/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { Bytes, Construction, Duration, Environment } from "@matter/general";
import { DclClient } from "./DclClient.js";
import { DclConfig, DclGithubConfig } from "./DclConfig.js";
import type { CertSeedEntry, SeedSource } from "./SeedTypes.js";
/**
 * Implements a service to manage DCL root certificates as a singleton in the environment and so will be shared by
 * multiple nodes of relevant. It is mainly relevant for controller use cases.
 * The service supports fetching certificates from teh CSA production and test DCL instances, as well
 * as from a GitHub repository for development certificates.
 */
export declare class DclCertificateService {
    #private;
    constructor(environment: Environment, options?: DclCertificateService.Options);
    get construction(): Construction<DclCertificateService>;
    /**
     * Get certificate metadata by subject key identifier. Returns undefined if not found or if the
     * entry is filtered by the effective trust policy.
     */
    getCertificate(subjectKeyId: Bytes | string, options?: DclCertificateService.GetCertificateOptions): DclCertificateService.CertificateMetadata | undefined;
    /**
     * Get all certificate metadata entries (raw enumeration, unaffected by the
     * `fetchTestCertificates` filter so management commands can still inspect cached test certs).
     */
    get certificates(): DclCertificateService.CertificateMetadata[];
    /**
     * Whether the service trusts test (non-production) certificates as valid trust anchors.
     *
     * Independent of {@link Options.fetchTestCertificates} (which only governs whether test certs are
     * downloaded). Defaults to {@link Options.acceptTestCertificates}, falling back to
     * `fetchTestCertificates` when the trust policy is not set explicitly.
     */
    get acceptsTestCertificates(): boolean;
    /**
     * Get certificate as PEM string.
     * @throws {MatterDclError} if certificate not found or filtered by trust policy
     */
    getCertificateAsPem(subjectKeyId: Bytes | string, options?: DclCertificateService.GetCertificateOptions): Promise<string>;
    /**
     * Get certificate as DER bytes.
     *
     * Self-heals a corrupted local cache: if the stored certificate no longer parses (e.g. a
     * truncated or mangled storage entry), make one best-effort re-fetch from DCL so a broken cache
     * entry cannot permanently break attestation for an otherwise-valid trust anchor. If recovery
     * fails the original bytes are returned unchanged, leaving the caller's normal validation to
     * surface the parse failure rather than masking it with a different error here.
     *
     * @throws {MatterDclError} if certificate not found or filtered by trust policy
     */
    getCertificateAsDer(subjectKeyId: Bytes | string, options?: DclCertificateService.GetCertificateOptions): Promise<AllowSharedBufferSource>;
    /**
     * Check if a certificate is revoked by looking up its serial number in the revocation set
     * for the given authority key identifier.
     *
     * Lazily fetches revocation data from DCL on first access per AKID, then caches for 1 hour.
     * Per spec Section 6.2.4.2, the revocation set is indexed by (AuthorityKeyIdentifier, IssuerDN).
     *
     * Returns true if the certificate is revoked, false otherwise.
     * If revocation data is not available for the given authority, returns false.
     */
    isRevoked(authorityKeyIdentifier: Bytes | string, serialNumber: Bytes | string, issuerDnDerHex?: string): Promise<boolean>;
    /**
     * Get certificate metadata by subject key identifier, fetching from DCL if not in local storage.
     * Returns undefined if not found or if the entry is filtered by the effective trust policy.
     */
    getOrFetchCertificate(subjectKeyId: Bytes | string, options?: DclClient.Options & {
        isProduction?: boolean;
    } & DclCertificateService.GetCertificateOptions): Promise<DclCertificateService.CertificateMetadata | undefined>;
    /**
     * Delete a certificate from storage and index.
     */
    deleteCertificate(subjectKeyId: Bytes | string): Promise<void>;
    /**
     * Inject a certificate (PAA or CD signer) into the trust store.
     *
     * Returns `true` if the certificate was newly added, `false` if a certificate with the same
     * SubjectKeyIdentifier already exists (in which case the store is unchanged).
     *
     * @param derBytes DER-encoded X.509 certificate
     * @param kind "PAA" (self-signed root) or "CDSigner" (CMS Certification Declaration signer)
     * @param options.isProduction  mark as production-trust; defaults to `false`
     */
    addCertificate(derBytes: Bytes, kind: DclCertificateService.CertificateKind, options?: {
        isProduction?: boolean;
    }): Promise<boolean>;
    /**
     * Look up a CD signer certificate by its SubjectKeyIdentifier.
     *
     * Checks the local trust store first. On miss, queries the production DCL
     * (`/dcl/pki/all-certificates?subjectKeyId=<skid>`) and caches the result as a
     * CDSigner entry with `isProduction: true`.
     *
     * Returns `undefined` if no matching CD signer can be found either locally or on DCL.
     */
    getOrFetchCdSigner(subjectKeyId: Bytes | string): Promise<{
        publicKey: Bytes;
        isProduction: boolean;
    } | undefined>;
    /**
     * Close the service and stop all timers.
     */
    close(): Promise<void>;
    /**
     * Update certificates from DCL and GitHub. Returns true if update succeeded, false if it failed.
     */
    update(force?: boolean): Promise<void | boolean>;
    /** Result of parsing a CRL. */
    static parseCrl(crlDer: Bytes): DclCertificateService.CrlParseResult;
    /** Convenience wrapper that returns only the revoked serial numbers from a CRL. */
    static parseCrlRevokedSerials(crlDer: Bytes): Set<string>;
}
export declare namespace DclCertificateService {
    /** Per-call options for certificate retrieval. */
    interface GetCertificateOptions {
        /**
         * Whether the lookup should also return test (non-production) certificates.
         * Defaults to the service-wide `fetchTestCertificates` flag passed at construction.
         */
        considerTestCertificates?: boolean;
    }
    interface Options {
        /** Whether to fetch test certificates in addition to production ones. Default is false. */
        fetchTestCertificates?: boolean;
        /**
         * Whether to trust test (non-production) certificates as valid trust anchors. Controls whether a
         * matched test PAA is accepted during device attestation or flagged via a
         * `TrustedAsTestCertificate` finding. Independent of `fetchTestCertificates`. Defaults to the value
         * of `fetchTestCertificates` when not set.
         */
        acceptTestCertificates?: boolean;
        /** Whether to fetch development certificates from GitHub. Default is true (when fetchTestCertificates is true). */
        fetchGithubCertificates?: boolean;
        /**
         * Interval for periodic certificate updates. Default is 1 day. Set to null to disable automatic certificate
         * updates
         */
        updateInterval?: Duration | null;
        /** Timeout for DCL requests. Default is 5s. */
        timeout?: Duration;
        /** DCL config for production endpoint. Defaults to DclConfig.production. */
        dclConfig?: DclConfig;
        /** DCL config for test endpoint. Defaults to DclConfig.test. */
        testDclConfig?: DclConfig;
        /** GitHub config for development certificates. Programmatic override only. Defaults to DclGithubConfig.defaults. */
        githubConfig?: DclGithubConfig;
        /** Pre-populate storage from snapshot before the initial network update. Network update still runs after. */
        seed?: {
            paaRoots?: SeedSource<CertSeedEntry>;
            cdSigners?: SeedSource<CertSeedEntry>;
        };
    }
    /** Kind of certificate stored in the trust store. */
    type CertificateKind = "PAA" | "CDSigner";
    /**
     * Metadata for a stored certificate.
     */
    type CertificateMetadata = {
        subject?: string;
        subjectAsText?: string;
        subjectKeyId: string;
        serialNumber: string;
        vid: number;
        isRoot: boolean;
        isProduction: boolean;
        /** Kind of certificate. Defaults to "PAA" when absent (backward compat). */
        kind?: CertificateKind;
        /** Epoch timestamp (ms) when this certificate was first fetched and added to the local trust store. */
        fetchedAt?: number;
    };
    /** Cached revocation data for a single AKID. */
    interface RevocationEntry {
        serials: Set<string>;
        issuerDnDerHex?: string;
    }
    /** Result of parsing a DER-encoded CRL. */
    interface CrlParseResult {
        /** Revoked serial numbers (uppercase hex). */
        serials: Set<string>;
        /** Hex of the DER-encoded issuer Name, for composite revocation key matching. */
        issuerDnDerHex?: string;
        /** CRL Authority Key Identifier extension value (uppercase hex). */
        authorityKeyId?: string;
        /** Raw DER bytes of tbsCertList for signature verification. */
        tbsDer?: Bytes;
        /** Raw signature value bytes from the CRL. */
        signatureValue?: Bytes;
        /** Unix epoch ms of the CRL's nextUpdate field, if present. */
        nextUpdateMs?: number;
    }
}
//# sourceMappingURL=DclCertificateService.d.ts.map