import { ErrorResult, Micro509Error } from "../result/result.js";
import { ParsedCertificate } from "../x509/parse.js";
//#region src/verify/identity.d.ts
/** DNS hostname reference identifier. */
interface DnsServiceIdentityInput {
  /** Discriminant for DNS hostname matching. */
  readonly type: "dns";
  /** The hostname to match (e.g. `"mail.example.com"`). Wildcard labels in the certificate are handled internally. */
  readonly value: string;
  /**
   * When `true`, falls back to the subject CN if the SAN extension has no
   * dns/uri/srv entries. Suppressed when any supported SAN type is present.
   * RFC 9525 §4.1 forbids identifying a service by the Common Name RDN.
   * @default false
   */
  readonly allowCommonNameFallback?: boolean;
}
/** IP address reference identifier. */
interface IpServiceIdentityInput {
  /** Discriminant for IP address matching. */
  readonly type: "ip";
  /** IPv4 or IPv6 address string. Normalized before comparison. */
  readonly value: string;
}
/** URI-ID reference identifier (RFC 9525 §§6.2-6.5). Scheme and host are matched. */
interface UriServiceIdentityInput {
  /** Discriminant for URI-ID matching. */
  readonly type: "uri";
  /** Full URI whose scheme and reg-name will be compared. */
  readonly value: string;
}
/** SRV-ID reference identifier (RFC 4985). */
interface SrvServiceIdentityInput {
  /** Discriminant for SRV-ID matching. */
  readonly type: "srv";
  /** SRV name in `_service.domain` form (e.g. `"_imap.example.com"`). */
  readonly value: string;
}
/** Discriminated union of all supported reference identifier types. */
type ServiceIdentityInput = DnsServiceIdentityInput | IpServiceIdentityInput | UriServiceIdentityInput | SrvServiceIdentityInput;
/** The `type` discriminant values of {@linkcode ServiceIdentityInput}. */
type ServiceIdentityType = ServiceIdentityInput["type"];
/** Discriminant codes for identity-matching failures. */
type MatchServiceIdentityErrorCode = "subject_alt_name_mismatch" | "common_name_fallback_suppressed" | "service_identity_mismatch" | "unsupported_service_identity_type";
/** Diagnostic context attached to an identity-matching failure. */
interface MatchServiceIdentityFailureDetails {
  /** CN of the certificate that was being matched, if present. */
  readonly subjectCommonName?: string;
  /** The reference identifier the caller asked to verify. */
  readonly expected?: string;
  /** Comma-joined presented identifiers (from SAN) that were compared. */
  readonly actual?: string;
  /** SAN types that were present, relevant to CN-fallback suppression logic. */
  readonly presentedIdentifierTypes?: readonly ("dns" | "uri" | "srv")[];
  /** Explains why CN fallback was not used or failed. */
  readonly commonNameFallbackReason?: "disabled" | "suppressed_by_presented_identifier" | "common_name_missing" | "common_name_mismatch";
}
/** A failed identity-matching attempt. */
interface MatchServiceIdentityFailure extends Micro509Error<MatchServiceIdentityErrorCode, MatchServiceIdentityFailureDetails> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/** A successful identity match (the certificate covers the requested name). */
interface MatchServiceIdentitySuccess {
  /** Always `true` for success. */
  readonly ok: true;
  /** No payload on success — the match itself is the signal. */
  readonly value: undefined;
}
/** Failure branch of {@linkcode MatchServiceIdentityResult} with structured error details. */
type MatchServiceIdentityFailureResult = ErrorResult<MatchServiceIdentityErrorCode, MatchServiceIdentityFailureDetails, MatchServiceIdentityFailure>;
/** Result of matching a reference identifier against a certificate's presented identifiers. */
type MatchServiceIdentityResult = MatchServiceIdentitySuccess | MatchServiceIdentityFailureResult;
/** Input for {@linkcode matchServiceIdentity}. */
interface MatchServiceIdentityInput {
  /** The parsed leaf certificate to check. */
  readonly certificate: ParsedCertificate;
  /** The reference identifier the client wants to verify. */
  readonly serviceIdentity: ServiceIdentityInput;
}
/**
 * Checks whether a certificate covers the requested service identity.
 *
 * Delegates to {@linkcode matchCertificateServiceIdentity} — this overload
 * accepts a single options object.
 *
 * @example
 * ```ts
 * const result = matchServiceIdentity({
 *   certificate: parsed,
 *   serviceIdentity: { type: 'dns', value: 'example.com' },
 * });
 * if (!result.ok) console.error(result.error.message);
 * ```
 */
declare function matchServiceIdentity(input: MatchServiceIdentityInput): MatchServiceIdentityResult;
/**
 * Compares a reference identifier against a certificate's SAN entries.
 *
 * Supports DNS (with wildcard matching), IP, URI-ID, and SRV-ID.
 * For DNS, optionally falls back to subject CN when no SAN of a supported type is present.
 *
 * @example
 * ```ts
 * const result = matchCertificateServiceIdentity(parsed, {
 *   type: 'ip',
 *   value: '192.168.1.1',
 * });
 * ```
 *
 * @example
 * ```ts
 * const result = matchCertificateServiceIdentity(parsed, {
 *   type: 'dns',
 *   value: 'mail.example.com',
 *   allowCommonNameFallback: true,
 * });
 * ```
 */
declare function matchCertificateServiceIdentity(rawCertificate: ParsedCertificate, serviceIdentity: ServiceIdentityInput): MatchServiceIdentityResult;
//#endregion
export { DnsServiceIdentityInput, IpServiceIdentityInput, MatchServiceIdentityErrorCode, MatchServiceIdentityFailure, MatchServiceIdentityFailureDetails, MatchServiceIdentityFailureResult, MatchServiceIdentityInput, MatchServiceIdentityResult, MatchServiceIdentitySuccess, ServiceIdentityInput, ServiceIdentityType, SrvServiceIdentityInput, UriServiceIdentityInput, matchCertificateServiceIdentity, matchServiceIdentity };
//# sourceMappingURL=identity.d.ts.map