/**
 * X.509 Certificate Authentication
 *
 * Provides X.509 certificate parsing, validation, and authentication
 * for PIV/CAC smart card authentication.
 *
 * Features:
 * - Certificate parsing and validation
 * - Chain building and verification
 * - Key usage and policy validation
 * - DoD PKI compatibility
 *
 * @packageDocumentation
 */
import { type ParsedCertificate, type CertificateChain, type CertificateValidationResult, type TrustedCAConfig, type PIVCACConfig, PIVErrorCode } from './types.js';
/**
 * Base error class for certificate authentication errors
 */
export declare class CertificateAuthError extends Error {
    readonly code: PIVErrorCode;
    readonly details?: Record<string, unknown>;
    constructor(message: string, code: PIVErrorCode, details?: Record<string, unknown>);
}
/**
 * Certificate parsing error
 */
export declare class CertificateParseError extends CertificateAuthError {
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Certificate validation error
 */
export declare class CertificateValidationError extends CertificateAuthError {
    readonly validationResult?: CertificateValidationResult;
    constructor(message: string, code: PIVErrorCode, validationResult?: CertificateValidationResult, details?: Record<string, unknown>);
}
/**
 * Parse a PEM-encoded X.509 certificate
 *
 * This implementation uses Node.js crypto module for basic parsing.
 * For production use, consider using a dedicated X.509 library like
 * @peculiar/x509 or node-forge for more complete ASN.1 parsing.
 */
export declare function parseCertificate(pem: string): ParsedCertificate;
/**
 * Parse multiple PEM certificates from a chain
 */
export declare function parseCertificateChain(pem: string): ParsedCertificate[];
/**
 * Build a certificate chain from end-entity and available certificates
 */
export declare function buildCertificateChain(endEntity: ParsedCertificate, availableCerts: ParsedCertificate[], trustedCAs: TrustedCAConfig[]): CertificateChain;
/**
 * Certificate authentication service
 */
export declare class CertificateAuthService {
    private config;
    private trustedCAs;
    constructor(config?: Partial<PIVCACConfig>);
    /**
     * Load trusted CA certificates
     */
    private loadTrustedCAs;
    /**
     * Get all trusted CA certificates
     */
    getTrustedCAs(): ParsedCertificate[];
    /**
     * Add a trusted CA certificate
     */
    addTrustedCA(config: TrustedCAConfig): void;
    /**
     * Validate a certificate
     */
    validateCertificate(certificate: ParsedCertificate, chain?: ParsedCertificate[]): Promise<CertificateValidationResult>;
    /**
     * Validate key usage extension
     */
    private validateKeyUsage;
    /**
     * Validate extended key usage extension
     */
    private validateExtendedKeyUsage;
    /**
     * Validate certificate policies extension
     */
    private validateCertificatePolicies;
    /**
     * Validate certificate chain
     */
    private validateChain;
    /**
     * Create a validation result object
     */
    private createValidationResult;
    /**
     * Update configuration
     */
    updateConfig(config: Partial<PIVCACConfig>): void;
    /**
     * Get current configuration
     */
    getConfig(): PIVCACConfig;
}
/**
 * Get the default certificate authentication service
 */
export declare function getCertificateAuthService(config?: Partial<PIVCACConfig>): CertificateAuthService;
/**
 * Create a new certificate authentication service
 */
export declare function createCertificateAuthService(config?: Partial<PIVCACConfig>): CertificateAuthService;
/**
 * Reset the default service (for testing)
 */
export declare function resetCertificateAuthService(): void;
//# sourceMappingURL=certificate-auth.d.ts.map