import { ErrorResult, Micro509Error } from "../result/result.js";
//#region src/pem/pem.d.ts
/** A single decoded PEM block with its label, decoded DER bytes, and original PEM text. */
interface PemBlock {
  /** RFC 7468 label between the `BEGIN` / `END` markers (e.g. `"CERTIFICATE"`). */
  readonly label: string;
  /** Decoded DER content of this block. */
  readonly bytes: Uint8Array;
  /** The original PEM text including `BEGIN`/`END` lines. */
  readonly pem: string;
}
/**
 * PEM blocks grouped by their label into well-known PKI categories.
 * Blocks that don't match any known label land in {@linkcode others}.
 */
interface CategorizedPemBlocks {
  /** Blocks with label `CERTIFICATE`. */
  readonly certificates: readonly PemBlock[];
  /** Blocks with label `CERTIFICATE REQUEST`. */
  readonly certificateRequests: readonly PemBlock[];
  /** Blocks with label `PRIVATE KEY`, `RSA PRIVATE KEY`, or `EC PRIVATE KEY`. */
  readonly privateKeys: readonly PemBlock[];
  /** Blocks with label `PUBLIC KEY`. */
  readonly publicKeys: readonly PemBlock[];
  /** Blocks whose label doesn't match any of the above categories. */
  readonly others: readonly PemBlock[];
}
/**
 * Wraps DER bytes in a PEM envelope with 64-character base64 lines.
 *
 * @param label PEM type label (e.g. `"CERTIFICATE"`, `"PRIVATE KEY"`).
 * @param der Raw DER-encoded content.
 */
declare function pemEncode(label: string, der: Uint8Array): string;
/** Machine-readable failure reason for the PEM decoders. */
type PemErrorCode = "malformed";
/** Structured failure payload for PEM decoding. */
interface PemFailure extends Micro509Error<PemErrorCode> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/** Success-or-failure result from {@linkcode pemDecode}. */
type PemDecodeResult = {
  readonly ok: true;
  readonly value: Uint8Array;
} | ErrorResult<PemErrorCode, Record<never, never>, PemFailure>;
/** Success-or-failure result from {@linkcode splitPemBlocks}. */
type SplitPemBlocksResult = {
  readonly ok: true;
  readonly value: readonly PemBlock[];
} | ErrorResult<PemErrorCode, Record<never, never>, PemFailure>;
/** Success-or-failure result from {@linkcode categorizePemBlocks}. */
type CategorizePemBlocksResult = {
  readonly ok: true;
  readonly value: CategorizedPemBlocks;
} | ErrorResult<PemErrorCode, Record<never, never>, PemFailure>;
/**
 * Throwing core for {@linkcode pemDecode}: extracts and base64-decodes the
 * DER content from a PEM string. Text ahead of the `BEGIN` line is ignored.
 * Throws if the `BEGIN`/`END` markers don't match `label`.
 *
 * @param label Expected PEM type label.
 * @param pem PEM-encoded text (may contain `\r`).
 */
declare function pemDecodeOrThrow(label: string, pem: string): Uint8Array;
/**
 * Finds all `BEGIN`/`END`-delimited PEM blocks in a string and returns
 * them as parsed {@linkcode PemBlock} entries. Handles concatenated PEM files
 * and ignores non-PEM text between blocks.
 */
declare function splitPemBlocksOrThrow(input: string): readonly PemBlock[];
/**
 * Groups PEM blocks by label into well-known PKI categories
 * (certificates, CSRs, private keys, public keys, and everything else).
 * Accepts either raw PEM text or pre-split {@linkcode PemBlock} entries.
 */
declare function categorizePemBlocksOrThrow(input: string | readonly PemBlock[]): CategorizedPemBlocks;
/**
 * Extracts and base64-decodes the DER content from a PEM string.
 * Text ahead of the `BEGIN` line is ignored.
 *
 * Returns a typed failure (`code: 'malformed'`) when the `BEGIN`/`END`
 * markers don't match `label` or the body is not valid base64. For the
 * throwing form use {@linkcode pemDecodeOrThrow}.
 */
declare function pemDecode(label: string, pem: string): PemDecodeResult;
/**
 * Finds all `BEGIN`/`END`-delimited PEM blocks in a string and returns them
 * as parsed {@linkcode PemBlock} entries. Handles concatenated PEM files and
 * ignores non-PEM text between blocks.
 *
 * Returns a typed failure (`code: 'malformed'`) on stray or truncated PEM
 * markers. For the throwing form use {@linkcode splitPemBlocksOrThrow}.
 */
declare function splitPemBlocks(input: string): SplitPemBlocksResult;
/**
 * Groups PEM blocks by label into well-known PKI categories
 * (certificates, CSRs, private keys, public keys, and everything else).
 * Accepts either raw PEM text or pre-split {@linkcode PemBlock} entries.
 *
 * Returns a typed failure (`code: 'malformed'`) when raw text contains stray
 * or truncated PEM markers. For the throwing form use
 * {@linkcode categorizePemBlocksOrThrow}.
 */
declare function categorizePemBlocks(input: string | readonly PemBlock[]): CategorizePemBlocksResult;
//#endregion
export { CategorizePemBlocksResult, CategorizedPemBlocks, PemBlock, PemDecodeResult, PemErrorCode, PemFailure, SplitPemBlocksResult, categorizePemBlocks, categorizePemBlocksOrThrow, pemDecode, pemDecodeOrThrow, pemEncode, splitPemBlocks, splitPemBlocksOrThrow };
//# sourceMappingURL=pem.d.ts.map