/**
 * OCSP Certificate Validation
 *
 * Online Certificate Status Protocol (OCSP) validation for
 * real-time certificate revocation checking.
 *
 * Features:
 * - OCSP request generation
 * - Response parsing and validation
 * - Response caching
 * - Nonce support
 * - Soft-fail mode
 *
 * @packageDocumentation
 */
import { type ParsedCertificate, type OCSPResponse, type OCSPConfig, PIVErrorCode } from './types.js';
/**
 * OCSP validation error
 */
export declare class OCSPError extends Error {
    readonly code: PIVErrorCode;
    readonly details?: Record<string, unknown>;
    constructor(message: string, code?: PIVErrorCode, details?: Record<string, unknown>);
}
/**
 * OCSP responder unavailable error
 */
export declare class OCSPResponderUnavailableError extends OCSPError {
    constructor(responderUrl: string, originalError?: Error);
}
/**
 * OCSP response error
 */
export declare class OCSPResponseError extends OCSPError {
    constructor(message: string, status?: number);
}
/**
 * OCSP validation service
 */
export declare class OCSPValidator {
    private config;
    private cache;
    private pendingRequests;
    constructor(config?: Partial<OCSPConfig>);
    /**
     * Check certificate revocation status via OCSP
     */
    checkRevocationStatus(certificate: ParsedCertificate, issuerCertificate: ParsedCertificate): Promise<OCSPResponse>;
    /**
     * Execute OCSP request
     */
    private executeOCSPRequest;
    /**
     * Get OCSP responder URL from certificate
     */
    private getResponderUrl;
    /**
     * Build OCSP request
     *
     * This is a simplified implementation. Production code should use
     * a proper ASN.1 library for OCSP request generation.
     */
    private buildOCSPRequest;
    /**
     * Build CertID structure
     */
    private buildCertId;
    /**
     * Build Request structure
     */
    private buildRequest;
    /**
     * Build TBSRequest structure
     */
    private buildTBSRequest;
    /**
     * Build nonce extension
     */
    private buildNonceExtension;
    /**
     * Wrap OCSP request
     */
    private wrapOCSPRequest;
    /**
     * ASN.1 SEQUENCE wrapper
     */
    private wrapSequence;
    /**
     * ASN.1 OCTET STRING wrapper
     */
    private wrapOctetString;
    /**
     * ASN.1 INTEGER wrapper
     */
    private wrapInteger;
    /**
     * Generic ASN.1 tag wrapper
     */
    private wrapTag;
    /**
     * Parse OCSP response
     *
     * This is a simplified implementation. Production code should use
     * a proper ASN.1 library for full response parsing.
     */
    private parseOCSPResponse;
    /**
     * Find ASN.1 tag in buffer
     */
    private findTag;
    /**
     * Extract certificate status from response
     */
    private extractCertStatus;
    /**
     * Parse RevokedInfo structure
     */
    private parseRevokedInfo;
    /**
     * Parse GeneralizedTime
     */
    private parseGeneralizedTime;
    /**
     * Extract timestamps from response
     */
    private extractTimestamps;
    /**
     * Extract responder ID from response
     */
    private extractResponderId;
    /**
     * Extract nonce from response
     */
    private extractNonce;
    /**
     * Get cache key for certificate
     */
    private getCacheKey;
    /**
     * Get cached response if valid
     */
    private getCachedResponse;
    /**
     * Cache OCSP response
     */
    private cacheResponse;
    /**
     * Clean up expired cache entries
     */
    private cleanupCache;
    /**
     * Clear cache
     */
    clearCache(): void;
    /**
     * Update configuration
     */
    updateConfig(config: Partial<OCSPConfig>): void;
    /**
     * Get current configuration
     */
    getConfig(): OCSPConfig;
    /**
     * Get cache statistics
     */
    getCacheStats(): {
        size: number;
        entries: string[];
    };
}
/**
 * Get the default OCSP validator
 */
export declare function getOCSPValidator(config?: Partial<OCSPConfig>): OCSPValidator;
/**
 * Create a new OCSP validator
 */
export declare function createOCSPValidator(config?: Partial<OCSPConfig>): OCSPValidator;
/**
 * Reset the default validator (for testing)
 */
export declare function resetOCSPValidator(): void;
//# sourceMappingURL=ocsp-validator.d.ts.map