import { ErrorResult, IndexedErrorResult, IndexedMicro509Error, Micro509Error } from "../result/result.js";
import { ParsedCertificate, ParsedCertificateSigningRequest, ParsedName } from "../x509/parse.js";
import { CrlSource } from "../revocation/crl.js";
import { RevocationCertificateSource } from "../revocation/revocation.js";
import { RevocationPolicy } from "../revocation/chain.js";
import { DnsServiceIdentityInput, IpServiceIdentityInput, MatchServiceIdentityErrorCode, MatchServiceIdentityFailure, MatchServiceIdentityFailureDetails, MatchServiceIdentityFailureResult, MatchServiceIdentityInput, MatchServiceIdentityResult, MatchServiceIdentitySuccess, ServiceIdentityInput, ServiceIdentityType, SrvServiceIdentityInput, UriServiceIdentityInput, matchCertificateServiceIdentity, matchServiceIdentity } from "./identity.js";
import { InitialNameConstraintsInput } from "./name-constraints.js";
import { ConstrainedPolicy, PolicyValidationInput, PolicyValidationOutcome } from "./policy.js";
import { isSelfIssued } from "../internal/verify/verify-path.js";
//#region src/verify/verify.d.ts
/** PEM string or DER bytes for a certificate. PEM may contain multiple blocks. */
type CertificateSource = string | Uint8Array;
/** PEM string or DER bytes for a certificate signing request. */
type CsrSource = string | Uint8Array;
/** High-level purpose applied during path validation to enforce leaf constraints. */
type VerifyPurpose = "serverAuth" | "clientAuth" | "ca";
/** Extended key usage purpose checked by {@linkcode checkExtendedKeyUsage}. */
type EkuCheckPurpose = "serverAuth" | "clientAuth" | "codeSigning" | "emailProtection" | "timeStamping" | "ocspSigning";
/** Result of {@linkcode checkExtendedKeyUsage}. Success carries no value; failure identifies the offending certificate. */
type EkuCheckResult = {
  readonly ok: true;
  readonly value: undefined;
} | IndexedErrorResult<"leaf_eku_missing" | "intermediate_eku_constraint", Record<never, never>, EkuCheckFailure>;
/** Failure from {@linkcode checkExtendedKeyUsage} with the chain index of the certificate that failed. */
interface EkuCheckFailure extends Micro509Error<"leaf_eku_missing" | "intermediate_eku_constraint"> {
  /** Always `false` for failures. */
  readonly ok: false;
  /** Zero-based index into the chain of the certificate that lacks the required EKU. */
  readonly index: number;
}
/**
 * Bare trust anchor — subject identity and public key material without a
 * full certificate. Used when the root CA certificate is unavailable but
 * its key is known. Build from a certificate with {@linkcode trustAnchorFromCertificate}.
 */
interface TrustAnchor {
  /** Parsed subject distinguished name. Used for semantic issuer matching (RFC 5280 §7.1). */
  readonly subject: ParsedName;
  /** DER-encoded SubjectPublicKeyInfo used to verify signatures from this anchor. */
  readonly subjectPublicKeyInfoDer: Uint8Array;
  /** OID of the public key algorithm (e.g. `1.2.840.10045.2.1` for EC). */
  readonly publicKeyAlgorithmOid: string;
  /** OID of the key parameters, when algorithm-specific (e.g. named curve OID for EC). */
  readonly publicKeyParametersOid?: string;
  /** Hex-encoded subject key identifier for AKI matching. */
  readonly subjectKeyIdentifier?: string;
}
/**
 * Discriminant for every failure a verify operation can produce.
 *
 * - `no_trusted_root` — chain could not be anchored to any root or {@linkcode TrustAnchor}.
 * - `issuer_not_found` — an intermediate's issuer was not in the candidate set, or its issuer DN does not match the candidate issuer's subject DN.
 * - `signature_invalid` — a certificate's signature failed cryptographic verification.
 * - `certificate_expired` — a certificate's notBefore/notAfter window excludes the validation time.
 * - `ca_required` — an issuer lacks `basicConstraints.ca = true`.
 * - `key_cert_sign_required` — an issuer has keyUsage but omits `keyCertSign`.
 * - `path_length_exceeded` — the number of CA certificates below an issuer exceeds its pathLength.
 * - `authority_key_identifier_mismatch` — a certificate's AKI does not match the issuer's SKI.
 * - `extended_key_usage_invalid` — the leaf certificate lacks the required EKU for the requested purpose.
 * - `subject_alt_name_mismatch` — no SAN entry matches the requested service identity.
 * - `common_name_fallback_suppressed` — CN fallback was attempted but suppressed (SAN present or disabled).
 * - `self_signed_leaf_not_allowed` — the leaf is self-signed and `allowSelfSignedLeaf` was not set.
 * - `unrecognized_critical_extension` — a certificate contains a critical extension the verifier cannot process.
 * - `intermediate_eku_constraint` — an intermediate CA's EKU set does not include the required purpose.
 * - `explicit_policy_required` — `requireExplicitPolicy` was set but no acceptable policy was found.
 * - `initial_policy_set_not_satisfied` — the chain's policies do not intersect `initialPolicySet`.
 * - `unsupported_initial_name_constraints` — caller-supplied initial name constraints use unsupported or malformed forms.
 * - `unsupported_name_constraints` — a certificate's nameConstraints use an unsupported form.
 * - `name_constraints_violated` — a subject name violates a permitted/excluded subtree.
 * - `unsupported_signature_algorithm_parameters` — the signature algorithm uses unrecognized parameters.
 * - `ec_domain_parameters_missing` — an elliptic curve public key carries no namedCurve domain parameters.
 * - `certificate_revoked` — revocation evidence confirms a chain certificate is revoked.
 * - `revocation_indeterminate` — revocation status could not be determined under a hard-fail policy.
 */
declare const VERIFY_ERROR_CODES: readonly ["no_trusted_root", "issuer_not_found", "signature_invalid", "certificate_expired", "ca_required", "key_cert_sign_required", "path_length_exceeded", "authority_key_identifier_mismatch", "extended_key_usage_invalid", "subject_alt_name_mismatch", "common_name_fallback_suppressed", "self_signed_leaf_not_allowed", "unrecognized_critical_extension", "intermediate_eku_constraint", "explicit_policy_required", "initial_policy_set_not_satisfied", "unsupported_initial_name_constraints", "unsupported_name_constraints", "name_constraints_violated", "unsupported_signature_algorithm_parameters", "ec_domain_parameters_missing", "certificate_revoked", "revocation_indeterminate"];
/** See the doc comment above {@linkcode VERIFY_ERROR_CODES} for the meaning of each code. */
type VerifyErrorCode = (typeof VERIFY_ERROR_CODES)[number];
/** Diagnostic context attached to every {@linkcode VerifyChainFailure}. All fields are optional; presence depends on the error code. */
interface VerifyFailureDetails {
  /** CN of the certificate that triggered the failure. */
  readonly subjectCommonName?: string;
  /** CN of the issuer of the offending certificate. */
  readonly issuerCommonName?: string;
  /** The value the verifier expected (e.g. a validity window bound or SKI). */
  readonly expected?: string;
  /** The value actually found. */
  readonly actual?: string;
  /** CNs of every certificate in the chain, leaf-first. Present on `no_trusted_root`. */
  readonly chainCommonNames?: readonly string[];
  /** SAN identifier types the leaf actually presents. Set on identity-match failures. */
  readonly presentedIdentifierTypes?: readonly ("dns" | "uri" | "srv")[];
  /** Why the CN-fallback path was not taken. Set on `common_name_fallback_suppressed`. */
  readonly commonNameFallbackReason?: "disabled" | "suppressed_by_presented_identifier" | "common_name_missing" | "common_name_mismatch";
}
/** A chain verification failure with its error code, human message, chain index, and diagnostic details. */
interface VerifyChainFailure extends IndexedMicro509Error<VerifyErrorCode, VerifyFailureDetails> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/** Input for {@linkcode buildCandidatePath}. */
interface BuildCandidatePathInput {
  /** End-entity certificate to verify. */
  readonly leaf: CertificateSource;
  /** Intermediate CA certificates available for path building. Order does not matter. */
  readonly intermediates?: readonly CertificateSource[];
  /** Trusted root CA certificates. At least one root or trust anchor must be supplied. */
  readonly roots: readonly CertificateSource[];
  /** Bare trust anchors to try when no root certificate matches. */
  readonly trustAnchors?: readonly TrustAnchor[];
  /** Validation time. Defaults to `new Date()`. */
  readonly at?: Date;
}
/** A signature-verified certification path from leaf to root, before constraint validation. */
interface CandidatePath {
  /** Parsed end-entity certificate. */
  readonly leaf: ParsedCertificate;
  /** Full chain in leaf-to-root order (includes both leaf and root). */
  readonly chain: readonly ParsedCertificate[];
  /** Trusted root that terminates the path. */
  readonly root: ParsedCertificate;
  /**
   * `true` when {@linkcode CandidatePath.root} is a trusted root certificate
   * included in {@linkcode CandidatePath.chain}; `false` when a bare trust
   * anchor verified the terminal certificate, which stays a path certificate.
   */
  readonly anchorCertificateInChain: boolean;
}
/** Result of {@linkcode buildCandidatePath}. On success, contains the {@linkcode CandidatePath}. */
type BuildCandidatePathResult = {
  readonly ok: true;
  readonly value: CandidatePath;
} | IndexedErrorResult<VerifyErrorCode, VerifyFailureDetails, VerifyChainFailure>;
/** Input for {@linkcode validateCandidatePath}. */
interface ValidateCandidatePathInput extends PolicyValidationInput, InitialNameConstraintsInput {
  /** Nested policy validation overrides (takes precedence over flat fields). */
  readonly policy?: PolicyValidationInput;
  /** Nested name constraint overrides (takes precedence over flat fields). */
  readonly nameConstraints?: InitialNameConstraintsInput;
  /** Pre-built certificate chain in leaf-to-root order. */
  readonly chain: readonly ParsedCertificate[];
  /**
   * Whether the terminal certificate in `chain` is the trust anchor (and so is
   * excluded from policy processing). Defaults to `true`, matching a chain that
   * ends at a root certificate. Set `false` when a bare trust anchor verified
   * the terminal certificate, which then must be processed as a path certificate.
   */
  readonly anchorCertificateInChain?: boolean;
  /** Validation time. Defaults to `new Date()`. */
  readonly at?: Date;
  /** Leaf purpose constraint to enforce. */
  readonly purpose?: VerifyPurpose;
  /** When `true`, allows a self-signed leaf that is also the root. Defaults to `false`. */
  readonly allowSelfSignedLeaf?: boolean;
}
/** Success payload from {@linkcode validateCandidatePath}. */
interface ValidateCandidatePathSuccess {
  /** Final RFC 9618-constrained policy outputs for this validated path. */
  readonly policyValidation: PolicyValidationOutcome;
}
/** Result of {@linkcode validateCandidatePath}. */
type ValidateCandidatePathResult = {
  readonly ok: true;
  readonly value: ValidateCandidatePathSuccess;
} | IndexedErrorResult<VerifyErrorCode, VerifyFailureDetails, VerifyChainFailure>;
/** Input for chain-level revocation checking in {@linkcode verifyCertificateChain}. */
interface ChainRevocationInput {
  /** CRLs to evaluate. */
  readonly crls?: readonly CrlSource[];
  /** OCSP responses to evaluate (PEM strings or DER bytes). */
  readonly ocspResponses?: readonly (string | Uint8Array)[];
  /** Extra certs for indirect CRL issuers / delegated OCSP responders. */
  readonly extraCertificates?: readonly RevocationCertificateSource[];
  /** Explicitly trusted OCSP responder certificates (RFC 6960 §4.2.2.2 criterion 1). */
  readonly trustedOcspResponders?: readonly RevocationCertificateSource[];
  /** Revocation policy. */
  readonly policy?: RevocationPolicy;
}
/** Input for {@linkcode verifyCertificateChain}. Combines path-building, validation, and identity options. */
interface VerifyCertificateChainInput extends PolicyValidationInput, InitialNameConstraintsInput {
  /** Nested policy validation overrides. */
  readonly policy?: PolicyValidationInput;
  /** Nested name constraint overrides. */
  readonly nameConstraints?: InitialNameConstraintsInput;
  /** End-entity certificate to verify. */
  readonly leaf: CertificateSource;
  /** Intermediate CA certificates available for path building. */
  readonly intermediates?: readonly CertificateSource[];
  /** Trusted root CA certificates. */
  readonly roots: readonly CertificateSource[];
  /** Bare trust anchors to try when no root certificate matches. */
  readonly trustAnchors?: readonly TrustAnchor[];
  /** Validation time. Defaults to `new Date()`. */
  readonly at?: Date;
  /** Leaf purpose constraint to enforce during validation. */
  readonly purpose?: VerifyPurpose;
  /** DNS/IP/URI/SRV identity to match against the leaf's SAN. */
  readonly serviceIdentity?: ServiceIdentityInput;
  /** When `true`, allows a self-signed leaf. Defaults to `false`. */
  readonly allowSelfSignedLeaf?: boolean;
  /** Optional revocation checking. */
  readonly revocation?: ChainRevocationInput;
}
/** Fully verified certificate chain returned on success from {@linkcode verifyCertificateChain}. */
interface VerifiedCertificateChain {
  /** Parsed end-entity certificate. */
  readonly leaf: ParsedCertificate;
  /** Full chain in leaf-to-root order. */
  readonly chain: readonly ParsedCertificate[];
  /** Trusted root that terminates the path. */
  readonly root: ParsedCertificate;
  /** Final RFC 5280 §6 / RFC 9618 constrained policy outputs for this validated path. */
  readonly policyValidation: PolicyValidationOutcome;
}
/** Result of {@linkcode verifyCertificateChain}. On success, contains the {@linkcode VerifiedCertificateChain}. */
type VerifyChainResult = {
  readonly ok: true;
  readonly value: VerifiedCertificateChain;
} | IndexedErrorResult<VerifyErrorCode, VerifyFailureDetails, VerifyChainFailure>;
/** Failure from {@linkcode verifyCertificateSigningRequest}. */
interface VerifyRequestFailure extends Micro509Error<"signature_invalid" | "unsupported_signature_algorithm_parameters", VerifyFailureDetails> {
  /** Always `false` for failures. */
  readonly ok: false;
}
/** Result of {@linkcode verifyCertificateSigningRequest}. On success, contains the parsed CSR. */
type VerifyRequestResult = {
  readonly ok: true;
  readonly value: ParsedCertificateSigningRequest;
} | ErrorResult<"signature_invalid" | "unsupported_signature_algorithm_parameters", VerifyFailureDetails, VerifyRequestFailure>;
/** Input for {@linkcode validateForTlsServer}. Enforces `serverAuth` EKU and optional DNS/IP identity matching. */
interface ValidateForTlsServerInput extends BuildCandidatePathInput, PolicyValidationInput, InitialNameConstraintsInput {
  /** Nested policy validation overrides. */
  readonly policy?: PolicyValidationInput;
  /** Nested name constraint overrides. */
  readonly nameConstraints?: InitialNameConstraintsInput;
  /** End-entity certificate to verify. */
  readonly leaf: CertificateSource;
  /** Intermediate CA certificates. */
  readonly intermediates?: readonly CertificateSource[];
  /** Trusted root CA certificates. */
  readonly roots: readonly CertificateSource[];
  /** Bare trust anchors. */
  readonly trustAnchors?: readonly TrustAnchor[];
  /** Validation time. Defaults to `new Date()`. */
  readonly at?: Date;
  /** DNS/IP identity to match against the leaf's SAN. */
  readonly serviceIdentity?: ServiceIdentityInput;
}
/** Input for {@linkcode validateForTlsClient}. Enforces `clientAuth` EKU. */
interface ValidateForTlsClientInput extends BuildCandidatePathInput, PolicyValidationInput, InitialNameConstraintsInput {
  /** Nested policy validation overrides. */
  readonly policy?: PolicyValidationInput;
  /** Nested name constraint overrides. */
  readonly nameConstraints?: InitialNameConstraintsInput;
}
/** Input for {@linkcode validateForCodeSigning}. Enforces `codeSigning` EKU. */
interface ValidateForCodeSigningInput extends BuildCandidatePathInput, PolicyValidationInput, InitialNameConstraintsInput {
  /** Nested policy validation overrides. */
  readonly policy?: PolicyValidationInput;
  /** Nested name constraint overrides. */
  readonly nameConstraints?: InitialNameConstraintsInput;
}
/** Input for {@linkcode validateForCa}. Enforces `basicConstraints.ca` on the leaf. */
interface ValidateForCaInput extends BuildCandidatePathInput, PolicyValidationInput, InitialNameConstraintsInput {
  /** Nested policy validation overrides. */
  readonly policy?: PolicyValidationInput;
  /** Nested name constraint overrides. */
  readonly nameConstraints?: InitialNameConstraintsInput;
}
/**
 * Builds a signature-verified path from a leaf certificate to a trusted root.
 *
 * Parses the supplied certificates, walks the issuer chain, signature-checks
 * each link, and returns the first valid path. Does not enforce time, constraints,
 * or leaf purpose — call {@linkcode validateCandidatePath} or use the all-in-one
 * {@linkcode verifyCertificateChain} for full validation.
 *
 * @example
 * ```ts
 * import { buildCandidatePath } from 'micro509';
 *
 * const result = await buildCandidatePath({
 *   leaf: leafPem,
 *   intermediates: [intermediatePem],
 *   roots: [rootPem],
 * });
 * if (result.ok) {
 *   console.log('path length:', result.value.chain.length);
 * }
 * ```
 */
declare function buildCandidatePath(input: BuildCandidatePathInput): Promise<BuildCandidatePathResult>;
/**
 * Validates a pre-built certificate chain for time, constraints, policy, and
 * optionally leaf purpose. Wrap the result of {@linkcode buildCandidatePath}.
 */
declare function validateCandidatePath(input: ValidateCandidatePathInput): Promise<ValidateCandidatePathResult>;
/**
 * All-in-one certificate chain verification: builds a candidate path then
 * validates time, constraints, policy, purpose, and optional service identity.
 *
 * Equivalent to calling {@linkcode buildCandidatePath} followed by
 * {@linkcode validateCandidatePath} (plus identity matching when configured).
 *
 * @example
 * ```ts
 * import { verifyCertificateChain } from 'micro509';
 *
 * const result = await verifyCertificateChain({
 *   leaf: serverCertPem,
 *   intermediates: [intermediatePem],
 *   roots: [rootCaPem],
 *   purpose: 'serverAuth',
 *   serviceIdentity: { type: 'dns', value: 'example.com' },
 * });
 * if (!result.ok) {
 *   console.error(result.error.code, result.error.message);
 * }
 * ```
 */
declare function verifyCertificateChain(input: VerifyCertificateChainInput): Promise<VerifyChainResult>;
/**
 * Verifies the self-signature of a PKCS#10 certificate signing request.
 *
 * Parses the CSR from PEM or DER, then checks that its signature is valid
 * against its own embedded public key.
 *
 * @example
 * ```ts
 * import { verifyCertificateSigningRequest } from 'micro509';
 *
 * const result = await verifyCertificateSigningRequest(csrPem);
 * if (result.ok) {
 *   console.log('subject:', result.value.subject.values.commonName);
 * }
 * ```
 */
declare function verifyCertificateSigningRequest(input: CsrSource): Promise<VerifyRequestResult>;
/**
 * Standalone EKU check against a verified certificate chain.
 * Validates that the leaf has the requested purpose and that
 * intermediate CA EKU constraints (if present) permit it.
 *
 * @example
 * ```ts
 * import { checkExtendedKeyUsage } from 'micro509';
 *
 * const result = checkExtendedKeyUsage(chain, 'serverAuth');
 * if (!result.ok) {
 *   console.error(result.error.code, result.error.message);
 * }
 * ```
 */
declare function checkExtendedKeyUsage(chain: readonly ParsedCertificate[], purpose: EkuCheckPurpose): EkuCheckResult;
/** Extracts a {@linkcode TrustAnchor} from a parsed certificate, copying the subject, SPKI, and key identifiers. */
declare function trustAnchorFromCertificate(certificate: ParsedCertificate): TrustAnchor;
/**
 * Validates a certificate chain for TLS server use:
 * chain verification + `serverAuth` EKU (leaf + intermediate propagation)
 * + DNS/IP identity matching.
 *
 * @example
 * ```ts
 * import { validateForTlsServer } from 'micro509';
 *
 * const result = await validateForTlsServer({
 *   leaf: serverCertPem,
 *   roots: [rootCaPem],
 *   serviceIdentity: { type: 'dns', value: 'example.com' },
 * });
 * if (result.ok) {
 *   console.log('valid for', result.value.leaf.subject.values.commonName);
 * }
 * ```
 */
declare function validateForTlsServer(input: ValidateForTlsServerInput): Promise<VerifyChainResult>;
/**
 * Validates a certificate chain for TLS client use:
 * chain verification + `clientAuth` EKU (leaf + intermediate propagation).
 *
 * @example
 * ```ts
 * import { validateForTlsClient } from 'micro509';
 *
 * const result = await validateForTlsClient({
 *   leaf: clientCertPem,
 *   roots: [rootCaPem],
 * });
 * ```
 */
declare function validateForTlsClient(input: ValidateForTlsClientInput): Promise<VerifyChainResult>;
/**
 * Validates a certificate chain for code signing:
 * chain verification + `codeSigning` EKU (leaf + intermediate propagation).
 *
 * @example
 * ```ts
 * import { validateForCodeSigning } from 'micro509';
 *
 * const result = await validateForCodeSigning({
 *   leaf: codeSigningCertPem,
 *   roots: [rootCaPem],
 * });
 * ```
 */
declare function validateForCodeSigning(input: ValidateForCodeSigningInput): Promise<VerifyChainResult>;
/**
 * Validates a certificate chain for CA use:
 * chain verification + `basicConstraints.ca` check on the leaf.
 *
 * @example
 * ```ts
 * import { validateForCa } from 'micro509';
 *
 * const result = await validateForCa({
 *   leaf: intermediateCertPem,
 *   roots: [rootCaPem],
 * });
 * ```
 */
declare function validateForCa(input: ValidateForCaInput): Promise<VerifyChainResult>;
//#endregion
export { BuildCandidatePathInput, BuildCandidatePathResult, CandidatePath, CertificateSource, ChainRevocationInput, type ConstrainedPolicy, CsrSource, type DnsServiceIdentityInput, EkuCheckFailure, EkuCheckPurpose, EkuCheckResult, type InitialNameConstraintsInput, type IpServiceIdentityInput, type MatchServiceIdentityErrorCode, type MatchServiceIdentityFailure, type MatchServiceIdentityFailureDetails, type MatchServiceIdentityFailureResult, type MatchServiceIdentityInput, type MatchServiceIdentityResult, type MatchServiceIdentitySuccess, type PolicyValidationInput, type PolicyValidationOutcome, type ServiceIdentityInput, type ServiceIdentityType, type SrvServiceIdentityInput, TrustAnchor, type UriServiceIdentityInput, VERIFY_ERROR_CODES, ValidateCandidatePathInput, ValidateCandidatePathResult, ValidateCandidatePathSuccess, ValidateForCaInput, ValidateForCodeSigningInput, ValidateForTlsClientInput, ValidateForTlsServerInput, VerifiedCertificateChain, VerifyCertificateChainInput, VerifyChainFailure, VerifyChainResult, VerifyErrorCode, VerifyFailureDetails, VerifyPurpose, VerifyRequestFailure, VerifyRequestResult, buildCandidatePath, checkExtendedKeyUsage, isSelfIssued as isSelfIssuedCertificate, type matchCertificateServiceIdentity, type matchServiceIdentity, trustAnchorFromCertificate, validateCandidatePath, validateForCa, validateForCodeSigning, validateForTlsClient, validateForTlsServer, verifyCertificateChain, verifyCertificateSigningRequest };
//# sourceMappingURL=verify.d.ts.map