/**
 * DNSSEC validation utilities and record type definitions
 *
 * @packageDocumentation DNSSEC
 */
import type { ValueOf } from "type-fest";
import type { DNSKEYRecord, DSRecord, NSEC3PARAMRecord, NSEC3Record, NSECRecord, RRSIGRecord } from "./types.js";
/**
 * DNSSEC digest algorithms
 */
export declare const DigestAlgorithm: {
    readonly SHA1: 1;
    readonly SHA256: 2;
    readonly GOST: 3;
    readonly SHA384: 4;
};
/**
 * DNSSEC digest algorithm number.
 */
export type DigestAlgorithm = ValueOf<typeof DigestAlgorithm>;
/**
 * DNSSEC key flags
 */
export declare const DNSKEYFlags: {
    readonly SEP: 1;
    readonly REVOKE: 128;
    readonly ZONE_KEY: 256;
};
/**
 * DNSKEY flag bitmask value.
 */
export type DNSKEYFlags = ValueOf<typeof DNSKEYFlags>;
/**
 * DNSSEC algorithms as defined in RFC 8624
 */
export declare const DNSSECAlgorithm: {
    readonly RSAMD5: 1;
    readonly DH: 2;
    readonly DSA: 3;
    readonly RSASHA1: 5;
    readonly DSA_NSEC3_SHA1: 6;
    readonly RSASHA1_NSEC3_SHA1: 7;
    readonly RSASHA256: 8;
    readonly RSASHA512: 10;
    readonly ECC_GOST: 12;
    readonly ECDSAP256SHA256: 13;
    readonly ECDSAP384SHA384: 14;
    readonly ED25519: 15;
    readonly ED448: 16;
};
/**
 * DNSSEC algorithm number.
 */
export type DNSSECAlgorithm = ValueOf<typeof DNSSECAlgorithm>;
/**
 * NSEC3 hash algorithms
 */
export declare const NSEC3HashAlgorithm: {
    readonly SHA1: 1;
};
/**
 * NSEC3 hash algorithm number.
 */
export type NSEC3HashAlgorithm = ValueOf<typeof NSEC3HashAlgorithm>;
/**
 * Calculates DNSKEY key tag (RFC 4034 Appendix B)
 */
export declare function calculateKeyTag(dnskey: Readonly<DNSKEYRecord>): number;
/**
 * Checks if a DNSSEC algorithm is recommended for use
 */
export declare function isRecommendedAlgorithm(algorithm: DNSSECAlgorithm): boolean;
/**
 * Checks if a digest algorithm is recommended for use
 */
export declare function isRecommendedDigestAlgorithm(algorithm: DigestAlgorithm): boolean;
/**
 * Validates a DNSKEY record
 *
 * @throws DNSValidationError When the DNSKEY record is invalid.
 */
export declare function validateDNSKEY(record: unknown): DNSKEYRecord;
/**
 * Validates a DS record
 *
 * @throws DNSValidationError When the DS record is invalid.
 */
export declare function validateDS(record: unknown): DSRecord;
/**
 * Validates an NSEC record
 *
 * @throws DNSValidationError When the NSEC record is invalid.
 */
export declare function validateNSEC(record: unknown): NSECRecord;
/**
 * Validates an NSEC3 record
 *
 * @throws DNSValidationError When the NSEC3 record is invalid.
 */
export declare function validateNSEC3(record: unknown): NSEC3Record;
/**
 * Validates an NSEC3PARAM record
 *
 * @throws DNSValidationError When the NSEC3PARAM record is invalid.
 */
export declare function validateNSEC3PARAM(record: unknown): NSEC3PARAMRecord;
/**
 * Validates a RRSIG record
 *
 * @throws DNSValidationError When the RRSIG record is invalid.
 */
export declare function validateRRSIG(record: unknown): RRSIGRecord;
/**
 * Validates DNSSEC signature timestamps
 */
export declare function validateSignatureTimestamps(inception: number, expiration: number, clockSkew?: number): boolean;
//# sourceMappingURL=dnssec.d.ts.map