERT if the certificate is malformed
     *
     * @see Requirement 6.1 — Validate well-formed X.509 certificate in PEM or DER format
     * @see Requirement 6.7 — Import S/MIME certificate from another user or CA
     */
    importCertificate(content: string | Uint8Array, format: 'pem' | 'der'): Promise<ISmimeCertificateMetadata>;
    /**
     * Import a PKCS#12 bundle (.p12/.pfx), extract certificate and private key.
     *
     * @param data - Raw PKCS#12 binary data
     * @param password - Password to decrypt the PKCS#12 bundle
     * @returns Certificate bundle with PEM certificate, optional PEM private key, and metadata
     * @throws EmailError with SMIME_PKCS12_FAILED on extraction failure
     *
     * @see Requirement 6.2 — Extract and store certificate and private key from PKCS#12
     */
    importPkcs12(data: Uint8Array, password: string): Promise<ISmimeCertificateBundle>;
    /**
     * Export a certificate as PEM, validating it first.
     *
     * @param certificatePem - PEM-encoded X.509 certificate to export
     * @returns The validated PEM-encoded certificate string
     * @throws EmailError with SMIME_INVALID_CERT if the certificate is malformed
     *
     * @see Requirement 15.2 — PEM round-trip property
     */
    exportCertificatePem(certificatePem: string): Promise<string>;
    /**
     * Validate that content is a well-formed X.509 certificate.
     *
     * @param content - PEM string or DER Uint8Array certificate data
     * @param format - Certificate format: 'pem' or 'der'
     * @returns true if the content is a valid X.509 certificate
     *
     * @see Requirement 6.5 — Reject invalid X.509 certificates
     */
    validateCertificate(content: string | Uint8Array, format: 'pem' | 'der'): Promise<boolean>;
    /**
     * Encrypt content using CMS/PKCS#7 enveloped-data for one or more recipients.
     *
     * Uses pkijs EnvelopedData with AES-256-CBC content encryption and
     * RSA-OAEP (SHA-256) key transport per RFC 5751.
     *
     * @param content - Plaintext content to encrypt
     * @param recipientCertificatesPem - PEM-encoded X.509 certificates of recipients
     * @returns CMS enveloped-data result with DER-encoded content and MIME content type
     * @throws EmailError with SMIME_ENCRYPT_FAILED on any failure
     *
     * @see Requirement 7.1 — CMS/PKCS#7 encryption per RFC 5751
     * @see Requirement 7.3 — S/MIME encrypted message output (application/pkcs7-mime)
     * @see Requirement 7.4 — Error on invalid/expired certificate
     */
    encrypt(content: Uint8Array, recipientCertificatesPem: string[]): Promise<ISmimeEncryptionResult>;
    /**
     * Decrypt CMS/PKCS#7 enveloped-data content using a recipient's certificate and private key.
     *
     * Parses the DER-encoded ContentInfo, extracts the EnvelopedData, and decrypts
     * using the provided certificate and private key.
     *
     * @param encryptedContent - DER-encoded CMS/PKCS#7 enveloped-data
     * @param certificatePem - PEM-encoded X.509 certificate of the recipient
     * @param privateKeyPem - PEM-encoded PKCS#8 private key of the recipient
     * @returns Decrypted plaintext content
     * @throws EmailError with SMIME_DECRYPT_FAILED on any failure
     *
     * @see Requirement 9.1 — S/MIME decryption with private key
     * @see Requirement 9.5 — Error when private key is missing/invalid
     */
    decrypt(encryptedContent: Uint8Array, certificatePem: string, privateKeyPem: string): Promise<Uint8Array>;
    /**
     * Create a CMS detached signature over the given content.
     *
     * Uses pkijs SignedData with RSASSA-PKCS1-v1_5 / SHA-256 to produce
     * a DER-encoded CMS detached signature conforming to RFC 5751.
     *
     * @param content - The content to sign
     * @param certificatePem - PEM-encoded X.509 certificate of the signer
     * @param privateKeyPem - PEM-encoded PKCS#8 private key of the signer
     * @returns Signature result with DER-encoded CMS signature and signer subject
     * @throws EmailError with SMIME_VERIFY_FAILED on any failure
     *
     * @see Requirement 8.1 — CMS detached signature production
     * @see Requirement 8.2 — Sign before encrypt ordering
     */
    sign(content: Uint8Array, certificatePem: string, privateKeyPem: string): Promise<ISmimeSignatureResult>;
    /**
     * Verify a CMS detached signature against the given content and signer certificate.
     *
     * Parses the DER-encoded CMS signature, extracts the SignedData, and verifies
     * using the provided signer certificate as a trusted certificate.
     *
     * @param content - The original content that was signed
     * @param signature - DER-encoded CMS detached signature
     * @param signerCertificatePem - PEM-encoded X.509 certificate of the expected signer
     * @returns Verification result with valid status, signer subject, and optional reason
     *
     * @see Requirement 9.2 — S/MIME signature verification
     * @see Requirement 9.3 — Verification result with signer subject and valid status
     * @see Requirement 9.4 — Verification failure with reason
     */
    verify(content: Uint8Array, signature: Uint8Array, signerCertificatePem: string): Promise<ISmimeVerificationResult>;
    /**
     * Extract metadata from an X.509 certificate.
     *
     * @param cert - The parsed X.509 certificate
     * @returns Certificate metadata
     */
    private extractMetadata;
    /**
     * Extract email addresses from the Subject Alternative Name extension.
     *
     * @param cert - The parsed X.509 certificate
     * @returns Array of email addresses found in the SAN extension
     */
    private extractEmailAddresses;
    /**
     * Compute SHA-256 fingerprint of a certificate.
     *
     * @param cert - The parsed X.509 certificate
     * @returns Hex-encoded SHA-256 fingerprint
     */
    private computeFingerprint;
    /**
     * Convert a string to ArrayBuffer (UTF-16 encoding as expected by pkijs).
     *
     * @param str - The string to convert
     * @returns ArrayBuffer with UTF-16 encoded string
     */
    private static stringToArrayBuffer;
    /**
     * Convert DER-encoded data to PEM format.
     *
     * @param der - DER-encoded binary data
     * @param tag - PEM tag (e.g., 'CERTIFICATE', 'PRIVATE KEY')
     * @returns PEM-encoded string
     */
    private static derToPem;
    /**
     * Ensure the pkijs crypto engine is initialized with WebCrypto.
     *
     * @param pkijs - The pkijs module
     */
    private static ensureCryptoEngine;
    /**
     * Parse a PEM-encoded X.509 certificate into a pkijs Certificate object.
     *
     * @param pem - PEM-encoded certificate string
     * @param asn1js - The asn1js module
     * @param pkijs - The pkijs module
     * @returns pkijs Certificate instance
     */
    private static pemToPkijsCertificate;
    /**
     * Import a PEM-encoded PKCS#8 private key as a CryptoKey for signing.
     *
     * Uses RSASSA-PKCS1-v1_5 with SHA-256, which is the standard algorithm
     * for CMS/S/MIME digital signatures.
     *
     * @param pem - PEM-encoded PKCS#8 private key
     * @returns CryptoKey suitable for signing
     */
    private static pemToSigningKey;
    /**
     * Extract the subject distinguished name string from a pkijs Certificate.
     *
     * @param cert - pkijs Certificate instance
     * @returns Subject DN string (e.g., "CN=John Doe, O=Example Corp")
     */
    private static extractPkijsCertSubject;
    /**
     * Import a PEM-encoded PKCS#8 private key as a CryptoKey for decryption.
     *
     * Tries RSA-OAEP first, then falls back to ECDH if RSA import fails.
     *
     * @param pem - PEM-encoded PKCS#8 private key
     * @returns CryptoKey suitable for decryption
     */
    private static pemToPrivateKey;
    /**
     * Find the recipient index in an EnvelopedData structure that matches
     * the given certificate.
     *
     * @param envelopedData - The pkijs EnvelopedData structure
     * @param recipientCert - The pkijs Certificate to match
     * @returns The zero-based index of the matching recipient
     */
    private static findRecipientIndex;
}
//# sourceMappingURL=smimeCertificateManager.d.ts.map