import type { PublicKey, PrivateKey, Certificate, CertificateASN1, CertificatePEM } from '../types.js';
import type { CertId, NodeId } from '../../ids/types.js';
import * as x509 from '@peculiar/x509';
declare class PolykeyVersionString {
    value: string;
}
declare class PolykeyNodeSignatureString {
    value: ArrayBuffer;
}
declare class PolykeyVersionExtension extends x509.Extension {
    readonly version: string;
    constructor(raw: ArrayBuffer);
    constructor(version: string, critical?: boolean);
}
declare class PolykeyNodeSignatureExtension extends x509.Extension {
    readonly signature: string;
    readonly signatureBytes: ArrayBuffer;
    constructor(raw: ArrayBuffer);
    constructor(signature: string, critical?: boolean);
}
declare const extendedKeyUsageFlags: {
    serverAuth: string;
    clientAuth: string;
    codeSigning: string;
    emailProtection: string;
    timeStamping: string;
    ocspSigning: string;
};
/**
 * Generate x509 certificate.
 * Duration is in seconds.
 * X509 certificates currently use `UTCTime` format for `notBefore` and `notAfter`.
 * This means:
 *   - Only second resolution.
 *   - Minimum date for validity is 1970-01-01T00:00:00Z (inclusive).
 *   - Maximum date for valdity is 2049-12-31T23:59:59Z (inclusive).
 */
declare function generateCertificate({ certId, subjectKeyPair, issuerPrivateKey, duration, subjectAttrsExtra, issuerAttrsExtra, now, }: {
    certId: CertId;
    subjectKeyPair: {
        publicKey: PublicKey;
        privateKey: PrivateKey;
    };
    issuerPrivateKey: PrivateKey;
    duration: number;
    subjectAttrsExtra?: Array<{
        [key: string]: Array<string>;
    }>;
    issuerAttrsExtra?: Array<{
        [key: string]: Array<string>;
    }>;
    now?: Date;
}): Promise<Certificate>;
declare function certCertId(cert: Certificate): CertId | undefined;
/**
 * The returned buffers is guaranteed to unpooled.
 * This means the underlying `ArrayBuffer` is safely transferrable.
 */
declare function certPublicKey(cert: Certificate): PublicKey | undefined;
declare function certNodeId(cert: Certificate): NodeId | undefined;
/**
 * Checks if 2 certificates are exactly the same
 * This checks equality of the raw data buffer
 */
declare function certEqual(cert1: Certificate, cert2: Certificate): boolean;
/**
 * Checks if the subject certificate was issued by the issuer certificate
 * This is done by checking all attributes for equality.
 * This does not perform a signature check.
 */
declare function certIssuedBy(subject: Certificate, issuer: Certificate): boolean;
/**
 * Checks if the certificate is valid for a date.
 * Certificates are valid for a time range.
 * The time range is exclusive i.e. not-before and not-after.
 */
declare function certNotExpiredBy(cert: Certificate, now?: Date): boolean;
declare function certRemainingDuration(cert: Certificate, now?: Date): number;
/**
 * Checks if certificate is signed by public key.
 * This does not check if the certificate is valid for the current datetime.
 */
declare function certSignedBy(cert: Certificate, publicKey: PublicKey): Promise<boolean>;
/**
 * Checks if the certificate's node signature is valid.
 * This has to extract the TBS data, remove the node signature extension.
 * Then verify the signature against the mutated TBS data.
 */
declare function certNodeSigned(cert: Certificate): Promise<boolean>;
/**
 * The returned buffers is guaranteed to unpooled.
 * This means the underlying `ArrayBuffer` is safely transferrable.
 */
declare function certToASN1(cert: Certificate): CertificateASN1;
declare function certFromASN1(certASN1: CertificateASN1): Certificate | undefined;
declare function certToPEM(cert: Certificate): CertificatePEM;
declare function certFromPEM(certPEM: CertificatePEM): Certificate | undefined;
export { PolykeyVersionString, PolykeyVersionExtension, PolykeyNodeSignatureString, PolykeyNodeSignatureExtension, extendedKeyUsageFlags, generateCertificate, certCertId, certPublicKey, certNodeId, certEqual, certIssuedBy, certNotExpiredBy, certRemainingDuration, certSignedBy, certNodeSigned, certToASN1, certFromASN1, certToPEM, certFromPEM, };
export { createCertIdGenerator, encodeCertId, decodeCertId, } from '../../ids/index.js';