import { Result } from "../result/result.js";
import { ParsedCertificate } from "../x509/parse.js";
import { CertificateRevocationListMaterial, CheckCertificateRevocationAgainstCrlErrorCode, CheckCertificateRevocationAgainstCrlFailure, CheckCertificateRevocationAgainstCrlFailureDetails, CheckCertificateRevocationAgainstCrlGoodValue, CheckCertificateRevocationAgainstCrlInput, CheckCertificateRevocationAgainstCrlResult, CheckCertificateRevocationAgainstCrlRevokedValue, CheckCertificateRevocationAgainstCrlValue, CreateCertificateRevocationListInput, CrlApplicabilityFailureReason, CrlCertificateSource, CrlEncoderErrorCode, CrlSource, ParseCertificateRevocationListErrorCode, ParseCertificateRevocationListFailure, ParseCertificateRevocationListResult, ParsedCertificateRevocationList, ParsedRevokedCertificate, RevocationReason, RevokedCertificateInput, ValidateCertificateRevocationListFailure, ValidateCertificateRevocationListInput, ValidateCertificateRevocationListResult, VerifyCertificateRevocationListSignatureFailure, VerifyCertificateRevocationListSignatureResult, checkCertificateRevocationAgainstCrl, createCertificateRevocationList, isCertificateRevoked, parseCertificateRevocationListDer, parseCertificateRevocationListDerOrThrow, parseCertificateRevocationListPem, parseCertificateRevocationListPemOrThrow, revocationReasonFromCode, validateCertificateRevocationList, verifyCertificateRevocationListSignature } from "./crl.js";
import { CreateOcspCertStatusInput, CreateOcspRequestInput, CreateOcspRequestItemInput, CreateOcspResponseInput, CreateOcspSingleResponseInput, OcspCertStatus, OcspCertificateSource, OcspEncoderErrorCode, OcspHashAlgorithm, OcspRequestMaterial, OcspRequestSource, OcspResponderRevocationPolicy, OcspResponseMaterial, OcspResponseStatus, ParseOcspRequestErrorCode, ParseOcspRequestFailure, ParseOcspRequestResult, ParseOcspResponseErrorCode, ParseOcspResponseFailure, ParseOcspResponseResult, ParsedOcspCertId, ParsedOcspCertStatus, ParsedOcspRequest, ParsedOcspResponderId, ParsedOcspResponse, ParsedOcspSingleResponse, ValidateOcspResponseErrorCode, ValidateOcspResponseFailure, ValidateOcspResponseInput, ValidateOcspResponseResult, VerifyOcspResponseSignatureFailure, VerifyOcspResponseSignatureResult, createOcspRequest, createOcspResponse, hasOcspNoCheckExtension, parseOcspRequestDer, parseOcspRequestDerOrThrow, parseOcspRequestPem, parseOcspRequestPemOrThrow, parseOcspResponseDer, parseOcspResponseDerOrThrow, parseOcspResponsePem, parseOcspResponsePemOrThrow, validateOcspResponse, verifyOcspResponseSignature } from "./ocsp.js";
//#region src/revocation/revocation.d.ts
/** Unified revocation outcome across CRL and OCSP evidence. */
type RevocationStatus = "good" | "revoked" | "indeterminate";
/** Which revocation mechanism produced the evidence. */
type RevocationEvidenceKind = "crl" | "ocsp";
/** PEM string, DER bytes, or already-parsed certificate. */
type RevocationCertificateSource = string | Uint8Array | ParsedCertificate;
/** Where the OCSP responder URI came from. */
type OcspResponderSource = "configured" | "authorityInfoAccess";
/** PEM or DER bytes of a pre-configured OCSP responder certificate. */
type ConfiguredOcspResponderCertificate = string | Uint8Array;
/** A manually-configured OCSP responder endpoint. */
interface ConfiguredOcspResponder {
  /** OCSP responder URI (typically `http://...`). */
  readonly uri: string;
  /** Known responder certificate — skips embedded-certificate discovery. */
  readonly responderCertificate?: ConfiguredOcspResponderCertificate;
}
/** One candidate OCSP responder resolved by {@linkcode resolveOcspResponderCandidates}. */
interface OcspResponderCandidate {
  /** Whether this candidate came from configuration or the certificate's AIA extension. */
  readonly source: OcspResponderSource;
  /** OCSP responder URI. */
  readonly uri: string;
  /** Pre-known responder certificate, if available. */
  readonly responderCertificate?: ConfiguredOcspResponderCertificate;
}
/** Input for {@linkcode resolveOcspResponderCandidates}. */
interface ResolveOcspResponderCandidatesInput {
  /** Certificate whose AIA extension will be inspected for OCSP URIs. */
  readonly certificate: RevocationCertificateSource;
  /** Manually-configured responders — checked before AIA-derived ones. */
  readonly configuredResponders?: readonly ConfiguredOcspResponder[];
}
/** CRL-based revocation evidence for {@linkcode CheckCertificateRevocationInput.evidence}. */
interface RevocationCrlEvidenceInput {
  /** Discriminator for the CRL evidence variant. */
  readonly kind: "crl";
  /** Complete (base) CRL. */
  readonly crl: CrlSource;
  /** Optional delta CRL for more recent revocation information. */
  readonly deltaCrl?: CrlSource;
}
/** OCSP-based revocation evidence for {@linkcode CheckCertificateRevocationInput.evidence}. */
interface RevocationOcspEvidenceInput {
  /** Discriminator for the OCSP evidence variant. */
  readonly kind: "ocsp";
  /** OCSP response to validate. */
  readonly response: string | Uint8Array | ParsedOcspResponse;
  /** Original OCSP request — enables nonce and coverage checks. */
  readonly request?: OcspRequestSource;
  /** Explicit responder certificate — overrides embedded certificate discovery. */
  readonly responderCertificate?: OcspCertificateSource;
}
/** Discriminated union of CRL and OCSP evidence inputs. */
type RevocationEvidenceInput = RevocationCrlEvidenceInput | RevocationOcspEvidenceInput;
/** Input for {@linkcode checkCertificateRevocation}. */
interface CheckCertificateRevocationInput {
  /** Certificate whose revocation status to determine. */
  readonly certificate: RevocationCertificateSource;
  /** Issuer of `certificate`. */
  readonly issuerCertificate: RevocationCertificateSource;
  /** CRL and/or OCSP evidence to evaluate. Returns `indeterminate` if empty. */
  readonly evidence?: readonly RevocationEvidenceInput[];
  /** Evaluation time. Defaults to `new Date()`. */
  readonly at?: Date;
  /** Clock-skew tolerance in milliseconds. */
  readonly clockSkewMs?: number;
}
/** Error codes that {@linkcode checkCertificateRevocation} may surface inside an `indeterminate` result. */
type CheckCertificateRevocationErrorCode = "revocation_evidence_missing" | "revocation_status_indeterminate";
/** Every {@linkcode RevocationIndeterminateReasonCode}, as a runtime array. */
declare const REVOCATION_INDETERMINATE_REASON_CODES: readonly ["certificate_status_missing", "certificate_status_unknown", "crl_sign_not_permitted", "issuer_mismatch", "non_applicable", "nonce_mismatch", "ocsp_signing_missing", "reason_coverage_incomplete", "request_mismatch", "responder_id_mismatch", "responder_chain_invalid", "responder_revoked", "responder_revocation_unknown", "response_status_invalid", "signature_invalid", "stale_crl", "stale_response"];
/** Why a particular piece of evidence could not produce a definitive `good`/`revoked` answer. */
type RevocationIndeterminateReasonCode = (typeof REVOCATION_INDETERMINATE_REASON_CODES)[number];
/** One piece of evidence that failed to produce a definitive revocation answer. */
interface RevocationIndeterminateEvidence {
  /** Whether this evidence was CRL or OCSP. */
  readonly kind: RevocationEvidenceKind;
  /** Machine-readable reason code. */
  readonly code: RevocationIndeterminateReasonCode;
  /** Human-readable explanation. */
  readonly message: string;
  /** CRL-specific applicability failure reason, when `kind` is `'crl'`. */
  readonly reason?: CrlApplicabilityFailureReason;
}
/** Diagnostic details attached to an `indeterminate` revocation result. */
interface CheckCertificateRevocationFailureDetails {
  /** Which evidence kinds were attempted (`'crl'`, `'ocsp'`, or both). */
  readonly checkedSources: readonly RevocationEvidenceKind[];
  /** Per-evidence explanations of why no definitive answer was reached. */
  readonly indeterminateEvidence: readonly RevocationIndeterminateEvidence[];
}
/** Revocation status could not be determined from the provided evidence. */
interface RevocationCheckIndeterminateValue {
  /** Status is indeterminate. */
  readonly status: Extract<RevocationStatus, "indeterminate">;
  /** Why revocation status is indeterminate. */
  readonly code: CheckCertificateRevocationErrorCode;
  /** Human-readable diagnostic message. */
  readonly message: string;
  /** What evidence was attempted and why each failed. */
  readonly details: CheckCertificateRevocationFailureDetails;
}
/** Certificate is not revoked according to the checked evidence. */
interface RevocationCheckGoodValue {
  /** Certificate is not revoked. */
  readonly status: Extract<RevocationStatus, "good">;
  /** Which evidence kind confirmed the good status. */
  readonly kind: RevocationEvidenceKind;
  /** Human-readable diagnostic message. */
  readonly message: string;
}
/** Certificate is revoked according to the checked evidence. */
interface RevocationCheckRevokedValue {
  /** Certificate is revoked. */
  readonly status: Extract<RevocationStatus, "revoked">;
  /** Which evidence kind reported the revocation. */
  readonly kind: RevocationEvidenceKind;
  /** Human-readable diagnostic message. */
  readonly message: string;
  /** When the certificate was revoked (from CRL entry or OCSP response). */
  readonly revokedAt?: Date;
  /** CRL reason string (from CRL evidence). */
  readonly revocationReason?: RevocationReason;
  /** CRL reason integer code (from OCSP evidence). */
  readonly revocationReasonCode?: number;
}
/** Discriminated union of `good`, `revoked`, and `indeterminate` revocation outcomes. */
type CheckCertificateRevocationValue = RevocationCheckGoodValue | RevocationCheckRevokedValue | RevocationCheckIndeterminateValue;
/**
 * Result of {@linkcode checkCertificateRevocation}. Always succeeds (`ok: true`) —
 * the `value.status` discriminator carries the actual outcome.
 */
type CheckCertificateRevocationResult = Result<CheckCertificateRevocationValue, never>;
/** Extracts OCSP responder URIs from the certificate's Authority Information Access extension. */
declare function getCertificateOcspResponderUris(certificate: RevocationCertificateSource): readonly string[];
/**
 * Merges configured OCSP responders with those discovered from the certificate's
 * AIA extension. Configured responders take priority; duplicates are deduplicated by URI.
 */
declare function resolveOcspResponderCandidates(input: ResolveOcspResponderCandidatesInput): readonly OcspResponderCandidate[];
/**
 * Evaluates all provided CRL and OCSP evidence to determine the certificate's
 * revocation status. Returns the first `revoked` if any, else the first `good`,
 * else `indeterminate` with diagnostic details about each indeterminate evidence.
 *
 * @example
 * ```ts
 * import { checkCertificateRevocation } from 'micro509';
 *
 * const result = await checkCertificateRevocation({
 *   certificate: leafPem,
 *   issuerCertificate: caPem,
 *   evidence: [{ kind: 'crl', crl: crlPem }],
 * });
 * if (result.ok && result.value.status === 'revoked') {
 *   console.log('revoked at', result.value.revokedAt);
 * }
 * ```
 */
declare function checkCertificateRevocation(input: CheckCertificateRevocationInput): Promise<CheckCertificateRevocationResult>;
//#endregion
export { type CertificateRevocationListMaterial, type CheckCertificateRevocationAgainstCrlErrorCode, type CheckCertificateRevocationAgainstCrlFailure, type CheckCertificateRevocationAgainstCrlFailureDetails, type CheckCertificateRevocationAgainstCrlGoodValue, type CheckCertificateRevocationAgainstCrlInput, type CheckCertificateRevocationAgainstCrlResult, type CheckCertificateRevocationAgainstCrlRevokedValue, type CheckCertificateRevocationAgainstCrlValue, CheckCertificateRevocationErrorCode, CheckCertificateRevocationFailureDetails, CheckCertificateRevocationInput, CheckCertificateRevocationResult, CheckCertificateRevocationValue, ConfiguredOcspResponder, ConfiguredOcspResponderCertificate, type CreateCertificateRevocationListInput, type CreateOcspCertStatusInput, type CreateOcspRequestInput, type CreateOcspRequestItemInput, type CreateOcspResponseInput, type CreateOcspSingleResponseInput, type CrlApplicabilityFailureReason, type CrlCertificateSource, type CrlEncoderErrorCode, type CrlSource, type OcspCertStatus, type OcspCertificateSource, type OcspEncoderErrorCode, type OcspHashAlgorithm, type OcspRequestMaterial, type OcspRequestSource, OcspResponderCandidate, type OcspResponderRevocationPolicy, OcspResponderSource, type OcspResponseMaterial, type OcspResponseStatus, type ParseCertificateRevocationListErrorCode, type ParseCertificateRevocationListFailure, type ParseCertificateRevocationListResult, type ParseOcspRequestErrorCode, type ParseOcspRequestFailure, type ParseOcspRequestResult, type ParseOcspResponseErrorCode, type ParseOcspResponseFailure, type ParseOcspResponseResult, type ParsedCertificateRevocationList, type ParsedOcspCertId, type ParsedOcspCertStatus, type ParsedOcspRequest, type ParsedOcspResponderId, type ParsedOcspResponse, type ParsedOcspSingleResponse, type ParsedRevokedCertificate, REVOCATION_INDETERMINATE_REASON_CODES, ResolveOcspResponderCandidatesInput, RevocationCertificateSource, RevocationCheckGoodValue, RevocationCheckIndeterminateValue, RevocationCheckRevokedValue, RevocationCrlEvidenceInput, RevocationEvidenceInput, RevocationEvidenceKind, RevocationIndeterminateEvidence, RevocationIndeterminateReasonCode, RevocationOcspEvidenceInput, type RevocationReason, RevocationStatus, type RevokedCertificateInput, type ValidateCertificateRevocationListFailure, type ValidateCertificateRevocationListInput, type ValidateCertificateRevocationListResult, type ValidateOcspResponseErrorCode, type ValidateOcspResponseFailure, type ValidateOcspResponseInput, type ValidateOcspResponseResult, type VerifyCertificateRevocationListSignatureFailure, type VerifyCertificateRevocationListSignatureResult, type VerifyOcspResponseSignatureFailure, type VerifyOcspResponseSignatureResult, checkCertificateRevocation, type checkCertificateRevocationAgainstCrl, type createCertificateRevocationList, type createOcspRequest, type createOcspResponse, getCertificateOcspResponderUris, type hasOcspNoCheckExtension, type isCertificateRevoked, type parseCertificateRevocationListDer, type parseCertificateRevocationListDerOrThrow, type parseCertificateRevocationListPem, type parseCertificateRevocationListPemOrThrow, type parseOcspRequestDer, type parseOcspRequestDerOrThrow, type parseOcspRequestPem, type parseOcspRequestPemOrThrow, type parseOcspResponseDer, type parseOcspResponseDerOrThrow, type parseOcspResponsePem, type parseOcspResponsePemOrThrow, resolveOcspResponderCandidates, type revocationReasonFromCode, type validateCertificateRevocationList, type validateOcspResponse, type verifyCertificateRevocationListSignature, type verifyOcspResponseSignature };
//# sourceMappingURL=revocation.d.ts.map