/**
 * CRL Certificate Revocation Checking
 *
 * Certificate Revocation List (CRL) validation for
 * certificate revocation checking.
 *
 * Features:
 * - CRL downloading and parsing
 * - CRL caching with automatic refresh
 * - Delta CRL support
 * - Distribution point handling
 * - Soft-fail mode
 *
 * @packageDocumentation
 */
import { type ParsedCertificate, type CRLData, type CRLEntry, type CRLConfig, PIVErrorCode } from './types.js';
/**
 * CRL validation error
 */
export declare class CRLError extends Error {
    readonly code: PIVErrorCode;
    readonly details?: Record<string, unknown>;
    constructor(message: string, code?: PIVErrorCode, details?: Record<string, unknown>);
}
/**
 * CRL download error
 */
export declare class CRLDownloadError extends CRLError {
    constructor(distributionPoint: string, originalError?: Error);
}
/**
 * CRL parsing error
 */
export declare class CRLParseError extends CRLError {
    constructor(message: string);
}
/**
 * CRL size exceeded error
 */
export declare class CRLSizeExceededError extends CRLError {
    constructor(size: number, maxSize: number);
}
/**
 * CRL validation service
 */
export declare class CRLValidator {
    private config;
    private cache;
    private pendingDownloads;
    private refreshTimers;
    constructor(config?: Partial<CRLConfig>);
    /**
     * Check if certificate is revoked via CRL
     */
    checkRevocationStatus(certificate: ParsedCertificate, issuerCertificate: ParsedCertificate): Promise<{
        revoked: boolean;
        entry?: CRLEntry;
        crl: CRLData;
    }>;
    /**
     * Get CRL distribution point from certificate
     */
    private getDistributionPoint;
    /**
     * Get CRL from cache or download
     */
    private getCRL;
    /**
     * Download and parse CRL
     */
    private downloadCRL;
    /**
     * Parse CRL data
     *
     * This is a simplified implementation. Production code should use
     * a proper ASN.1 library for complete CRL parsing.
     */
    private parseCRL;
    /**
     * Parse TBSCertList structure
     */
    private parseTBSCertList;
    /**
     * Extract Name (DN) from ASN.1 structure
     */
    private extractName;
    /**
     * Extract times from CRL
     */
    private extractTimes;
    /**
     * Extract revoked certificates list
     */
    private extractRevokedCertificates;
    /**
     * Check if data contains specific OID
     */
    private containsOID;
    /**
     * Extract CRL number from extensions
     */
    private extractCRLNumber;
    /**
     * Find ASN.1 tag in range
     */
    private findTag;
    /**
     * Find printable string or UTF8 string
     */
    private findPrintableString;
    /**
     * Extract OID from data
     */
    private extractOID;
    /**
     * Extract printable string value
     */
    private extractPrintableString;
    /**
     * Convert OID to attribute name
     */
    private oidToName;
    /**
     * Get ASN.1 length
     */
    private getLength;
    /**
     * Get number of length bytes
     */
    private getLengthBytes;
    /**
     * Parse UTCTime
     */
    private parseUTCTime;
    /**
     * Parse GeneralizedTime
     */
    private parseGeneralizedTime;
    /**
     * Get cache key
     */
    private getCacheKey;
    /**
     * Get cached CRL if valid
     */
    private getCachedCRL;
    /**
     * Cache CRL
     */
    private cacheCRL;
    /**
     * Schedule automatic CRL refresh
     */
    private scheduleRefresh;
    /**
     * Clear cache
     */
    clearCache(): void;
    /**
     * Update configuration
     */
    updateConfig(config: Partial<CRLConfig>): void;
    /**
     * Get current configuration
     */
    getConfig(): CRLConfig;
    /**
     * Get cache statistics
     */
    getCacheStats(): {
        size: number;
        entries: Array<{
            key: string;
            expiresAt: Date;
            revokedCount: number;
        }>;
    };
    /**
     * Shutdown validator (clear timers)
     */
    shutdown(): void;
}
/**
 * Get the default CRL validator
 */
export declare function getCRLValidator(config?: Partial<CRLConfig>): CRLValidator;
/**
 * Create a new CRL validator
 */
export declare function createCRLValidator(config?: Partial<CRLConfig>): CRLValidator;
/**
 * Reset the default validator (for testing)
 */
export declare function resetCRLValidator(): void;
//# sourceMappingURL=crl-validator.d.ts.map