import { KeyObject } from 'node:crypto';
import { D as DkimOptions, S as SmimeEncryptOptions, E as EmailEncrypter, a as SmimeSignOptions, b as EmailSigner } from "../packem_shared/types.d-A1Eea-p_.js";
import { E as EmailOptions } from "../packem_shared/types.d-CyiC9uRC.js";
import 'node:buffer';
/**
 * The signature algorithm for the ARC headers. RSA per RFC 8617, Ed25519 per RFC 8463.
 */
type ArcAlgorithm = "ed25519-sha256" | "rsa-sha256";
/**
 * Options for {@link signArc}.
 */
interface ArcSealOptions {
  /**
   * Signature algorithm (`a=`). `rsa-sha256` (default) or `ed25519-sha256` (RFC 8463).
   * @default "rsa-sha256"
   */
  algorithm?: ArcAlgorithm;
  /**
   * The `Authentication-Results` value to chain (authserv-id plus method results),
   * e.g. `example.com; spf=pass smtp.mailfrom=...; dkim=pass header.d=...`.
   */
  authenticationResults: string;
  /**
   * Chain validation status for the seal (`cv`). For an originating sealer (instance 1) this is
   * always `none`.
   * @default "none"
   */
  cv?: "fail" | "none" | "pass";
  /**
   * The signing domain (`d`).
   */
  domainName: string;
  /**
   * Lower-cased header names covered by the ARC-Message-Signature (`h`).
   * @default from, to, cc, subject, date, message-id, mime-version
   */
  headersToSign?: string[];
  /**
   * The ARC instance number (`i`). Only `1` (originating sealer) is supported.
   * @default 1
   */
  instance?: number;
  /**
   * The DKIM/ARC key selector (`s`).
   */
  keySelector: string;
  /**
   * Passphrase for an encrypted private key.
   */
  passphrase?: string;
  /**
   * Private key (PEM string, or a `file://` path). RSA or Ed25519 to match `algorithm`.
   */
  privateKey: string;
  /**
   * Signature timestamp (`t`) in unix seconds. Defaults to now.
   */
  timestamp?: number;
}
/**
 * The three ARC header fields produced for one instance.
 */
interface ArcHeaderSet {
  "ARC-Authentication-Results": string;
  "ARC-Message-Signature": string;
  "ARC-Seal": string;
}
/**
 * Options for {@link verifyArc}.
 */
interface ArcVerifyOptions {
  /**
   * The ARC/DKIM public key for the signing domain+selector — a PEM string or a `KeyObject`. Look it
   * up at `<selector>._domainkey.<d>` (the `p=` tag), decoded to SPKI.
   */
  publicKey: KeyObject | string;
}
/**
 * The outcome of {@link verifyArc}.
 */
interface ArcVerifyResult {
  /**
   * Per-component verification: the ARC-Message-Signature, the ARC-Seal, and the body hash.
   */
  components: {
    ams: boolean;
    bodyHash: boolean;
    seal: boolean;
  };
  /**
   * The chain-validation status (`cv`) from the ARC-Seal.
   */
  cv?: string;
  /**
   * A machine-readable reason when `valid` is `false`.
   */
  reason?: string;
  /**
   * Whether the whole instance verified (signature + seal + body hash).
   */
  valid: boolean;
}
/**
 * Computes the exact byte string that the ARC-Message-Signature `b=` value signs.
 *
 * Exposed so ARC verifiers (and tests) can re-derive the signing input.
 * @param message The serialized MIME message being sealed.
 * @param options The seal options.
 * @returns The AMS header (without the `b=` value) and the data signed.
 * @throws {Error} When `message` has no header/body separator.
 */
declare const arcMessageSignatureBase: (message: string, options: ArcSealOptions) => {
  header: string;
  signBase: string;
};
/**
 * Computes the exact byte string that the ARC-Seal `b=` value signs (for an originating, i=1 seal).
 *
 * Exposed so ARC verifiers (and tests) can re-derive the signing input.
 * @param aarValue The ARC-Authentication-Results value.
 * @param amsValue The full ARC-Message-Signature value (including its `b=` signature).
 * @param options The signing domain, selector, instance, timestamp and chain-validation status.
 * @returns The ARC-Seal header (without the `b=` value) and the data signed.
 */
declare const arcSealBase: (aarValue: string, amsValue: string, options: ArcSealOptions) => {
  header: string;
  signBase: string;
};
/**
 * Seals a message with an ARC (Authenticated Received Chain, RFC 8617) header set for an originating
 * sealer (instance `i=1`).
 *
 * Adds `ARC-Authentication-Results`, `ARC-Message-Signature`, and `ARC-Seal` headers. Use this when
 * your service forwards mail and wants downstream receivers to trust the authentication results you
 * observed. Supports RSA (default) and Ed25519 (`algorithm: "ed25519-sha256"`, RFC 8463) keys.
 *
 * Takes the serialized message rather than `EmailOptions`, because an ARC seal — like a DKIM
 * signature — commits to the bytes on the wire: `bh=` hashes the transmitted body and `h=` covers
 * the headers a downstream verifier will actually read. Forwarding is where ARC belongs, and there
 * the raw message is what you already have.
 * @param message The serialized MIME message to seal.
 * @param options The seal options. See {@link ArcSealOptions}.
 * @returns The message with the ARC header set prepended, and the raw {@link ArcHeaderSet}.
 * @throws {Error} When the message is not a complete MIME message, the private key cannot be
 * loaded, or signing fails.
 */
declare const signArc: (message: string, options: ArcSealOptions) => Promise<{
  headers: ArcHeaderSet;
  message: string;
}>;
/**
 * Verifies an originating (i=1) ARC header set against the signing domain's public key.
 *
 * Re-derives the AMS and ARC-Seal signing inputs from the message + the supplied ARC headers,
 * recomputes the body hash, and checks all three. The public key must be the one published for the
 * seal's `s=`/`d=` (the DKIM-style `&lt;selector>._domainkey.&lt;domain>` TXT `p=` value).
 * @param message The serialized MIME message that was sealed, without the ARC header set.
 * @param headers The ARC header set (or any record containing the three `ARC-*` headers).
 * @param options Verification options. See {@link ArcVerifyOptions}.
 * @returns The verification result. See {@link ArcVerifyResult}.
 */
declare const verifyArc: (message: string, headers: ArcHeaderSet | Record<string, string>, options: ArcVerifyOptions) => ArcVerifyResult;
/**
 * DKIM signer.
 *
 * DKIM signs the message **as transmitted**: the `bh=` tag is a hash of the canonicalized MIME
 * body, and `h=` covers the headers the recipient's MTA will see. That means signing can only
 * happen after the message has been serialized, so this deliberately does **not** implement
 * `EmailSigner` — `MailMessage.sign()` runs at the `EmailOptions` layer, where the body does not
 * exist yet, and passing a DKIM signer there is a compile error rather than a runtime surprise.
 * Configure DKIM on a transport that emits raw MIME instead.
 */
declare class DkimSigner {
  private readonly options;
  /**
   * Creates a new DKIM signer.
   * @param options DKIM signing options.
   */
  constructor(options: DkimOptions);
  /**
   * Signs a fully-built MIME message and returns it with a `DKIM-Signature` header prepended.
   * @param message The complete MIME message: headers, a blank line, then the body, CRLF-delimited.
   * @returns The message with the signature prepended.
   * @throws {Error} When the message has no header/body separator, has no signable `From` header,
   * or signing fails (e.g. an unreadable or malformed private key).
   * @example
   * ```typescript
   * const raw = await buildMimeMessage(emailOptions);
   * const signed = await createDkimSigner({ domainName: "example.com", keySelector: "s1", privateKey }).signMimeMessage(raw);
   * ```
   */
  signMimeMessage(message: string): Promise<string>;
}
/**
 * Creates a DKIM signer instance.
 * @param options DKIM signing options.
 * @returns A new DkimSigner instance.
 */
declare const createDkimSigner: (options: DkimOptions) => DkimSigner;
/**
 * Builds a signer for a transport that writes the MIME message itself.
 *
 * Canonicalization defaults to relaxed/relaxed rather than the `simple/simple` of
 * {@link DkimOptions}: SMTP hops routinely re-wrap whitespace, which `simple` does not survive.
 * Callers can still override either field.
 * @param options DKIM signing options from the transport config.
 * @returns A signer configured for on-the-wire use.
 */
declare const createTransportDkimSigner: (options: DkimOptions) => DkimSigner;
/**
 * S/MIME encrypter implementation using PKIjs
 * Note: Requires pkijs and asn1js for S/MIME operations
 * Uses Node.js crypto for all cryptographic operations
 */
declare class SmimeEncrypter implements EmailEncrypter {
  /**
   * Collects and normalizes all recipients (to, cc, bcc) from email options.
   * Normalizes each to an array, extracts email addresses, and deduplicates.
   * @param email The email options containing recipients.
   * @returns An array of unique email addresses (strings).
   */
  private static collectRecipients;
  /**
   * Formats an email address for use in email headers.
   * @param address The email address to format (string or EmailAddress object).
   * @returns The formatted email address string in RFC 5322 format.
   */
  private static formatAddress;
  /**
   * Formats email addresses for use in email headers.
   * @param addresses The email addresses to format (single or array, string or EmailAddress objects).
   * @returns The formatted email addresses string (comma-separated if multiple).
   */
  private static formatAddresses;
  private readonly options;
  /**
   * Creates a new S/MIME encrypter.
   * @param options S/MIME encryption options.
   */
  constructor(options: SmimeEncryptOptions);
  /**
   * Encrypts an email message with S/MIME.
   * @param email The email options to encrypt.
   * @returns The encrypted email options.
   * @throws {Error} When encryption fails (e.g., invalid certificate).
   */
  encrypt(email: EmailOptions): Promise<EmailOptions>;
  /**
   * Builds the email message string from email options.
   * @param email The email options to build the message from.
   * @returns The formatted email message as a string.
   */
  private buildMessage;
}
/**
 * Creates a new S/MIME encrypter instance.
 * @param options The S/MIME encryption options.
 * @returns A new SmimeEncrypter instance ready to encrypt emails.
 */
declare const createSmimeEncrypter: (options: SmimeEncryptOptions) => SmimeEncrypter;
/**
 * S/MIME signer implementation using PKIjs
 * Note: Requires pkijs and asn1js for S/MIME operations
 * Uses Node.js crypto for all cryptographic operations
 */
declare class SmimeSigner implements EmailSigner {
  /**
   * Formats an email address for use in email headers.
   * @param address The email address object to format.
   * @param address.email The email address string.
   * @param address.name Optional display name for the email address.
   * @returns The formatted email address string in RFC 5322 format.
   */
  private static formatAddress;
  private readonly options;
  /**
   * Creates a new S/MIME signer.
   * @param options S/MIME signing options.
   */
  constructor(options: SmimeSignOptions);
  /**
   * Signs an email message with S/MIME.
   * @param email The email options to sign.
   * @returns The email options with S/MIME signature.
   * @throws {Error} When signing fails (e.g., invalid certificate/key).
   */
  sign(email: EmailOptions): Promise<EmailOptions>;
  /**
   * Builds the email message string from email options.
   * @param email The email options to build the message from.
   * @returns The formatted email message as a string.
   */
  private buildMessage;
  /**
   * Formats email addresses for use in email headers.
   * @param addresses The email addresses to format (single or array).
   * @returns The formatted email addresses string (comma-separated if multiple).
   */
  private formatAddresses;
}
/**
 * Creates a new S/MIME signer instance.
 * @param options The S/MIME signing options.
 * @returns A new SmimeSigner instance ready to sign emails.
 */
declare const createSmimeSigner: (options: SmimeSignOptions) => SmimeSigner;
export { type ArcAlgorithm, type ArcHeaderSet, type ArcSealOptions, type ArcVerifyOptions, type ArcVerifyResult, type DkimOptions, DkimSigner, type EmailEncrypter, type EmailSigner, type SmimeEncryptOptions, SmimeEncrypter, type SmimeSignOptions, SmimeSigner, arcMessageSignatureBase, arcSealBase, createDkimSigner, createSmimeEncrypter, createSmimeSigner, createTransportDkimSigner, signArc, verifyArc };