import { ParsedCertificate } from "../x509/parse.js";
import { CrlSource, RevocationReason } from "./crl.js";
import { OcspResponderRevocationPolicy } from "./ocsp.js";
import { RevocationCertificateSource } from "./revocation.js";
//#region src/revocation/chain.d.ts
/**
 * OCSP response in any supported format.
 *
 * Accepts PEM string or DER bytes. Used for
 * {@linkcode CheckChainRevocationInput.ocspResponses}.
 */
type OcspResponseSource = string | Uint8Array;
/**
 * Revocation checking policy for {@linkcode checkChainRevocation}.
 *
 * Controls how indeterminate results (missing evidence, expired CRLs) affect
 * the final {@linkcode CheckChainRevocationValue.decision | decision}.
 */
interface RevocationPolicy {
  /**
   * How to handle indeterminate status.
   *
   * - `'hard-fail'`: indeterminate certificates cause denial (default)
   * - `'soft-fail'`: indeterminate certificates are allowed — an explicit
   *   availability/compatibility choice
   *
   * Revocation checking itself is opt-in: no check runs unless evidence is
   * supplied. Once it is, indeterminate status denies by default.
   */
  readonly mode?: "soft-fail" | "hard-fail";
  /**
   * Evidence preference when multiple sources are available.
   *
   * Both evidence kinds are always evaluated, and a validated `revoked`
   * verdict from either source wins regardless of preference (fail-closed).
   * Preference only decides which source's `good` verdict is reported when
   * both yield one.
   *
   * - `'best-available'`: the source with the fresher evidence — the later
   *   `thisUpdate` on the validated OCSP entry or CRL — is reported; ties
   *   favor OCSP (default)
   * - `'ocsp'`: prefer OCSP over CRL
   * - `'crl'`: prefer CRL over OCSP
   */
  readonly prefer?: "ocsp" | "crl" | "best-available";
  /**
   * Revocation policy for delegated OCSP responder certificates
   * (RFC 6960 §4.2.2.2.1). Supplied CRLs double as responder revocation
   * evidence. Defaults to `'honor-nocheck'`.
   */
  readonly ocspResponderRevocation?: OcspResponderRevocationPolicy;
}
/** Input for {@linkcode checkChainRevocation}. */
interface CheckChainRevocationInput {
  /** Validated certificate chain (leaf first, root last). */
  readonly chain: readonly ParsedCertificate[];
  /** CRLs to evaluate. */
  readonly crls?: readonly CrlSource[];
  /** OCSP responses to evaluate. */
  readonly ocspResponses?: readonly OcspResponseSource[];
  /** Extra certs for indirect CRL issuers / delegated OCSP responders. */
  readonly extraCertificates?: readonly RevocationCertificateSource[];
  /**
   * Explicitly trusted OCSP responder certificates (RFC 6960 §4.2.2.2
   * criterion 1). A response signed by one of these is accepted without
   * delegated-responder issuance, EKU, and revocation checks.
   */
  readonly trustedOcspResponders?: readonly RevocationCertificateSource[];
  /** Evaluation time. Defaults to `new Date()`. */
  readonly at?: Date;
  /** Revocation policy. */
  readonly policy?: RevocationPolicy;
}
/**
 * Granular reasons why revocation status could not be determined.
 *
 * Returned in {@linkcode CertificateRevocationStatus}'s `indeterminateReasons`
 * when `status` is `'indeterminate'`. Grouped by category:
 *
 * - **Evidence not found**: `no_applicable_crl`, `no_applicable_ocsp`
 * - **Scope mismatch**: `distribution_point_mismatch`, `issuer_name_mismatch`,
 *   `reason_scope_mismatch`, `indirect_crl_scope_mismatch`, `reason_coverage_incomplete`
 * - **Signer trust**: `crl_signer_not_found`, `crl_signer_not_authorized`,
 *   `crl_signer_revoked`, `crl_signer_indeterminate`, and OCSP equivalents
 * - **Freshness**: `crl_expired`, `ocsp_response_expired`
 */
declare const REVOCATION_INDETERMINATE_REASONS: readonly ["no_applicable_crl", "no_applicable_ocsp", "distribution_point_mismatch", "issuer_name_mismatch", "reason_scope_mismatch", "indirect_crl_scope_mismatch", "reason_coverage_incomplete", "crl_signer_not_found", "crl_signer_not_authorized", "crl_signer_revoked", "crl_signer_indeterminate", "ocsp_responder_not_found", "ocsp_responder_not_authorized", "ocsp_responder_revoked", "ocsp_responder_indeterminate", "crl_expired", "ocsp_response_expired", "ocsp_status_unknown"];
/** See the doc comment above {@linkcode REVOCATION_INDETERMINATE_REASONS}. */
type RevocationIndeterminateReason = (typeof REVOCATION_INDETERMINATE_REASONS)[number];
/**
 * Identifies the source of revocation evidence.
 *
 * Included in {@linkcode CertificateRevocationStatus}'s `source` when status is
 * `'good'` or `'revoked'` to indicate which CRL or OCSP response provided the answer.
 */
interface RevocationSource {
  /** Whether evidence came from a CRL or OCSP response. */
  readonly kind: "crl" | "ocsp";
  /** Certificate that signed the evidence (CRL issuer or OCSP responder). */
  readonly signerCertificate?: ParsedCertificate;
  /** Identifier for debugging (e.g., CRL issuer DN or OCSP responder URL). */
  readonly evidenceIdentifier?: string;
  /**
   * `thisUpdate` of the evidence backing the verdict — the OCSP single
   * response entry or the freshest contributing CRL (an applied delta CRL
   * supersedes its base). This is the timestamp `'best-available'` compares.
   */
  readonly thisUpdate?: Date;
}
/**
 * Revocation evaluation result for a single certificate.
 *
 * One entry per certificate in {@linkcode CheckChainRevocationValue.certificates}.
 * The trust anchor is excluded (never checked for revocation).
 */
type CertificateRevocationStatus = {
  /** The certificate that was evaluated. */
  readonly certificate: ParsedCertificate;
  /** Evidence confirms the certificate is not revoked. */
  readonly status: "good";
  /** Evidence that produced the verdict. */
  readonly source: RevocationSource;
  /** Never present on a `good` verdict. */
  readonly indeterminateReasons?: undefined;
  /** Never present on a `good` verdict. */
  readonly revocationInfo?: undefined;
} | {
  /** The certificate that was evaluated. */
  readonly certificate: ParsedCertificate;
  /** Evidence confirms the certificate is revoked. */
  readonly status: "revoked";
  /** Evidence that produced the verdict. */
  readonly source: RevocationSource;
  /** Revocation details from the CRL entry or OCSP response. */
  readonly revocationInfo: {
    /** When the certificate was revoked. */
    readonly revocationDate: Date;
    /** RFC 5280 CRLReason code, if provided by the CRL/OCSP response. */
    readonly reason?: RevocationReason;
  };
  /** Never present on a `revoked` verdict. */
  readonly indeterminateReasons?: undefined;
} | {
  /** The certificate that was evaluated. */
  readonly certificate: ParsedCertificate;
  /** Revocation status could not be determined. */
  readonly status: "indeterminate";
  /** Why status could not be determined. */
  readonly indeterminateReasons: readonly RevocationIndeterminateReason[];
  /** Never present on an `indeterminate` verdict. */
  readonly source?: undefined;
  /** Never present on an `indeterminate` verdict. */
  readonly revocationInfo?: undefined;
};
/**
 * Errors encountered while processing revocation evidence.
 *
 * Distinct from {@linkcode RevocationIndeterminateReason}: execution errors are
 * code failures (malformed CRL, unsupported extension) rather than evaluation
 * outcomes (CRL doesn't cover this certificate).
 *
 * Collected in {@linkcode CheckChainRevocationValue.executionErrors}.
 */
interface RevocationExecutionError {
  /** Error category. */
  readonly kind: "parse_error" | "unsupported_extension" | "internal_error";
  /** Human-readable error description. */
  readonly message: string;
  /** Which evidence caused the error (e.g., CRL issuer DN). */
  readonly evidenceIdentifier?: string;
}
/**
 * Detailed revocation check results.
 *
 * Returned as {@linkcode CheckChainRevocationResult.value} from
 * {@linkcode checkChainRevocation}. Contains both the policy decision and
 * detailed per-certificate findings for debugging.
 */
interface CheckChainRevocationValue {
  /**
   * Final policy decision based on {@linkcode RevocationPolicy}.
   *
   * - `'allow'`: chain passes revocation check
   * - `'deny'`: chain fails (revoked certificate or hard-fail on indeterminate)
   */
  readonly decision: "allow" | "deny";
  /** Quick-access summary of problematic certificates. */
  readonly summary: {
    /** Certificates confirmed as revoked. */
    readonly revokedCertificates: readonly ParsedCertificate[];
    /** Certificates whose status could not be determined. */
    readonly indeterminateCertificates: readonly ParsedCertificate[];
  };
  /** Per-certificate evaluation results. See {@linkcode CertificateRevocationStatus}. */
  readonly certificates: readonly CertificateRevocationStatus[];
  /** Evidence that could not be processed. See {@linkcode RevocationExecutionError}. */
  readonly executionErrors?: readonly RevocationExecutionError[];
}
/** Result type for {@linkcode checkChainRevocation}. */
type CheckChainRevocationResult = {
  readonly ok: true;
  readonly value: CheckChainRevocationValue;
};
/**
 * Checks revocation status for all certificates in a validated chain.
 *
 * Evaluates CRL and OCSP evidence against each certificate (except the trust
 * anchor), applies the revocation policy, and returns a unified decision.
 *
 * @example
 * ```ts
 * const result = await checkChainRevocation({
 *   chain: validatedChain,
 *   crls: [crl1, crl2],
 *   ocspResponses: [ocspResponseDer],
 *   policy: { mode: 'hard-fail' },
 * });
 * if (result.value.decision === 'deny') {
 *   console.log('Revocation check failed');
 * }
 * ```
 */
declare function checkChainRevocation(input: CheckChainRevocationInput): Promise<CheckChainRevocationResult>;
//#endregion
export { CertificateRevocationStatus, CheckChainRevocationInput, CheckChainRevocationResult, CheckChainRevocationValue, type CrlSource, OcspResponseSource, REVOCATION_INDETERMINATE_REASONS, RevocationExecutionError, RevocationIndeterminateReason, RevocationPolicy, RevocationSource, checkChainRevocation };
//# sourceMappingURL=chain.d.ts.map