import { SignatureProfileInput } from "../internal/crypto/signing.js";
import { canonicalDnKey, compareDistinguishedNames, isWithinDirectoryNameSubtree } from "../internal/shared/dn.js";
import { NameAttribute, NameEncoderErrorCode, NameFieldKey, NameInput, NameObject, RelativeDistinguishedNameInput, encodeName, encodeRelativeDistinguishedName } from "./name.js";
import { ExtensionEncoderErrorCode } from "../internal/x509/extension-errors.js";
import { allOnesMaskForIpAddress, decodeIpAddress, normalizeIpAddress, parseIpAddressToBytes } from "../internal/shared/ip.js";
import { AuthorityInfoAccessMethod, AuthorityInformationAccess, AuthorityInformationAccessInput, BasicConstraints, CertificateExtensionsInput, CertificatePolicies, CpsPolicyQualifierInfo, CustomAuthorityInfoAccessMethod, CustomExtendedKeyUsage, CustomExtension, CustomPolicyQualifierInfo, DistributionPoint, DistributionPointName, DistributionPointReason, ExtendedKeyUsage, GeneralName, GeneralSubtree, InhibitAnyPolicy, IssuingDistributionPoint, IssuingDistributionPointBase, IssuingDistributionPointForAttributeCerts, IssuingDistributionPointForCaCerts, IssuingDistributionPointForUserCerts, KeyUsage, KnownAuthorityInfoAccessMethod, KnownExtendedKeyUsage, NameConstraintForm, NameConstraints, ParsedBitFlags, ParsedNameConstraintForm, PolicyConstraints, PolicyInformation, PolicyMapping, PolicyMappings, PolicyNoticeReference, PolicyQualifierInfo, SubjectAltName, UnsupportedNameConstraintForm, UserNoticePolicyQualifierInfo, buildCertificateExtensions, buildRequestedExtensions, buildSubjectKeyIdentifier, encodeAuthorityInfoAccess, encodeBasicConstraints, encodeCertificatePolicies, encodeCrlDistributionPoints, encodeExtendedKeyUsage, encodeExtension, encodeInhibitAnyPolicy, encodeKeyUsage, encodeNameConstraints, encodePolicyConstraints, encodePolicyMappings, encodeSubjectAltName, getAuthorityInfoAccessMethodOid, getExtendedKeyUsageOid, parseAuthorityInfoAccessMethodOid, parseExtendedKeyUsageOid } from "./extensions.js";
//#region src/x509/csr.d.ts
/** Input for {@linkcode createCertificateSigningRequest}. */
interface CreateCsrInput {
  /** Distinguished name for the CSR subject (e.g. `{ commonName: 'example.com' }`). */
  readonly subject: NameInput;
  /** WebCrypto public key to embed in the CSR's SubjectPublicKeyInfo. */
  readonly publicKey: CryptoKey;
  /** WebCrypto private key used to self-sign the CSR (proves key possession). */
  readonly signerPrivateKey: CryptoKey;
  /** Requested X.509v3 extensions to include in the CSR attributes. */
  readonly extensions?: CertificateExtensionsInput;
  /** Override the signature algorithm profile (hash, salt length, etc.). */
  readonly signature?: SignatureProfileInput;
}
/** DER, PEM, and base64 encodings of a CSR produced by {@linkcode createCertificateSigningRequest}. */
interface CsrMaterial {
  /** Raw DER-encoded PKCS#10 CertificationRequest. */
  readonly der: Uint8Array;
  /** PEM-armored CSR (`-----BEGIN CERTIFICATE REQUEST-----`). */
  readonly pem: string;
  /** Base64-encoded DER (no PEM armor). */
  readonly base64: string;
}
/**
 * Creates a PKCS#10 Certificate Signing Request signed with the given private key.
 *
 * The CSR embeds the public key's SPKI, the subject name, and any requested extensions
 * as attributes. The signature proves possession of the private key.
 *
 * @example
 * ```ts
 * import { createCertificateSigningRequest } from 'micro509';
 *
 * const keyPair = await crypto.subtle.generateKey(
 *   { name: 'ECDSA', namedCurve: 'P-256' },
 *   true,
 *   ['sign', 'verify'],
 * );
 * const csr = await createCertificateSigningRequest({
 *   subject: { commonName: 'example.com' },
 *   publicKey: keyPair.publicKey,
 *   signerPrivateKey: keyPair.privateKey,
 *   extensions: { subjectAltNames: [{ type: 'dns', value: 'example.com' }] },
 * });
 * console.log(csr.pem);
 * ```
 */
declare function createCertificateSigningRequest(input: CreateCsrInput): Promise<CsrMaterial>;
//#endregion
export { type AuthorityInfoAccessMethod, type AuthorityInformationAccess, type AuthorityInformationAccessInput, type BasicConstraints, type CertificateExtensionsInput, type CertificatePolicies, type CpsPolicyQualifierInfo, CreateCsrInput, CsrMaterial, type CustomAuthorityInfoAccessMethod, type CustomExtendedKeyUsage, type CustomExtension, type CustomPolicyQualifierInfo, type DistributionPoint, type DistributionPointName, type DistributionPointReason, type ExtendedKeyUsage, type ExtensionEncoderErrorCode, type GeneralName, type GeneralSubtree, type InhibitAnyPolicy, type IssuingDistributionPoint, type IssuingDistributionPointBase, type IssuingDistributionPointForAttributeCerts, type IssuingDistributionPointForCaCerts, type IssuingDistributionPointForUserCerts, type KeyUsage, type KnownAuthorityInfoAccessMethod, type KnownExtendedKeyUsage, type NameConstraintForm, type NameConstraints, type NameEncoderErrorCode, type NameInput, type NameObject, type ParsedBitFlags, type ParsedNameConstraintForm, type PolicyConstraints, type PolicyInformation, type PolicyMapping, type PolicyMappings, type PolicyNoticeReference, type PolicyQualifierInfo, type SubjectAltName, type UnsupportedNameConstraintForm, type UserNoticePolicyQualifierInfo, type allOnesMaskForIpAddress, type buildCertificateExtensions, type buildRequestedExtensions, type buildSubjectKeyIdentifier, type canonicalDnKey, type compareDistinguishedNames, createCertificateSigningRequest, type decodeIpAddress, type encodeAuthorityInfoAccess, type encodeBasicConstraints, type encodeCertificatePolicies, type encodeCrlDistributionPoints, type encodeExtendedKeyUsage, type encodeExtension, type encodeInhibitAnyPolicy, type encodeKeyUsage, type encodeName, type encodeNameConstraints, type encodePolicyConstraints, type encodePolicyMappings, type encodeRelativeDistinguishedName, type encodeSubjectAltName, type getAuthorityInfoAccessMethodOid, type getExtendedKeyUsageOid, type isWithinDirectoryNameSubtree, type normalizeIpAddress, type parseAuthorityInfoAccessMethodOid, type parseExtendedKeyUsageOid, type parseIpAddressToBytes };
//# sourceMappingURL=csr.d.ts.map