import { KeyAlgorithmInput, KeyPairMaterial } from "../keys/keys.js";
import { SignatureProfileInput } from "../internal/crypto/signing.js";
import { canonicalDnKey, compareDistinguishedNames, isWithinDirectoryNameSubtree } from "../internal/shared/dn.js";
import { NameAttribute, NameEncoderErrorCode, NameFieldKey, NameInput, NameObject, RelativeDistinguishedNameInput, encodeName, encodeRelativeDistinguishedName } from "./name.js";
import { ExtensionEncoderErrorCode } from "../internal/x509/extension-errors.js";
import { allOnesMaskForIpAddress, decodeIpAddress, normalizeIpAddress, parseIpAddressToBytes } from "../internal/shared/ip.js";
import { AuthorityInfoAccessMethod, AuthorityInformationAccess, AuthorityInformationAccessInput, BasicConstraints, CertificateExtensionsInput, CertificatePolicies, CpsPolicyQualifierInfo, CustomAuthorityInfoAccessMethod, CustomExtendedKeyUsage, CustomExtension, CustomPolicyQualifierInfo, DistributionPoint, DistributionPointName, DistributionPointReason, ExtendedKeyUsage, GeneralName, GeneralSubtree, InhibitAnyPolicy, IssuingDistributionPoint, IssuingDistributionPointBase, IssuingDistributionPointForAttributeCerts, IssuingDistributionPointForCaCerts, IssuingDistributionPointForUserCerts, KeyUsage, KnownAuthorityInfoAccessMethod, KnownExtendedKeyUsage, NameConstraintForm, NameConstraints, ParsedBitFlags, ParsedNameConstraintForm, PolicyConstraints, PolicyInformation, PolicyMapping, PolicyMappings, PolicyNoticeReference, PolicyQualifierInfo, SubjectAltName, UnsupportedNameConstraintForm, UserNoticePolicyQualifierInfo, buildCertificateExtensions, buildRequestedExtensions, buildSubjectKeyIdentifier, encodeAuthorityInfoAccess, encodeBasicConstraints, encodeCertificatePolicies, encodeCrlDistributionPoints, encodeExtendedKeyUsage, encodeExtension, encodeInhibitAnyPolicy, encodeKeyUsage, encodeNameConstraints, encodePolicyConstraints, encodePolicyMappings, encodeSubjectAltName, getAuthorityInfoAccessMethodOid, getExtendedKeyUsageOid, parseAuthorityInfoAccessMethodOid, parseExtendedKeyUsageOid } from "./extensions.js";
//#region src/x509/certificate.d.ts
/** Machine-readable reason a certificate builder rejected its construction input. */
type CreateCertificateErrorCode = "issuer_distinguished_name_empty" | "serial_number_not_positive" | "serial_number_too_long" | "validity_not_after_before_not_before";
/**
 * Configures the certificate validity window.
 *
 * If `notAfter` is omitted, it is derived from `notBefore` plus `days`. If both
 * `notAfter` and `days` are omitted, the certificate is valid for 30 days.
 */
interface ValidityInput {
  /**
   * Start of the validity window.
   *
   * Defaults to the current time.
   */
  readonly notBefore?: Date;
  /**
   * End of the validity window.
   *
   * Must be later than `notBefore`.
   */
  readonly notAfter?: Date;
  /**
   * Number of days to add to `notBefore` when `notAfter` is omitted.
   */
  readonly days?: number;
}
/**
 * Input for {@linkcode createCertificate}.
 */
interface CreateCertificateInput {
  /**
   * Issuer distinguished name.
   */
  readonly issuer: NameInput;
  /**
   * Subject distinguished name.
   */
  readonly subject: NameInput;
  /**
   * Subject public key to encode into the certificate.
   */
  readonly publicKey: CryptoKey;
  /**
   * Private key used to sign the certificate.
   */
  readonly signerPrivateKey: CryptoKey;
  /**
   * Issuer public key.
   *
   * Provide this when extension builders need issuer key material, such as
   * authority key identifier derivation.
   */
  readonly issuerPublicKey?: CryptoKey;
  /**
   * Validity window configuration.
   */
  readonly validity?: ValidityInput;
  /**
   * DER integer bytes for the certificate serial number.
   *
   * RFC 5280 §4.1.2.2 requires a positive value of at most 20 octets.
   * When omitted, a random positive 16-byte serial number is generated.
   */
  readonly serialNumber?: Uint8Array;
  /**
   * X.509 extensions to encode into the certificate.
   */
  readonly extensions?: CertificateExtensionsInput;
  /**
   * Signature algorithm override.
   *
   * When omitted, the library selects a compatible profile from the signing
   * key.
   */
  readonly signature?: SignatureProfileInput;
}
/**
 * Input for {@linkcode createSelfSignedCertificate}.
 */
type CreateSelfSignedCertificateInput = CreateSelfSignedCertificateBase & SelfSignedKeySource;
/**
 * Where {@linkcode createSelfSignedCertificate} gets its key pair.
 *
 * Supplying `keyPair` makes `algorithm` unreachable, since generation is skipped.
 */
type SelfSignedKeySource = {
  /**
   * Existing key pair to reuse for both subject and issuer.
   */
  readonly keyPair: KeyPairMaterial;
  /**
   * Unavailable in this variant; the supplied `keyPair` is used as-is.
   */
  readonly algorithm?: never;
} | {
  /**
   * Generate a new key pair for both subject and issuer.
   */
  readonly keyPair?: never;
  /**
   * Key generation parameters. Defaults to the {@linkcode generateKeyPair} default.
   */
  readonly algorithm?: KeyAlgorithmInput;
};
/** Fields common to both {@linkcode SelfSignedKeySource} variants. */
interface CreateSelfSignedCertificateBase {
  /**
   * Subject distinguished name used as both subject and issuer.
   */
  readonly subject: NameInput;
  /**
   * Validity window configuration.
   */
  readonly validity?: ValidityInput;
  /**
   * DER integer bytes for the certificate serial number.
   *
   * RFC 5280 §4.1.2.2 requires a positive value of at most 20 octets.
   * When omitted, a random positive 16-byte serial number is generated.
   */
  readonly serialNumber?: Uint8Array;
  /**
   * X.509 extensions to encode into the certificate.
   */
  readonly extensions?: CertificateExtensionsInput;
  /**
   * Signature algorithm override.
   */
  readonly signature?: SignatureProfileInput;
}
/**
 * Encoded certificate material in common interchange formats.
 */
interface CertificateMaterial {
  /**
   * DER-encoded certificate bytes.
   */
  readonly der: Uint8Array;
  /**
   * PEM-encoded certificate.
   */
  readonly pem: string;
  /**
   * Base64 encoding of {@linkcode der} without PEM armor.
   */
  readonly base64: string;
}
/**
 * Result returned by {@linkcode createSelfSignedCertificate}.
 */
interface SelfSignedCertificateResult {
  /**
   * Encoded certificate outputs.
   */
  readonly certificate: CertificateMaterial;
  /**
   * Key pair used to issue the certificate.
   */
  readonly keyPair: KeyPairMaterial;
}
/**
 * Create a self-signed certificate.
 *
 * Reuses `input.keyPair` when provided; otherwise generates a new key pair from
 * `input.algorithm`. The returned certificate uses `input.subject` as both
 * issuer and subject.
 *
 * @example
 * ```ts
 * const { certificate, keyPair } = await createSelfSignedCertificate({
 * 	subject: { commonName: 'example.com' },
 * 	algorithm: { kind: 'ecdsa', curve: 'P-256' },
 * });
 * ```
 *
 * @param input Certificate subject, key, validity, and extension settings.
 * @returns The certificate plus the key pair used to sign it.
 */
declare function createSelfSignedCertificate(input: CreateSelfSignedCertificateInput): Promise<SelfSignedCertificateResult>;
/**
 * Create an X.509 certificate signed by `input.signerPrivateKey`.
 *
 * The certificate encodes `input.subject`, `input.publicKey`, and any supplied
 * extensions. When `serialNumber` is omitted, a random positive serial number is
 * generated. When `validity` is omitted, the certificate is valid from now for
 * 30 days.
 *
 * @example
 * ```ts
 * const certificate = await createCertificate({
 * 	issuer: { commonName: 'Example Root CA' },
 * 	subject: { commonName: 'example.com' },
 * 	publicKey: leafKeys.publicKey,
 * 	signerPrivateKey: issuerKeys.privateKey,
 * 	issuerPublicKey: issuerKeys.publicKey,
 * });
 * ```
 *
 * @param input Issuer, subject, key, validity, and extension settings.
 * @returns The encoded certificate material.
 */
declare function createCertificate(input: CreateCertificateInput): Promise<CertificateMaterial>;
//#endregion
export { type AuthorityInfoAccessMethod, type AuthorityInformationAccess, type AuthorityInformationAccessInput, type BasicConstraints, type CertificateExtensionsInput, CertificateMaterial, type CertificatePolicies, type CpsPolicyQualifierInfo, CreateCertificateErrorCode, CreateCertificateInput, CreateSelfSignedCertificateBase, CreateSelfSignedCertificateInput, type CustomAuthorityInfoAccessMethod, type CustomExtendedKeyUsage, type CustomExtension, type CustomPolicyQualifierInfo, type DistributionPoint, type DistributionPointName, type DistributionPointReason, type ExtendedKeyUsage, type ExtensionEncoderErrorCode, type GeneralName, type GeneralSubtree, type InhibitAnyPolicy, type IssuingDistributionPoint, type IssuingDistributionPointBase, type IssuingDistributionPointForAttributeCerts, type IssuingDistributionPointForCaCerts, type IssuingDistributionPointForUserCerts, type KeyUsage, type KnownAuthorityInfoAccessMethod, type KnownExtendedKeyUsage, type NameConstraintForm, type NameConstraints, type NameEncoderErrorCode, type NameInput, type NameObject, type ParsedBitFlags, type ParsedNameConstraintForm, type PolicyConstraints, type PolicyInformation, type PolicyMapping, type PolicyMappings, type PolicyNoticeReference, type PolicyQualifierInfo, SelfSignedCertificateResult, SelfSignedKeySource, type SignatureProfileInput, type SubjectAltName, type UnsupportedNameConstraintForm, type UserNoticePolicyQualifierInfo, ValidityInput, type allOnesMaskForIpAddress, type buildCertificateExtensions, type buildRequestedExtensions, type buildSubjectKeyIdentifier, type canonicalDnKey, type compareDistinguishedNames, createCertificate, createSelfSignedCertificate, type decodeIpAddress, type encodeAuthorityInfoAccess, type encodeBasicConstraints, type encodeCertificatePolicies, type encodeCrlDistributionPoints, type encodeExtendedKeyUsage, type encodeExtension, type encodeInhibitAnyPolicy, type encodeKeyUsage, type encodeName, type encodeNameConstraints, type encodePolicyConstraints, type encodePolicyMappings, type encodeRelativeDistinguishedName, type encodeSubjectAltName, type getAuthorityInfoAccessMethodOid, type getExtendedKeyUsageOid, type isWithinDirectoryNameSubtree, type normalizeIpAddress, type parseAuthorityInfoAccessMethodOid, type parseExtendedKeyUsageOid, type parseIpAddressToBytes };
//# sourceMappingURL=certificate.d.ts.map