import { ErrorResult, Micro509Error } from "../result/result.js";
import { NameInput } from "../x509/name.js";
import { DistributionPoint, DistributionPointReason, GeneralName, IssuingDistributionPoint } from "../x509/extensions.js";
import { ParsedCertificate, ParsedDistributionPoint, ParsedIssuingDistributionPoint, ParsedName } from "../x509/parse.js";
//#region src/revocation/crl.d.ts
/**
 * Single revoked certificate entry for {@linkcode createCertificateRevocationList}.
 */
interface RevokedCertificateInput {
  /** DER-encoded certificate serial number to revoke. */
  readonly serialNumber: Uint8Array;
  /** When the certificate was revoked. Defaults to `thisUpdate` of the CRL. */
  readonly revocationDate?: Date;
  /** RFC 5280 CRLReason code. Omit for `unspecified`. */
  readonly reasonCode?: RevocationReason;
  /** When the key or certificate became suspect — may predate `revocationDate`. */
  readonly invalidityDate?: Date;
}
/**
 * RFC 5280 [§5.3.1](https://datatracker.ietf.org/doc/html/rfc5280#section-5.3.1) CRLReason code values.
 *
 * `removeFromCRL` is used in delta CRLs to un-hold a certificate.
 */
type RevocationReason = "unspecified" | "keyCompromise" | "cACompromise" | "affiliationChanged" | "superseded" | "cessationOfOperation" | "certificateHold" | "removeFromCRL" | "privilegeWithdrawn" | "aACompromise";
/**
 * Input for {@linkcode createCertificateRevocationList}.
 */
interface CreateCertificateRevocationListInput {
  /** Distinguished name of the CRL issuer (typically the signing CA). */
  readonly issuer: NameInput;
  /** Private key used to sign the CRL. Algorithm is inferred from the key. */
  readonly signerPrivateKey: CryptoKey;
  /** Issuer public key — used to embed an Authority Key Identifier extension. */
  readonly issuerPublicKey?: CryptoKey;
  /** Issuance timestamp. Defaults to `new Date()`. */
  readonly thisUpdate?: Date;
  /** Planned next issuance. Omit for an open-ended CRL. */
  readonly nextUpdate?: Date;
  /** Certificates to list as revoked in this CRL. */
  readonly revokedCertificates?: readonly RevokedCertificateInput[];
  /** Monotonically-increasing CRL sequence number (CRLNumber extension). */
  readonly crlNumber?: number;
  /** If set, marks this CRL as a delta CRL referencing the given base CRL number. */
  readonly baseCrlNumber?: number;
  /** Issuing distribution point extension — scopes this CRL to a subset of certificates. */
  readonly issuingDistributionPoint?: IssuingDistributionPoint;
  /** Freshest CRL distribution points — tells relying parties where to find delta CRLs. */
  readonly freshestCrlDistributionPoints?: readonly DistributionPoint[];
}
/**
 * Encoded CRL in multiple serialisation formats, returned by {@linkcode createCertificateRevocationList}.
 */
interface CertificateRevocationListMaterial {
  /** Raw DER bytes of the signed CRL. */
  readonly der: Uint8Array;
  /** PEM-encoded CRL (`-----BEGIN X509 CRL-----`). */
  readonly pem: string;
  /** Base64-encoded DER (no PEM armour). */
  readonly base64: string;
}
/**
 * A single revoked-certificate entry decoded from a CRL.
 */
interface ParsedRevokedCertificate {
  /** Hex-encoded serial number of the revoked certificate. */
  readonly serialNumberHex: string;
  /** When the CA declared this certificate revoked. */
  readonly revocationDate: Date;
  /** RFC 5280 CRLReason, if the entry carries one. */
  readonly reasonCode?: RevocationReason;
  /** When the key or certificate actually became suspect, if present. */
  readonly invalidityDate?: Date;
  /** Indirect-CRL certificate issuer override (RFC 5280 §5.3.3). */
  readonly certificateIssuer?: readonly GeneralName[];
}
/**
 * Decoded X.509 CRL, returned by {@linkcode parseCertificateRevocationListDer}
 * and {@linkcode parseCertificateRevocationListPem}.
 */
interface ParsedCertificateRevocationList {
  /** Original DER bytes when this object came from {@linkcode parseCertificateRevocationListDer} or PEM parsing. */
  readonly der?: Uint8Array;
  /** CRL version (1 = v1, 2 = v2 with extensions). */
  readonly version: number;
  /** DER-encoded TBSCertList — the signed payload for signature verification. */
  readonly tbsCertListDer: Uint8Array;
  /** Raw signature bytes from the CRL outer wrapper. */
  readonly signatureValue: Uint8Array;
  /** CRL issuer distinguished name. */
  readonly issuer: ParsedName;
  /** Start of the CRL validity window. */
  readonly thisUpdate: Date;
  /** End of the CRL validity window. Absent if the CA does not commit to a schedule. */
  readonly nextUpdate?: Date;
  /** OID of the algorithm used to sign this CRL. */
  readonly signatureAlgorithmOid: string;
  /** Human-readable signature algorithm name (e.g. `"ECDSA with SHA-256"`). */
  readonly signatureAlgorithmName: string;
  /** DER-encoded signature algorithm parameters (e.g. DER NULL for RSA PKCS#1 v1.5). */
  readonly signatureAlgorithmParametersDer?: Uint8Array;
  /** OID of the issuer's public key algorithm, when available. */
  readonly issuerPublicKeyAlgorithmOid?: string;
  /** OID of the issuer's public key parameters (e.g. named curve), when available. */
  readonly issuerPublicKeyParametersOid?: string;
  /** Hex-encoded Authority Key Identifier, if the extension is present. */
  readonly authorityKeyIdentifier?: string;
  /** CRLNumber extension value — monotonically increasing sequence number. */
  readonly crlNumber?: number;
  /** Delta CRL indicator — present only on delta CRLs, referencing the base CRL number. */
  readonly baseCrlNumber?: number;
  /** Issuing distribution point extension — scopes this CRL to a certificate subset. */
  readonly issuingDistributionPoint?: ParsedIssuingDistributionPoint;
  /** Freshest CRL extension — points to delta CRL locations. */
  readonly freshestCrlDistributionPoints?: readonly ParsedDistributionPoint[];
  /** All revoked certificate entries (empty array if none). */
  readonly revokedCertificates: readonly ParsedRevokedCertificate[];
}
/** PEM string, DER bytes, or already-parsed CRL. */
type CrlSource = string | Uint8Array | ParsedCertificateRevocationList;
/** PEM string, DER bytes, or already-parsed certificate. */
type CrlCertificateSource = string | Uint8Array | ParsedCertificate;
/** Failure detail when CRL signature verification fails. */
interface VerifyCertificateRevocationListSignatureFailure extends Micro509Error<"signature_invalid"> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/**
 * Result of {@linkcode verifyCertificateRevocationListSignature}.
 *
 * On success, `value` is the parsed CRL whose signature has been verified.
 */
type VerifyCertificateRevocationListSignatureResult = {
  readonly ok: true;
  /** Parsed CRL with a verified signature. */
  readonly value: ParsedCertificateRevocationList;
} | ErrorResult<"signature_invalid", Record<never, never>, VerifyCertificateRevocationListSignatureFailure>;
/**
 * Input for {@linkcode validateCertificateRevocationList}.
 */
interface ValidateCertificateRevocationListInput {
  /** The CRL to validate. */
  readonly crl: CrlSource;
  /** Certificate of the CA that should have signed the CRL. */
  readonly issuerCertificate: CrlCertificateSource;
  /** Evaluation time for freshness checks. Defaults to `new Date()`. */
  readonly at?: Date;
  /** Tolerance in milliseconds for clock skew when checking `thisUpdate`/`nextUpdate`. */
  readonly clockSkewMs?: number;
}
/**
 * Failure detail for {@linkcode validateCertificateRevocationList}.
 *
 * Possible codes: `signature_invalid`, `issuer_mismatch`, `stale_crl`, `crl_sign_not_permitted`.
 */
interface ValidateCertificateRevocationListFailure extends Micro509Error<"signature_invalid" | "issuer_mismatch" | "stale_crl" | "crl_sign_not_permitted"> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/**
 * Result of {@linkcode validateCertificateRevocationList}.
 *
 * On success, the CRL has passed signature, issuer, key-usage, and freshness checks.
 */
type ValidateCertificateRevocationListResult = {
  readonly ok: true;
  /** Validated and parsed CRL. */
  readonly value: ParsedCertificateRevocationList;
} | ErrorResult<"signature_invalid" | "issuer_mismatch" | "stale_crl" | "crl_sign_not_permitted", Record<never, never>, ValidateCertificateRevocationListFailure>;
/**
 * Input for {@linkcode checkCertificateRevocationAgainstCrl}.
 */
interface CheckCertificateRevocationAgainstCrlInput {
  /** Certificate whose revocation status to check. */
  readonly certificate: CrlCertificateSource;
  /** Issuer of `certificate` — also expected signer of the CRL. */
  readonly issuerCertificate: CrlCertificateSource;
  /** Complete (base) CRL to check against. */
  readonly crl: CrlSource;
  /** Optional delta CRL for more recent revocation information. */
  readonly deltaCrl?: CrlSource;
  /** Evaluation time. Defaults to `new Date()`. */
  readonly at?: Date;
  /** Clock-skew tolerance in milliseconds for freshness checks. */
  readonly clockSkewMs?: number;
}
/** Error codes that {@linkcode checkCertificateRevocationAgainstCrl} may return. */
type CheckCertificateRevocationAgainstCrlErrorCode = "signature_invalid" | "issuer_mismatch" | "stale_crl" | "crl_sign_not_permitted" | "non_applicable";
/** Structured reason why a CRL was deemed non-applicable to a given certificate. */
type CrlApplicabilityFailureReason = "certificate_scope_mismatch" | "delta_crl_incompatible" | "unsupported_delta_crl" | "distribution_point_mismatch" | "unsupported_indirect_crl" | "issuer_mismatch" | "reasons_mismatch";
/** Structured details attached to a {@linkcode CheckCertificateRevocationAgainstCrlFailure}. */
interface CheckCertificateRevocationAgainstCrlFailureDetails {
  /** Why the CRL was non-applicable, when the error code is `non_applicable`. */
  readonly reason?: CrlApplicabilityFailureReason;
}
/** Failure detail for {@linkcode checkCertificateRevocationAgainstCrl}. */
interface CheckCertificateRevocationAgainstCrlFailure extends Micro509Error<CheckCertificateRevocationAgainstCrlErrorCode, CheckCertificateRevocationAgainstCrlFailureDetails> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/** Success value when the certificate is not found in the CRL. */
interface CheckCertificateRevocationAgainstCrlGoodValue {
  /** Certificate is not revoked. */
  readonly status: "good";
  /** The validated CRL that was checked. */
  readonly crl: ParsedCertificateRevocationList;
  /**
   * Revocation reasons this check covered, the RFC 5280 §6.3.3 (d)
   * interim_reasons_mask: the matched distribution point's reasons intersected
   * with the CRL's `onlySomeReasons`, either alone when the other is absent,
   * or every reason when both are.
   */
  readonly coveredReasons: readonly DistributionPointReason[];
}
/** Success value when the certificate is found as revoked in the CRL. */
interface CheckCertificateRevocationAgainstCrlRevokedValue {
  /** Certificate is revoked. */
  readonly status: "revoked";
  /** The validated CRL that contained the revocation entry. */
  readonly crl: ParsedCertificateRevocationList;
  /** When the CA declared this certificate revoked. */
  readonly revocationDate: Date;
  /** CRLReason from the entry, if present. */
  readonly reasonCode?: RevocationReason;
}
/** Discriminated union of `good` and `revoked` outcomes. */
type CheckCertificateRevocationAgainstCrlValue = CheckCertificateRevocationAgainstCrlGoodValue | CheckCertificateRevocationAgainstCrlRevokedValue;
/**
 * Result of {@linkcode checkCertificateRevocationAgainstCrl}.
 *
 * On success `value.status` is `'good'` or `'revoked'`.
 * On failure the CRL could not be validated or was non-applicable.
 */
type CheckCertificateRevocationAgainstCrlResult = {
  readonly ok: true;
  readonly value: CheckCertificateRevocationAgainstCrlValue;
} | ErrorResult<CheckCertificateRevocationAgainstCrlErrorCode, CheckCertificateRevocationAgainstCrlFailureDetails, CheckCertificateRevocationAgainstCrlFailure>;
/**
 * Signs and encodes an X.509 v2 CRL.
 *
 * Embeds Authority Key Identifier, CRLNumber, delta CRL indicator,
 * issuing distribution point, and freshest-CRL extensions as configured.
 *
 * @example
 * ```ts
 * import { createCertificateRevocationList } from 'micro509';
 *
 * const crl = await createCertificateRevocationList({
 *   issuer: { commonName: 'Example CA' },
 *   signerPrivateKey: caPrivateKey,
 *   issuerPublicKey: caPublicKey,
 *   thisUpdate: new Date('2025-01-01'),
 *   nextUpdate: new Date('2025-02-01'),
 *   crlNumber: 42,
 *   revokedCertificates: [
 *     { serialNumber: revokedSerial, reasonCode: 'keyCompromise' },
 *   ],
 * });
 * // crl.pem, crl.der, crl.base64
 * ```
 */
declare function createCertificateRevocationList(input: CreateCertificateRevocationListInput): Promise<CertificateRevocationListMaterial>;
/** Machine-readable failure reason for the CRL parsers. */
type ParseCertificateRevocationListErrorCode = "malformed";
/** Structured failure payload for CRL parsing. */
interface ParseCertificateRevocationListFailure extends Micro509Error<ParseCertificateRevocationListErrorCode> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/** Success-or-failure result from {@linkcode parseCertificateRevocationListDer} / {@linkcode parseCertificateRevocationListPem}. */
type ParseCertificateRevocationListResult = {
  readonly ok: true;
  readonly value: ParsedCertificateRevocationList;
} | ErrorResult<ParseCertificateRevocationListErrorCode, Record<never, never>, ParseCertificateRevocationListFailure>;
/**
 * Throwing core for {@linkcode parseCertificateRevocationListDer}.
 *
 * Does not verify the signature — call {@linkcode verifyCertificateRevocationListSignature} or
 * {@linkcode validateCertificateRevocationList} for that.
 */
declare function parseCertificateRevocationListDerOrThrow(der: Uint8Array): ParsedCertificateRevocationList;
/**
 * Decodes a PEM-encoded X.509 CRL (`-----BEGIN X509 CRL-----`).
 *
 * @example
 * ```ts
 * import { parseCertificateRevocationListPemOrThrow } from 'micro509';
 *
 * const crl = parseCertificateRevocationListPemOrThrow(pemString); // throws if malformed
 * console.log(crl.issuer.values.commonName, crl.revokedCertificates.length);
 * ```
 */
declare function parseCertificateRevocationListPemOrThrow(pem: string): ParsedCertificateRevocationList;
/**
 * Decodes a DER-encoded X.509 CRL into a structured {@linkcode ParsedCertificateRevocationList}.
 *
 * Returns a typed failure (`code: 'malformed'`) on malformed input. For the
 * throwing form use {@linkcode parseCertificateRevocationListDerOrThrow}.
 * Does not verify the signature — call {@linkcode verifyCertificateRevocationListSignature} or
 * {@linkcode validateCertificateRevocationList} for that.
 */
declare function parseCertificateRevocationListDer(der: Uint8Array): ParseCertificateRevocationListResult;
/**
 * Decodes a PEM-encoded X.509 CRL (`-----BEGIN X509 CRL-----`).
 *
 * Returns a typed failure (`code: 'malformed'`) on malformed input. For the
 * throwing form use {@linkcode parseCertificateRevocationListPemOrThrow}.
 */
declare function parseCertificateRevocationListPem(pem: string): ParseCertificateRevocationListResult;
/**
 * Verifies the CRL signature against the issuer certificate's public key.
 *
 * Does **not** check issuer name match, key-usage, or freshness — use
 * {@linkcode validateCertificateRevocationList} for full validation.
 */
declare function verifyCertificateRevocationListSignature(crl: string | Uint8Array, issuerCertificate: string | Uint8Array): Promise<VerifyCertificateRevocationListSignatureResult>;
/**
 * Full CRL validation: issuer name match, authority key identifier match,
 * cRLSign key-usage check, signature verification, and `thisUpdate`/`nextUpdate`
 * freshness check (with optional clock-skew tolerance).
 */
declare function validateCertificateRevocationList(input: ValidateCertificateRevocationListInput): Promise<ValidateCertificateRevocationListResult>;
/**
 * End-to-end revocation check: validates the CRL (and optional delta CRL),
 * verifies applicability via distribution-point and scope matching, then
 * resolves the certificate's revocation status.
 *
 * Returns `good` if the serial is absent, `revoked` with date/reason if present,
 * or an error if the CRL cannot be validated or is non-applicable.
 *
 * @example
 * ```ts
 * import { checkCertificateRevocationAgainstCrl } from 'micro509';
 *
 * const result = await checkCertificateRevocationAgainstCrl({
 *   certificate: leafPem,
 *   issuerCertificate: caPem,
 *   crl: crlPem,
 * });
 * if (result.ok && result.value.status === 'revoked') {
 *   console.log('revoked on', result.value.revocationDate);
 * }
 * ```
 */
declare function checkCertificateRevocationAgainstCrl(input: CheckCertificateRevocationAgainstCrlInput): Promise<CheckCertificateRevocationAgainstCrlResult>;
/**
 * Quick serial-number lookup — returns `true` if the serial appears in the
 * CRL's revoked entries. Does **not** validate the CRL or check applicability.
 */
declare function isCertificateRevoked(certificateSerialNumber: Uint8Array | string, crl: ParsedCertificateRevocationList): boolean;
/** Machine-readable reason a CRL encoder rejected its construction input. */
type CrlEncoderErrorCode = "distribution_point_full_name_empty" | "issuer_distinguished_name_empty";
/** Maps an integer CRLReason code back to its {@linkcode RevocationReason} string, or `undefined` for unknown codes. */
declare function revocationReasonFromCode(code: number | undefined): RevocationReason | undefined;
//#endregion
export { CertificateRevocationListMaterial, CheckCertificateRevocationAgainstCrlErrorCode, CheckCertificateRevocationAgainstCrlFailure, CheckCertificateRevocationAgainstCrlFailureDetails, CheckCertificateRevocationAgainstCrlGoodValue, CheckCertificateRevocationAgainstCrlInput, CheckCertificateRevocationAgainstCrlResult, CheckCertificateRevocationAgainstCrlRevokedValue, CheckCertificateRevocationAgainstCrlValue, CreateCertificateRevocationListInput, CrlApplicabilityFailureReason, CrlCertificateSource, CrlEncoderErrorCode, CrlSource, ParseCertificateRevocationListErrorCode, ParseCertificateRevocationListFailure, ParseCertificateRevocationListResult, ParsedCertificateRevocationList, ParsedRevokedCertificate, RevocationReason, RevokedCertificateInput, ValidateCertificateRevocationListFailure, ValidateCertificateRevocationListInput, ValidateCertificateRevocationListResult, VerifyCertificateRevocationListSignatureFailure, VerifyCertificateRevocationListSignatureResult, checkCertificateRevocationAgainstCrl, createCertificateRevocationList, isCertificateRevoked, parseCertificateRevocationListDer, parseCertificateRevocationListDerOrThrow, parseCertificateRevocationListPem, parseCertificateRevocationListPemOrThrow, revocationReasonFromCode, validateCertificateRevocationList, verifyCertificateRevocationListSignature };
//# sourceMappingURL=crl.d.ts.map