import { ErrorResult, Micro509Error } from "../result/result.js";
import { EncryptedPkcs8Options } from "../keys/keys.js";
import { ParsePkcs12MacDataErrorCode, ParsePkcs12MacDataFailure, ParsePkcs12MacDataResult, ParsedPkcs12MacData, Pkcs12MacOptions, createPkcs12MacData, parsePkcs12MacData, parsePkcs12MacDataOrThrow } from "./pkcs12-mac.js";
import { ParsedCertificate } from "../x509/parse.js";
//#region src/pkcs/pfx.d.ts
/** PEM string or DER bytes for a certificate to include in a PFX bag. */
type PfxCertificateSource = string | Uint8Array | ParsedCertificate;
/** A WebCrypto private key or raw PKCS#8 DER bytes for a PFX key bag. */
type PfxPrivateKeySource = CryptoKey | Uint8Array;
/** Optional metadata attached to a certificate or key bag inside a PFX. */
interface PfxBagAttributesInput {
  /** Human-readable label stored as a BMPString attribute. */
  readonly friendlyName?: string;
  /** Opaque identifier linking a certificate bag to its corresponding key bag. */
  readonly localKeyId?: Uint8Array;
}
/** A certificate to embed in a PFX container. Input for {@linkcode createPfx}. */
interface PfxCertificateBagInput {
  /** Certificate as PEM text or DER bytes. */
  readonly certificate: PfxCertificateSource;
  /** Optional bag-level attributes (friendly name, local key ID). */
  readonly attributes?: PfxBagAttributesInput;
}
/** A private key to embed in a PFX container. Input for {@linkcode createPfx}. */
interface PfxPrivateKeyBagInput {
  /** Private key as a WebCrypto `CryptoKey` or raw PKCS#8 DER bytes. */
  readonly privateKey: PfxPrivateKeySource;
  /** Optional bag-level attributes (friendly name, local key ID). */
  readonly attributes?: PfxBagAttributesInput;
}
/** Input for {@linkcode createPfx}. */
interface CreatePfxInput {
  /** Certificates to include as certBag entries. */
  readonly certificates?: readonly PfxCertificateBagInput[];
  /** Private keys to include as keyBag entries. */
  readonly privateKeys?: readonly PfxPrivateKeyBagInput[];
  /** PBES2 encryption settings for the key-bag ContentInfo. Omit for unencrypted. */
  readonly encryption?: PfxEncryptionOptions;
  /** PKCS#12 MAC integrity settings. Omit to skip MAC generation. */
  readonly mac?: Pkcs12MacOptions;
}
/** PBES2 encryption settings for PFX key-bag protection. Alias of {@linkcode EncryptedPkcs8Options}. */
type PfxEncryptionOptions = EncryptedPkcs8Options;
/** Options for {@linkcode parsePfxDer} and {@linkcode parsePfxPem}. */
interface ParsePfxOptions {
  /** Password used to decrypt PBES2-encrypted ContentInfo entries. Also used for MAC verification when `macPassword` is omitted. */
  readonly password?: string;
  /** Separate password for MAC verification. Falls back to `password` when omitted. */
  readonly macPassword?: string;
}
/** DER, PEM, and base64 encodings of a PFX container produced by {@linkcode createPfx}. */
interface PfxMaterial {
  /** Raw DER-encoded PFX bytes. */
  readonly der: Uint8Array;
  /** PEM-armored PFX (`-----BEGIN PKCS12-----`). */
  readonly pem: string;
  /** Base64-encoded DER (no PEM armor). */
  readonly base64: string;
}
/** A single PKCS#12 bag attribute as decoded by {@linkcode parsePfxDer}. */
interface ParsedPfxAttribute {
  /** Dotted-decimal OID identifying this attribute type. */
  readonly oid: string;
  /** Hex-encoded DER of each attribute value. */
  readonly valuesHex: readonly string[];
}
/** Decoded bag attributes for a single SafeBag inside a PFX. */
interface ParsedPfxBagAttributes {
  /** All raw attributes as OID + hex-encoded values. */
  readonly entries: readonly ParsedPfxAttribute[];
  /** Decoded BMPString friendly-name attribute, if present. */
  readonly friendlyName?: string;
  /** Hex-encoded localKeyId attribute, if present. */
  readonly localKeyId?: string;
}
/**
 * Discriminated union of SafeBag types decoded from a PFX container.
 *
 * Use `kind` to narrow: `'certificate'` | `'privateKey'` | `'unknown'`.
 */
type ParsedPfxBag = {
  /** Bag contains an X.509 certificate. */
  readonly kind: "certificate";
  /** Dotted-decimal OID of the bag type. */
  readonly bagId: string;
  /** Decoded bag-level attributes. */
  readonly attributes: ParsedPfxBagAttributes;
  /** Parsed certificate from the certBag. */
  readonly certificate: ParsedCertificate;
} | {
  /** Bag contains a PKCS#8 private key. */
  readonly kind: "privateKey";
  /** Dotted-decimal OID of the bag type. */
  readonly bagId: string;
  /** Decoded bag-level attributes. */
  readonly attributes: ParsedPfxBagAttributes;
  /** Raw DER-encoded PKCS#8 PrivateKeyInfo. */
  readonly pkcs8Der: Uint8Array;
} | {
  /** Bag type not recognized by this library. */
  readonly kind: "unknown";
  /** Dotted-decimal OID of the bag type. */
  readonly bagId: string;
  /** Decoded bag-level attributes. */
  readonly attributes: ParsedPfxBagAttributes;
  /** Raw DER of the unrecognized bag value. */
  readonly valueDer: Uint8Array;
};
/** Fully decoded PFX container returned by {@linkcode parsePfxDer} / {@linkcode parsePfxPem}. */
interface ParsedPfx {
  /** All SafeBags in the PFX, including unknown types. */
  readonly bags: readonly ParsedPfxBag[];
  /** Convenience: only the parsed certificates extracted from certBag entries. */
  readonly certificates: readonly ParsedCertificate[];
  /** Convenience: raw PKCS#8 DER of each private key extracted from keyBag entries. */
  readonly privateKeys: readonly Uint8Array[];
  /** MAC verification metadata, present when the PFX includes a MacData block. */
  readonly macData?: ParsedPkcs12MacData;
}
/** Error codes returned by {@linkcode parsePfxDer} and {@linkcode parsePfxPem}. */
type ParsePfxErrorCode = "malformed" | "invalid_password" | "password_required";
/** Error payload for a failed PFX parse. */
interface ParsePfxFailure extends Micro509Error<ParsePfxErrorCode> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/** Success-or-failure result from {@linkcode parsePfxDer} / {@linkcode parsePfxPem}. */
type ParsePfxResult = {
  /** Parse succeeded. */
  readonly ok: true;
  /** Decoded PFX container. */
  readonly value: ParsedPfx;
} | ErrorResult<ParsePfxErrorCode, Record<never, never>, ParsePfxFailure>;
/**
 * Caller-correctable failure code from {@linkcode createPfx}.
 *
 * The only parse boundary in creation is the certificate source: it is
 * normalized from untrusted PEM/DER. Private keys are either a WebCrypto
 * `CryptoKey` (platform errors stay throws) or raw PKCS#8 bytes passed through
 * unvalidated, so there is no distinct `invalid_private_key` failure to model.
 */
type CreatePfxErrorCode = "invalid_certificate";
/** Error payload for a failed PFX creation. */
interface CreatePfxFailure extends Micro509Error<CreatePfxErrorCode> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/** Success-or-failure result from {@linkcode createPfx}. */
type CreatePfxResult = {
  /** Creation succeeded. */
  readonly ok: true;
  /** DER, PEM, and base64 forms of the PFX container. */
  readonly value: PfxMaterial;
} | ErrorResult<CreatePfxErrorCode, Record<never, never>, CreatePfxFailure>;
/**
 * Builds a PKCS#12/PFX archive containing certificates and/or private keys.
 *
 * When `encryption` is provided, the key-bag ContentInfo is PBES2-encrypted.
 * When `mac` is provided, a PKCS#12 MAC integrity block is appended.
 *
 * Returns a {@linkcode CreatePfxResult}: the container material on success, or a
 * typed `invalid_certificate` failure when a certificate source is not a single
 * PEM/DER certificate.
 *
 * @example
 * ```ts
 * import { createPfx, unwrap } from 'micro509';
 *
 * const result = await createPfx({
 *   certificates: [{ certificate: certPem }],
 *   privateKeys: [{ privateKey: keyPair.privateKey }],
 *   encryption: { password: 's3cret' },
 *   mac: { password: 's3cret' },
 * });
 * if (result.ok) {
 *   const pfx = result.value; // pfx.der, pfx.pem, pfx.base64
 * }
 * // or, when inputs are already validated: const pfx = unwrap(result);
 * ```
 */
declare function createPfx(input: CreatePfxInput): Promise<CreatePfxResult>;
/**
 * Decodes a DER-encoded PKCS#12/PFX container into its constituent bags.
 *
 * Returns a result union — check `ok` before accessing `value`.
 * Encrypted containers require `options.password`. MAC verification uses
 * `options.macPassword` (falls back to `options.password`).
 *
 * @example
 * ```ts
 * import { parsePfxDer } from 'micro509';
 *
 * const result = await parsePfxDer(pfxBytes, { password: 's3cret' });
 * if (result.ok) {
 *   console.log(result.value.certificates.length);
 * }
 * ```
 */
declare function parsePfxDer(der: Uint8Array, options?: ParsePfxOptions): Promise<ParsePfxResult>;
/**
 * Decodes a PEM-armored PKCS#12/PFX container. Expects exactly one `PKCS12` block.
 *
 * Delegates to {@linkcode parsePfxDer} after PEM decoding.
 *
 * @example
 * ```ts
 * import { parsePfxPem } from 'micro509';
 *
 * const result = await parsePfxPem(pfxPemString, { password: 's3cret' });
 * if (result.ok) {
 *   console.log(result.value.privateKeys.length);
 * }
 * ```
 */
declare function parsePfxPem(pem: string, options?: ParsePfxOptions): Promise<ParsePfxResult>;
//#endregion
export { CreatePfxErrorCode, CreatePfxFailure, CreatePfxInput, CreatePfxResult, ParsePfxErrorCode, ParsePfxFailure, ParsePfxOptions, ParsePfxResult, type ParsePkcs12MacDataErrorCode, type ParsePkcs12MacDataFailure, type ParsePkcs12MacDataResult, ParsedPfx, ParsedPfxAttribute, ParsedPfxBag, ParsedPfxBagAttributes, type ParsedPkcs12MacData, PfxBagAttributesInput, PfxCertificateBagInput, PfxCertificateSource, PfxEncryptionOptions, PfxMaterial, PfxPrivateKeyBagInput, PfxPrivateKeySource, type Pkcs12MacOptions, createPfx, type createPkcs12MacData, parsePfxDer, parsePfxPem, type parsePkcs12MacData, type parsePkcs12MacDataOrThrow };
//# sourceMappingURL=pfx.d.ts.map