/**
 * Issuer Configuration Schema Extensions (v0.11.3+)
 *
 * Zod schemas for revoked_keys field in peac-issuer.json.
 * Reason values aligned with RFC 5280 CRLReason subset
 * (only values meaningful for receipt signing keys).
 *
 * @packageDocumentation
 */
import { z } from 'zod';
/**
 * Revocation reasons: RFC 5280 CRLReason subset relevant to receipt signing keys.
 */
export declare const REVOCATION_REASONS: readonly ["key_compromise", "superseded", "cessation_of_operation", "privilege_withdrawn"];
export type RevocationReason = (typeof REVOCATION_REASONS)[number];
/**
 * Schema for a single revoked key entry.
 */
export declare const RevokedKeyEntrySchema: z.ZodObject<{
    kid: z.ZodString;
    revoked_at: z.ZodString;
    reason: z.ZodOptional<z.ZodEnum<{
        key_compromise: "key_compromise";
        superseded: "superseded";
        cessation_of_operation: "cessation_of_operation";
        privilege_withdrawn: "privilege_withdrawn";
    }>>;
}, z.core.$strict>;
export type RevokedKeyEntryInput = z.input<typeof RevokedKeyEntrySchema>;
export type RevokedKeyEntryOutput = z.output<typeof RevokedKeyEntrySchema>;
/**
 * Schema for the revoked_keys array in issuer configuration.
 * Maximum 100 entries to prevent unbounded growth.
 */
export declare const RevokedKeysArraySchema: z.ZodArray<z.ZodObject<{
    kid: z.ZodString;
    revoked_at: z.ZodString;
    reason: z.ZodOptional<z.ZodEnum<{
        key_compromise: "key_compromise";
        superseded: "superseded";
        cessation_of_operation: "cessation_of_operation";
        privilege_withdrawn: "privilege_withdrawn";
    }>>;
}, z.core.$strict>>;
/**
 * Validate a revoked_keys array.
 * Returns a discriminated result (no exceptions).
 */
export declare function validateRevokedKeys(data: unknown): {
    ok: true;
    value: RevokedKeyEntryOutput[];
} | {
    ok: false;
    error: string;
};
/**
 * Check if a kid is present in a revoked_keys array.
 * Returns the revocation entry if found, null otherwise.
 */
export declare function findRevokedKey(revokedKeys: RevokedKeyEntryOutput[], kid: string): RevokedKeyEntryOutput | null;
//# sourceMappingURL=issuer-config.d.ts.map