@vorionsys/platform-core 0.1.0

package/dist/auth/piv-cac/types.d.ts

@@ -0,0 +1,4098 @@
+/**
+ * PIV/CAC Smart Card Authentication Types
+ *
+ * Type definitions for Personal Identity Verification (PIV) and
+ * Common Access Card (CAC) smart card authentication.
+ *
+ * Supports:
+ * - X.509 certificate authentication
+ * - OCSP/CRL certificate validation
+ * - Certificate-to-user mapping (UPN/SAN)
+ * - Card removal session termination
+ * - DoD PKI compatibility
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+/**
+ * Certificate validation status
+ */
+export declare enum CertificateValidationStatus {
+    /** Certificate is valid */
+    VALID = "valid",
+    /** Certificate has been revoked */
+    REVOKED = "revoked",
+    /** Certificate has expired */
+    EXPIRED = "expired",
+    /** Certificate is not yet valid */
+    NOT_YET_VALID = "not_yet_valid",
+    /** Certificate chain is incomplete or invalid */
+    CHAIN_INVALID = "chain_invalid",
+    /** Certificate signature verification failed */
+    SIGNATURE_INVALID = "signature_invalid",
+    /** Unable to verify certificate status */
+    UNKNOWN = "unknown"
+}
+export declare const certificateValidationStatusSchema: z.ZodNativeEnum<typeof CertificateValidationStatus>;
+/**
+ * Certificate revocation check method
+ */
+export declare enum RevocationCheckMethod {
+    /** Online Certificate Status Protocol */
+    OCSP = "ocsp",
+    /** Certificate Revocation List */
+    CRL = "crl",
+    /** Both OCSP and CRL */
+    BOTH = "both",
+    /** OCSP with CRL fallback */
+    OCSP_WITH_CRL_FALLBACK = "ocsp_with_crl_fallback",
+    /** No revocation checking (not recommended) */
+    NONE = "none"
+}
+export declare const revocationCheckMethodSchema: z.ZodNativeEnum<typeof RevocationCheckMethod>;
+/**
+ * PIV key usage types
+ */
+export declare enum PIVKeyUsage {
+    /** PIV Authentication key */
+    PIV_AUTHENTICATION = "piv_authentication",
+    /** Card Authentication key */
+    CARD_AUTHENTICATION = "card_authentication",
+    /** Digital Signature key */
+    DIGITAL_SIGNATURE = "digital_signature",
+    /** Key Management key */
+    KEY_MANAGEMENT = "key_management"
+}
+export declare const pivKeyUsageSchema: z.ZodNativeEnum<typeof PIVKeyUsage>;
+/**
+ * Certificate mapping strategy
+ */
+export declare enum CertificateMappingStrategy {
+    /** Map using Subject Alternative Name (SAN) */
+    SAN = "san",
+    /** Map using User Principal Name (UPN) from SAN */
+    UPN = "upn",
+    /** Map using email address from SAN or Subject */
+    EMAIL = "email",
+    /** Map using Subject Distinguished Name */
+    SUBJECT_DN = "subject_dn",
+    /** Map using certificate serial number + issuer */
+    SERIAL_ISSUER = "serial_issuer",
+    /** Custom mapping function */
+    CUSTOM = "custom"
+}
+export declare const certificateMappingStrategySchema: z.ZodNativeEnum<typeof CertificateMappingStrategy>;
+/**
+ * Card event types
+ */
+export declare enum CardEventType {
+    /** Card inserted into reader */
+    CARD_INSERTED = "card_inserted",
+    /** Card removed from reader */
+    CARD_REMOVED = "card_removed",
+    /** Card reader connected */
+    READER_CONNECTED = "reader_connected",
+    /** Card reader disconnected */
+    READER_DISCONNECTED = "reader_disconnected",
+    /** PIN entry required */
+    PIN_REQUIRED = "pin_required",
+    /** PIN verified successfully */
+    PIN_VERIFIED = "pin_verified",
+    /** PIN verification failed */
+    PIN_FAILED = "pin_failed",
+    /** Card locked due to failed PIN attempts */
+    CARD_LOCKED = "card_locked"
+}
+export declare const cardEventTypeSchema: z.ZodNativeEnum<typeof CardEventType>;
+/**
+ * X.509 certificate extension
+ */
+export interface X509Extension {
+    /** OID of the extension */
+    oid: string;
+    /** Whether the extension is critical */
+    critical: boolean;
+    /** Extension value (base64 encoded) */
+    value: string;
+    /** Parsed extension data if available */
+    parsed?: Record<string, unknown>;
+}
+export declare const x509ExtensionSchema: z.ZodObject<{
+    oid: z.ZodString;
+    critical: z.ZodBoolean;
+    value: z.ZodString;
+    parsed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    value?: string;
+    critical?: boolean;
+    parsed?: Record<string, unknown>;
+    oid?: string;
+}, {
+    value?: string;
+    critical?: boolean;
+    parsed?: Record<string, unknown>;
+    oid?: string;
+}>;
+/**
+ * Subject Alternative Name entry
+ */
+export interface SubjectAltName {
+    /** Type of SAN entry */
+    type: 'email' | 'dns' | 'uri' | 'ip' | 'upn' | 'other';
+    /** Value of the SAN entry */
+    value: string;
+    /** OID for 'other' type */
+    oid?: string;
+}
+export declare const subjectAltNameSchema: z.ZodObject<{
+    type: z.ZodEnum<["email", "dns", "uri", "ip", "upn", "other"]>;
+    value: z.ZodString;
+    oid: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    value?: string;
+    type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+    oid?: string;
+}, {
+    value?: string;
+    type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+    oid?: string;
+}>;
+/**
+ * Distinguished Name components
+ */
+export interface DistinguishedName {
+    /** Common Name */
+    CN?: string;
+    /** Organization */
+    O?: string;
+    /** Organizational Unit */
+    OU?: string;
+    /** Country */
+    C?: string;
+    /** State or Province */
+    ST?: string;
+    /** Locality */
+    L?: string;
+    /** Email Address */
+    E?: string;
+    /** Serial Number */
+    serialNumber?: string;
+    /** Full DN string */
+    full: string;
+}
+export declare const distinguishedNameSchema: z.ZodObject<{
+    CN: z.ZodOptional<z.ZodString>;
+    O: z.ZodOptional<z.ZodString>;
+    OU: z.ZodOptional<z.ZodString>;
+    C: z.ZodOptional<z.ZodString>;
+    ST: z.ZodOptional<z.ZodString>;
+    L: z.ZodOptional<z.ZodString>;
+    E: z.ZodOptional<z.ZodString>;
+    serialNumber: z.ZodOptional<z.ZodString>;
+    full: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    full?: string;
+    C?: string;
+    E?: string;
+    L?: string;
+    O?: string;
+    CN?: string;
+    OU?: string;
+    ST?: string;
+    serialNumber?: string;
+}, {
+    full?: string;
+    C?: string;
+    E?: string;
+    L?: string;
+    O?: string;
+    CN?: string;
+    OU?: string;
+    ST?: string;
+    serialNumber?: string;
+}>;
+/**
+ * Parsed X.509 certificate
+ */
+export interface ParsedCertificate {
+    /** Certificate version (usually 3 for X.509v3) */
+    version: number;
+    /** Serial number (hex string) */
+    serialNumber: string;
+    /** Signature algorithm OID */
+    signatureAlgorithm: string;
+    /** Issuer distinguished name */
+    issuer: DistinguishedName;
+    /** Subject distinguished name */
+    subject: DistinguishedName;
+    /** Not valid before date */
+    notBefore: Date;
+    /** Not valid after date */
+    notAfter: Date;
+    /** Public key algorithm */
+    publicKeyAlgorithm: string;
+    /** Public key (PEM encoded) */
+    publicKey: string;
+    /** Subject Alternative Names */
+    subjectAltNames: SubjectAltName[];
+    /** Key Usage extension */
+    keyUsage?: string[];
+    /** Extended Key Usage extension */
+    extendedKeyUsage?: string[];
+    /** Certificate extensions */
+    extensions: X509Extension[];
+    /** Authority Information Access URLs */
+    authorityInfoAccess?: {
+        ocsp?: string[];
+        caIssuers?: string[];
+    };
+    /** CRL Distribution Points */
+    crlDistributionPoints?: string[];
+    /** SHA-256 fingerprint of the certificate */
+    fingerprint: string;
+    /** SHA-256 fingerprint of the public key */
+    publicKeyFingerprint: string;
+    /** Original certificate in PEM format */
+    pem: string;
+    /** Original certificate in DER format (base64) */
+    der: string;
+}
+export declare const parsedCertificateSchema: z.ZodObject<{
+    version: z.ZodNumber;
+    serialNumber: z.ZodString;
+    signatureAlgorithm: z.ZodString;
+    issuer: z.ZodObject<{
+        CN: z.ZodOptional<z.ZodString>;
+        O: z.ZodOptional<z.ZodString>;
+        OU: z.ZodOptional<z.ZodString>;
+        C: z.ZodOptional<z.ZodString>;
+        ST: z.ZodOptional<z.ZodString>;
+        L: z.ZodOptional<z.ZodString>;
+        E: z.ZodOptional<z.ZodString>;
+        serialNumber: z.ZodOptional<z.ZodString>;
+        full: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    }, {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    }>;
+    subject: z.ZodObject<{
+        CN: z.ZodOptional<z.ZodString>;
+        O: z.ZodOptional<z.ZodString>;
+        OU: z.ZodOptional<z.ZodString>;
+        C: z.ZodOptional<z.ZodString>;
+        ST: z.ZodOptional<z.ZodString>;
+        L: z.ZodOptional<z.ZodString>;
+        E: z.ZodOptional<z.ZodString>;
+        serialNumber: z.ZodOptional<z.ZodString>;
+        full: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    }, {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    }>;
+    notBefore: z.ZodDate;
+    notAfter: z.ZodDate;
+    publicKeyAlgorithm: z.ZodString;
+    publicKey: z.ZodString;
+    subjectAltNames: z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["email", "dns", "uri", "ip", "upn", "other"]>;
+        value: z.ZodString;
+        oid: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        value?: string;
+        type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+        oid?: string;
+    }, {
+        value?: string;
+        type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+        oid?: string;
+    }>, "many">;
+    keyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    extendedKeyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    extensions: z.ZodArray<z.ZodObject<{
+        oid: z.ZodString;
+        critical: z.ZodBoolean;
+        value: z.ZodString;
+        parsed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: string;
+        critical?: boolean;
+        parsed?: Record<string, unknown>;
+        oid?: string;
+    }, {
+        value?: string;
+        critical?: boolean;
+        parsed?: Record<string, unknown>;
+        oid?: string;
+    }>, "many">;
+    authorityInfoAccess: z.ZodOptional<z.ZodObject<{
+        ocsp: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        caIssuers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        ocsp?: string[];
+        caIssuers?: string[];
+    }, {
+        ocsp?: string[];
+        caIssuers?: string[];
+    }>>;
+    crlDistributionPoints: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    fingerprint: z.ZodString;
+    publicKeyFingerprint: z.ZodString;
+    pem: z.ZodString;
+    der: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    version?: number;
+    issuer?: {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    };
+    publicKey?: string;
+    signatureAlgorithm?: string;
+    fingerprint?: string;
+    extensions?: {
+        value?: string;
+        critical?: boolean;
+        parsed?: Record<string, unknown>;
+        oid?: string;
+    }[];
+    subject?: {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    };
+    serialNumber?: string;
+    notBefore?: Date;
+    notAfter?: Date;
+    publicKeyAlgorithm?: string;
+    subjectAltNames?: {
+        value?: string;
+        type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+        oid?: string;
+    }[];
+    keyUsage?: string[];
+    extendedKeyUsage?: string[];
+    authorityInfoAccess?: {
+        ocsp?: string[];
+        caIssuers?: string[];
+    };
+    crlDistributionPoints?: string[];
+    publicKeyFingerprint?: string;
+    pem?: string;
+    der?: string;
+}, {
+    version?: number;
+    issuer?: {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    };
+    publicKey?: string;
+    signatureAlgorithm?: string;
+    fingerprint?: string;
+    extensions?: {
+        value?: string;
+        critical?: boolean;
+        parsed?: Record<string, unknown>;
+        oid?: string;
+    }[];
+    subject?: {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    };
+    serialNumber?: string;
+    notBefore?: Date;
+    notAfter?: Date;
+    publicKeyAlgorithm?: string;
+    subjectAltNames?: {
+        value?: string;
+        type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+        oid?: string;
+    }[];
+    keyUsage?: string[];
+    extendedKeyUsage?: string[];
+    authorityInfoAccess?: {
+        ocsp?: string[];
+        caIssuers?: string[];
+    };
+    crlDistributionPoints?: string[];
+    publicKeyFingerprint?: string;
+    pem?: string;
+    der?: string;
+}>;
+/**
+ * Certificate chain
+ */
+export interface CertificateChain {
+    /** End-entity certificate */
+    endEntity: ParsedCertificate;
+    /** Intermediate certificates */
+    intermediates: ParsedCertificate[];
+    /** Root certificate (if included) */
+    root?: ParsedCertificate;
+}
+export declare const certificateChainSchema: z.ZodObject<{
+    endEntity: z.ZodObject<{
+        version: z.ZodNumber;
+        serialNumber: z.ZodString;
+        signatureAlgorithm: z.ZodString;
+        issuer: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        subject: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        notBefore: z.ZodDate;
+        notAfter: z.ZodDate;
+        publicKeyAlgorithm: z.ZodString;
+        publicKey: z.ZodString;
+        subjectAltNames: z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<["email", "dns", "uri", "ip", "upn", "other"]>;
+            value: z.ZodString;
+            oid: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }, {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }>, "many">;
+        keyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        extendedKeyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        extensions: z.ZodArray<z.ZodObject<{
+            oid: z.ZodString;
+            critical: z.ZodBoolean;
+            value: z.ZodString;
+            parsed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }, {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }>, "many">;
+        authorityInfoAccess: z.ZodOptional<z.ZodObject<{
+            ocsp: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            caIssuers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            ocsp?: string[];
+            caIssuers?: string[];
+        }, {
+            ocsp?: string[];
+            caIssuers?: string[];
+        }>>;
+        crlDistributionPoints: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        fingerprint: z.ZodString;
+        publicKeyFingerprint: z.ZodString;
+        pem: z.ZodString;
+        der: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }, {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }>;
+    intermediates: z.ZodArray<z.ZodObject<{
+        version: z.ZodNumber;
+        serialNumber: z.ZodString;
+        signatureAlgorithm: z.ZodString;
+        issuer: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        subject: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        notBefore: z.ZodDate;
+        notAfter: z.ZodDate;
+        publicKeyAlgorithm: z.ZodString;
+        publicKey: z.ZodString;
+        subjectAltNames: z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<["email", "dns", "uri", "ip", "upn", "other"]>;
+            value: z.ZodString;
+            oid: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }, {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }>, "many">;
+        keyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        extendedKeyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        extensions: z.ZodArray<z.ZodObject<{
+            oid: z.ZodString;
+            critical: z.ZodBoolean;
+            value: z.ZodString;
+            parsed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }, {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }>, "many">;
+        authorityInfoAccess: z.ZodOptional<z.ZodObject<{
+            ocsp: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            caIssuers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            ocsp?: string[];
+            caIssuers?: string[];
+        }, {
+            ocsp?: string[];
+            caIssuers?: string[];
+        }>>;
+        crlDistributionPoints: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        fingerprint: z.ZodString;
+        publicKeyFingerprint: z.ZodString;
+        pem: z.ZodString;
+        der: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }, {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }>, "many">;
+    root: z.ZodOptional<z.ZodObject<{
+        version: z.ZodNumber;
+        serialNumber: z.ZodString;
+        signatureAlgorithm: z.ZodString;
+        issuer: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        subject: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        notBefore: z.ZodDate;
+        notAfter: z.ZodDate;
+        publicKeyAlgorithm: z.ZodString;
+        publicKey: z.ZodString;
+        subjectAltNames: z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<["email", "dns", "uri", "ip", "upn", "other"]>;
+            value: z.ZodString;
+            oid: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }, {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }>, "many">;
+        keyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        extendedKeyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        extensions: z.ZodArray<z.ZodObject<{
+            oid: z.ZodString;
+            critical: z.ZodBoolean;
+            value: z.ZodString;
+            parsed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }, {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }>, "many">;
+        authorityInfoAccess: z.ZodOptional<z.ZodObject<{
+            ocsp: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            caIssuers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            ocsp?: string[];
+            caIssuers?: string[];
+        }, {
+            ocsp?: string[];
+            caIssuers?: string[];
+        }>>;
+        crlDistributionPoints: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        fingerprint: z.ZodString;
+        publicKeyFingerprint: z.ZodString;
+        pem: z.ZodString;
+        der: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }, {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    root?: {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    };
+    endEntity?: {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    };
+    intermediates?: {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }[];
+}, {
+    root?: {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    };
+    endEntity?: {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    };
+    intermediates?: {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }[];
+}>;
+/**
+ * OCSP response data
+ */
+export interface OCSPResponse {
+    /** Response status */
+    status: 'good' | 'revoked' | 'unknown';
+    /** Revocation time if revoked */
+    revocationTime?: Date;
+    /** Revocation reason if revoked */
+    revocationReason?: string;
+    /** Response production time */
+    producedAt: Date;
+    /** This update time */
+    thisUpdate: Date;
+    /** Next update time */
+    nextUpdate?: Date;
+    /** Responder ID */
+    responderId: string;
+    /** Whether response was cached */
+    fromCache: boolean;
+    /** OCSP responder URL used */
+    responderUrl: string;
+}
+export declare const ocspResponseSchema: z.ZodObject<{
+    status: z.ZodEnum<["good", "revoked", "unknown"]>;
+    revocationTime: z.ZodOptional<z.ZodDate>;
+    revocationReason: z.ZodOptional<z.ZodString>;
+    producedAt: z.ZodDate;
+    thisUpdate: z.ZodDate;
+    nextUpdate: z.ZodOptional<z.ZodDate>;
+    responderId: z.ZodString;
+    fromCache: z.ZodBoolean;
+    responderUrl: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    status?: "unknown" | "revoked" | "good";
+    fromCache?: boolean;
+    revocationReason?: string;
+    revocationTime?: Date;
+    producedAt?: Date;
+    thisUpdate?: Date;
+    nextUpdate?: Date;
+    responderId?: string;
+    responderUrl?: string;
+}, {
+    status?: "unknown" | "revoked" | "good";
+    fromCache?: boolean;
+    revocationReason?: string;
+    revocationTime?: Date;
+    producedAt?: Date;
+    thisUpdate?: Date;
+    nextUpdate?: Date;
+    responderId?: string;
+    responderUrl?: string;
+}>;
+/**
+ * CRL entry for a revoked certificate
+ */
+export interface CRLEntry {
+    /** Serial number of revoked certificate */
+    serialNumber: string;
+    /** Revocation date */
+    revocationDate: Date;
+    /** Revocation reason code */
+    reasonCode?: number;
+    /** Reason description */
+    reason?: string;
+}
+export declare const crlEntrySchema: z.ZodObject<{
+    serialNumber: z.ZodString;
+    revocationDate: z.ZodDate;
+    reasonCode: z.ZodOptional<z.ZodNumber>;
+    reason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    reason?: string;
+    serialNumber?: string;
+    revocationDate?: Date;
+    reasonCode?: number;
+}, {
+    reason?: string;
+    serialNumber?: string;
+    revocationDate?: Date;
+    reasonCode?: number;
+}>;
+/**
+ * CRL data
+ */
+export interface CRLData {
+    /** CRL issuer */
+    issuer: DistinguishedName;
+    /** This update time */
+    thisUpdate: Date;
+    /** Next update time */
+    nextUpdate?: Date;
+    /** Revoked certificates */
+    revokedCertificates: CRLEntry[];
+    /** CRL number */
+    crlNumber?: string;
+    /** Whether CRL is delta */
+    isDelta: boolean;
+    /** CRL distribution point URL */
+    distributionPoint: string;
+    /** Whether CRL was cached */
+    fromCache: boolean;
+}
+export declare const crlDataSchema: z.ZodObject<{
+    issuer: z.ZodObject<{
+        CN: z.ZodOptional<z.ZodString>;
+        O: z.ZodOptional<z.ZodString>;
+        OU: z.ZodOptional<z.ZodString>;
+        C: z.ZodOptional<z.ZodString>;
+        ST: z.ZodOptional<z.ZodString>;
+        L: z.ZodOptional<z.ZodString>;
+        E: z.ZodOptional<z.ZodString>;
+        serialNumber: z.ZodOptional<z.ZodString>;
+        full: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    }, {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    }>;
+    thisUpdate: z.ZodDate;
+    nextUpdate: z.ZodOptional<z.ZodDate>;
+    revokedCertificates: z.ZodArray<z.ZodObject<{
+        serialNumber: z.ZodString;
+        revocationDate: z.ZodDate;
+        reasonCode: z.ZodOptional<z.ZodNumber>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        reason?: string;
+        serialNumber?: string;
+        revocationDate?: Date;
+        reasonCode?: number;
+    }, {
+        reason?: string;
+        serialNumber?: string;
+        revocationDate?: Date;
+        reasonCode?: number;
+    }>, "many">;
+    crlNumber: z.ZodOptional<z.ZodString>;
+    isDelta: z.ZodBoolean;
+    distributionPoint: z.ZodString;
+    fromCache: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    issuer?: {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    };
+    fromCache?: boolean;
+    thisUpdate?: Date;
+    nextUpdate?: Date;
+    revokedCertificates?: {
+        reason?: string;
+        serialNumber?: string;
+        revocationDate?: Date;
+        reasonCode?: number;
+    }[];
+    crlNumber?: string;
+    isDelta?: boolean;
+    distributionPoint?: string;
+}, {
+    issuer?: {
+        full?: string;
+        C?: string;
+        E?: string;
+        L?: string;
+        O?: string;
+        CN?: string;
+        OU?: string;
+        ST?: string;
+        serialNumber?: string;
+    };
+    fromCache?: boolean;
+    thisUpdate?: Date;
+    nextUpdate?: Date;
+    revokedCertificates?: {
+        reason?: string;
+        serialNumber?: string;
+        revocationDate?: Date;
+        reasonCode?: number;
+    }[];
+    crlNumber?: string;
+    isDelta?: boolean;
+    distributionPoint?: string;
+}>;
+/**
+ * Certificate validation result
+ */
+export interface CertificateValidationResult {
+    /** Overall validation status */
+    status: CertificateValidationStatus;
+    /** Whether certificate is valid for authentication */
+    isValid: boolean;
+    /** Validation errors */
+    errors: string[];
+    /** Validation warnings */
+    warnings: string[];
+    /** Chain validation details */
+    chainValidation?: {
+        valid: boolean;
+        depth: number;
+        errors: string[];
+    };
+    /** OCSP validation result */
+    ocspResult?: OCSPResponse;
+    /** CRL validation result */
+    crlResult?: CRLData;
+    /** Timestamp of validation */
+    validatedAt: Date;
+    /** Certificate expiration date */
+    expiresAt: Date;
+    /** Trust anchor used */
+    trustAnchor?: string;
+}
+export declare const certificateValidationResultSchema: z.ZodObject<{
+    status: z.ZodNativeEnum<typeof CertificateValidationStatus>;
+    isValid: z.ZodBoolean;
+    errors: z.ZodArray<z.ZodString, "many">;
+    warnings: z.ZodArray<z.ZodString, "many">;
+    chainValidation: z.ZodOptional<z.ZodObject<{
+        valid: z.ZodBoolean;
+        depth: z.ZodNumber;
+        errors: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        valid?: boolean;
+        errors?: string[];
+        depth?: number;
+    }, {
+        valid?: boolean;
+        errors?: string[];
+        depth?: number;
+    }>>;
+    ocspResult: z.ZodOptional<z.ZodObject<{
+        status: z.ZodEnum<["good", "revoked", "unknown"]>;
+        revocationTime: z.ZodOptional<z.ZodDate>;
+        revocationReason: z.ZodOptional<z.ZodString>;
+        producedAt: z.ZodDate;
+        thisUpdate: z.ZodDate;
+        nextUpdate: z.ZodOptional<z.ZodDate>;
+        responderId: z.ZodString;
+        fromCache: z.ZodBoolean;
+        responderUrl: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        status?: "unknown" | "revoked" | "good";
+        fromCache?: boolean;
+        revocationReason?: string;
+        revocationTime?: Date;
+        producedAt?: Date;
+        thisUpdate?: Date;
+        nextUpdate?: Date;
+        responderId?: string;
+        responderUrl?: string;
+    }, {
+        status?: "unknown" | "revoked" | "good";
+        fromCache?: boolean;
+        revocationReason?: string;
+        revocationTime?: Date;
+        producedAt?: Date;
+        thisUpdate?: Date;
+        nextUpdate?: Date;
+        responderId?: string;
+        responderUrl?: string;
+    }>>;
+    crlResult: z.ZodOptional<z.ZodObject<{
+        issuer: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        thisUpdate: z.ZodDate;
+        nextUpdate: z.ZodOptional<z.ZodDate>;
+        revokedCertificates: z.ZodArray<z.ZodObject<{
+            serialNumber: z.ZodString;
+            revocationDate: z.ZodDate;
+            reasonCode: z.ZodOptional<z.ZodNumber>;
+            reason: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            reason?: string;
+            serialNumber?: string;
+            revocationDate?: Date;
+            reasonCode?: number;
+        }, {
+            reason?: string;
+            serialNumber?: string;
+            revocationDate?: Date;
+            reasonCode?: number;
+        }>, "many">;
+        crlNumber: z.ZodOptional<z.ZodString>;
+        isDelta: z.ZodBoolean;
+        distributionPoint: z.ZodString;
+        fromCache: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        fromCache?: boolean;
+        thisUpdate?: Date;
+        nextUpdate?: Date;
+        revokedCertificates?: {
+            reason?: string;
+            serialNumber?: string;
+            revocationDate?: Date;
+            reasonCode?: number;
+        }[];
+        crlNumber?: string;
+        isDelta?: boolean;
+        distributionPoint?: string;
+    }, {
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        fromCache?: boolean;
+        thisUpdate?: Date;
+        nextUpdate?: Date;
+        revokedCertificates?: {
+            reason?: string;
+            serialNumber?: string;
+            revocationDate?: Date;
+            reasonCode?: number;
+        }[];
+        crlNumber?: string;
+        isDelta?: boolean;
+        distributionPoint?: string;
+    }>>;
+    validatedAt: z.ZodDate;
+    expiresAt: z.ZodDate;
+    trustAnchor: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    status?: CertificateValidationStatus;
+    errors?: string[];
+    warnings?: string[];
+    expiresAt?: Date;
+    validatedAt?: Date;
+    isValid?: boolean;
+    chainValidation?: {
+        valid?: boolean;
+        errors?: string[];
+        depth?: number;
+    };
+    ocspResult?: {
+        status?: "unknown" | "revoked" | "good";
+        fromCache?: boolean;
+        revocationReason?: string;
+        revocationTime?: Date;
+        producedAt?: Date;
+        thisUpdate?: Date;
+        nextUpdate?: Date;
+        responderId?: string;
+        responderUrl?: string;
+    };
+    crlResult?: {
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        fromCache?: boolean;
+        thisUpdate?: Date;
+        nextUpdate?: Date;
+        revokedCertificates?: {
+            reason?: string;
+            serialNumber?: string;
+            revocationDate?: Date;
+            reasonCode?: number;
+        }[];
+        crlNumber?: string;
+        isDelta?: boolean;
+        distributionPoint?: string;
+    };
+    trustAnchor?: string;
+}, {
+    status?: CertificateValidationStatus;
+    errors?: string[];
+    warnings?: string[];
+    expiresAt?: Date;
+    validatedAt?: Date;
+    isValid?: boolean;
+    chainValidation?: {
+        valid?: boolean;
+        errors?: string[];
+        depth?: number;
+    };
+    ocspResult?: {
+        status?: "unknown" | "revoked" | "good";
+        fromCache?: boolean;
+        revocationReason?: string;
+        revocationTime?: Date;
+        producedAt?: Date;
+        thisUpdate?: Date;
+        nextUpdate?: Date;
+        responderId?: string;
+        responderUrl?: string;
+    };
+    crlResult?: {
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        fromCache?: boolean;
+        thisUpdate?: Date;
+        nextUpdate?: Date;
+        revokedCertificates?: {
+            reason?: string;
+            serialNumber?: string;
+            revocationDate?: Date;
+            reasonCode?: number;
+        }[];
+        crlNumber?: string;
+        isDelta?: boolean;
+        distributionPoint?: string;
+    };
+    trustAnchor?: string;
+}>;
+/**
+ * Mapped user identity from certificate
+ */
+export interface MappedUserIdentity {
+    /** User ID in the system */
+    userId: string;
+    /** Username or login */
+    username?: string;
+    /** Email address */
+    email?: string;
+    /** User Principal Name */
+    upn?: string;
+    /** EDIPI (DoD ID number) */
+    edipi?: string;
+    /** Tenant ID for multi-tenant systems */
+    tenantId?: string;
+    /** Additional attributes */
+    attributes: Record<string, string>;
+    /** Mapping strategy used */
+    mappingStrategy: CertificateMappingStrategy;
+    /** Certificate fingerprint */
+    certificateFingerprint: string;
+}
+export declare const mappedUserIdentitySchema: z.ZodObject<{
+    userId: z.ZodString;
+    username: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    upn: z.ZodOptional<z.ZodString>;
+    edipi: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+    attributes: z.ZodRecord<z.ZodString, z.ZodString>;
+    mappingStrategy: z.ZodNativeEnum<typeof CertificateMappingStrategy>;
+    certificateFingerprint: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email?: string;
+    tenantId?: string;
+    userId?: string;
+    attributes?: Record<string, string>;
+    username?: string;
+    upn?: string;
+    edipi?: string;
+    mappingStrategy?: CertificateMappingStrategy;
+    certificateFingerprint?: string;
+}, {
+    email?: string;
+    tenantId?: string;
+    userId?: string;
+    attributes?: Record<string, string>;
+    username?: string;
+    upn?: string;
+    edipi?: string;
+    mappingStrategy?: CertificateMappingStrategy;
+    certificateFingerprint?: string;
+}>;
+/**
+ * Certificate mapping rule
+ */
+export interface CertificateMappingRule {
+    /** Rule name */
+    name: string;
+    /** Rule priority (lower = higher priority) */
+    priority: number;
+    /** Issuer DN pattern (regex) */
+    issuerPattern?: string;
+    /** Subject DN pattern (regex) */
+    subjectPattern?: string;
+    /** Required OID in certificate policies */
+    requiredPolicyOid?: string;
+    /** Mapping strategy to use */
+    strategy: CertificateMappingStrategy;
+    /** Attribute to extract user ID from */
+    userIdAttribute?: string;
+    /** Tenant ID to assign */
+    tenantId?: string;
+    /** Custom attribute mappings */
+    attributeMappings?: Record<string, string>;
+}
+export declare const certificateMappingRuleSchema: z.ZodObject<{
+    name: z.ZodString;
+    priority: z.ZodNumber;
+    issuerPattern: z.ZodOptional<z.ZodString>;
+    subjectPattern: z.ZodOptional<z.ZodString>;
+    requiredPolicyOid: z.ZodOptional<z.ZodString>;
+    strategy: z.ZodNativeEnum<typeof CertificateMappingStrategy>;
+    userIdAttribute: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+    attributeMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    name?: string;
+    priority?: number;
+    tenantId?: string;
+    issuerPattern?: string;
+    subjectPattern?: string;
+    requiredPolicyOid?: string;
+    strategy?: CertificateMappingStrategy;
+    userIdAttribute?: string;
+    attributeMappings?: Record<string, string>;
+}, {
+    name?: string;
+    priority?: number;
+    tenantId?: string;
+    issuerPattern?: string;
+    subjectPattern?: string;
+    requiredPolicyOid?: string;
+    strategy?: CertificateMappingStrategy;
+    userIdAttribute?: string;
+    attributeMappings?: Record<string, string>;
+}>;
+/**
+ * Card event data
+ */
+export interface CardEvent {
+    /** Event type */
+    type: CardEventType;
+    /** Reader name */
+    readerName: string;
+    /** Timestamp */
+    timestamp: Date;
+    /** Card ATR (Answer To Reset) if available */
+    atr?: string;
+    /** Session ID associated with card */
+    sessionId?: string;
+    /** User ID associated with card */
+    userId?: string;
+}
+export declare const cardEventSchema: z.ZodObject<{
+    type: z.ZodNativeEnum<typeof CardEventType>;
+    readerName: z.ZodString;
+    timestamp: z.ZodDate;
+    atr: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type?: CardEventType;
+    userId?: string;
+    sessionId?: string;
+    timestamp?: Date;
+    readerName?: string;
+    atr?: string;
+}, {
+    type?: CardEventType;
+    userId?: string;
+    sessionId?: string;
+    timestamp?: Date;
+    readerName?: string;
+    atr?: string;
+}>;
+/**
+ * Card session binding
+ */
+export interface CardSessionBinding {
+    /** Session ID */
+    sessionId: string;
+    /** User ID */
+    userId: string;
+    /** Certificate fingerprint */
+    certificateFingerprint: string;
+    /** Reader name */
+    readerName: string;
+    /** Card ATR */
+    atr: string;
+    /** Session creation time */
+    createdAt: Date;
+    /** Last activity time */
+    lastActivity: Date;
+    /** Session expiration time */
+    expiresAt: Date;
+}
+export declare const cardSessionBindingSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    userId: z.ZodString;
+    certificateFingerprint: z.ZodString;
+    readerName: z.ZodString;
+    atr: z.ZodString;
+    createdAt: z.ZodDate;
+    lastActivity: z.ZodDate;
+    expiresAt: z.ZodDate;
+}, "strip", z.ZodTypeAny, {
+    userId?: string;
+    sessionId?: string;
+    createdAt?: Date;
+    expiresAt?: Date;
+    certificateFingerprint?: string;
+    readerName?: string;
+    atr?: string;
+    lastActivity?: Date;
+}, {
+    userId?: string;
+    sessionId?: string;
+    createdAt?: Date;
+    expiresAt?: Date;
+    certificateFingerprint?: string;
+    readerName?: string;
+    atr?: string;
+    lastActivity?: Date;
+}>;
+/**
+ * Trusted CA configuration
+ */
+export interface TrustedCAConfig {
+    /** CA name/identifier */
+    name: string;
+    /** CA certificate in PEM format */
+    certificate: string;
+    /** Whether this is a root CA */
+    isRoot: boolean;
+    /** Policy OIDs this CA is trusted for */
+    trustedPolicies?: string[];
+    /** Maximum chain depth */
+    maxPathLength?: number;
+}
+export declare const trustedCAConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    certificate: z.ZodString;
+    isRoot: z.ZodBoolean;
+    trustedPolicies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    maxPathLength: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    name?: string;
+    certificate?: string;
+    isRoot?: boolean;
+    trustedPolicies?: string[];
+    maxPathLength?: number;
+}, {
+    name?: string;
+    certificate?: string;
+    isRoot?: boolean;
+    trustedPolicies?: string[];
+    maxPathLength?: number;
+}>;
+/**
+ * OCSP configuration
+ */
+export interface OCSPConfig {
+    /** Enable OCSP checking */
+    enabled: boolean;
+    /** OCSP responder URL override (uses AIA if not set) */
+    responderUrl?: string;
+    /** Request timeout in milliseconds */
+    timeout: number;
+    /** Cache TTL in milliseconds */
+    cacheTtl: number;
+    /** Sign OCSP requests */
+    signRequests: boolean;
+    /** Signing certificate for OCSP requests */
+    signingCertificate?: string;
+    /** Signing key for OCSP requests */
+    signingKey?: string;
+    /** Allow OCSP soft failures (treat network errors as success) */
+    softFail: boolean;
+    /** Nonce in requests */
+    useNonce: boolean;
+}
+export declare const ocspConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    responderUrl: z.ZodOptional<z.ZodString>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    cacheTtl: z.ZodDefault<z.ZodNumber>;
+    signRequests: z.ZodDefault<z.ZodBoolean>;
+    signingCertificate: z.ZodOptional<z.ZodString>;
+    signingKey: z.ZodOptional<z.ZodString>;
+    softFail: z.ZodDefault<z.ZodBoolean>;
+    useNonce: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    timeout?: number;
+    enabled?: boolean;
+    cacheTtl?: number;
+    useNonce?: boolean;
+    responderUrl?: string;
+    signRequests?: boolean;
+    signingCertificate?: string;
+    signingKey?: string;
+    softFail?: boolean;
+}, {
+    timeout?: number;
+    enabled?: boolean;
+    cacheTtl?: number;
+    useNonce?: boolean;
+    responderUrl?: string;
+    signRequests?: boolean;
+    signingCertificate?: string;
+    signingKey?: string;
+    softFail?: boolean;
+}>;
+/**
+ * CRL configuration
+ */
+export interface CRLConfig {
+    /** Enable CRL checking */
+    enabled: boolean;
+    /** CRL distribution point URL override */
+    distributionPointUrl?: string;
+    /** Download timeout in milliseconds */
+    timeout: number;
+    /** Cache TTL in milliseconds (uses nextUpdate if not set) */
+    cacheTtl?: number;
+    /** Refresh CRL before expiration (milliseconds) */
+    refreshBefore: number;
+    /** Maximum CRL size in bytes */
+    maxSize: number;
+    /** Allow CRL soft failures */
+    softFail: boolean;
+    /** Check delta CRLs */
+    checkDelta: boolean;
+}
+export declare const crlConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    distributionPointUrl: z.ZodOptional<z.ZodString>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    cacheTtl: z.ZodOptional<z.ZodNumber>;
+    refreshBefore: z.ZodDefault<z.ZodNumber>;
+    maxSize: z.ZodDefault<z.ZodNumber>;
+    softFail: z.ZodDefault<z.ZodBoolean>;
+    checkDelta: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    timeout?: number;
+    enabled?: boolean;
+    cacheTtl?: number;
+    maxSize?: number;
+    softFail?: boolean;
+    distributionPointUrl?: string;
+    refreshBefore?: number;
+    checkDelta?: boolean;
+}, {
+    timeout?: number;
+    enabled?: boolean;
+    cacheTtl?: number;
+    maxSize?: number;
+    softFail?: boolean;
+    distributionPointUrl?: string;
+    refreshBefore?: number;
+    checkDelta?: boolean;
+}>;
+/**
+ * PKCS#11 configuration
+ */
+export interface PKCS11Config {
+    /** Path to PKCS#11 library */
+    libraryPath: string;
+    /** Slot ID (uses first available if not set) */
+    slotId?: number;
+    /** Token label */
+    tokenLabel?: string;
+    /** PIN for token access */
+    pin?: string;
+    /** Initialize token on startup */
+    initializeToken: boolean;
+    /** Reader polling interval in milliseconds */
+    pollingInterval: number;
+}
+export declare const pkcs11ConfigSchema: z.ZodObject<{
+    libraryPath: z.ZodString;
+    slotId: z.ZodOptional<z.ZodNumber>;
+    tokenLabel: z.ZodOptional<z.ZodString>;
+    pin: z.ZodOptional<z.ZodString>;
+    initializeToken: z.ZodDefault<z.ZodBoolean>;
+    pollingInterval: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    pin?: string;
+    libraryPath?: string;
+    slotId?: number;
+    tokenLabel?: string;
+    initializeToken?: boolean;
+    pollingInterval?: number;
+}, {
+    pin?: string;
+    libraryPath?: string;
+    slotId?: number;
+    tokenLabel?: string;
+    initializeToken?: boolean;
+    pollingInterval?: number;
+}>;
+/**
+ * Card removal policy
+ */
+export interface CardRemovalPolicy {
+    /** Terminate session on card removal */
+    terminateSession: boolean;
+    /** Grace period before termination (milliseconds) */
+    gracePeriod: number;
+    /** Allow session continuation with re-authentication */
+    allowReauthentication: boolean;
+    /** Re-authentication timeout (milliseconds) */
+    reauthenticationTimeout: number;
+    /** Notification webhook URL */
+    notificationWebhook?: string;
+}
+export declare const cardRemovalPolicySchema: z.ZodObject<{
+    terminateSession: z.ZodDefault<z.ZodBoolean>;
+    gracePeriod: z.ZodDefault<z.ZodNumber>;
+    allowReauthentication: z.ZodDefault<z.ZodBoolean>;
+    reauthenticationTimeout: z.ZodDefault<z.ZodNumber>;
+    notificationWebhook: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    terminateSession?: boolean;
+    gracePeriod?: number;
+    allowReauthentication?: boolean;
+    reauthenticationTimeout?: number;
+    notificationWebhook?: string;
+}, {
+    terminateSession?: boolean;
+    gracePeriod?: number;
+    allowReauthentication?: boolean;
+    reauthenticationTimeout?: number;
+    notificationWebhook?: string;
+}>;
+/**
+ * PIV/CAC authentication configuration
+ */
+export interface PIVCACConfig {
+    /** Enable PIV/CAC authentication */
+    enabled: boolean;
+    /** Trusted CA certificates */
+    trustedCAs: TrustedCAConfig[];
+    /** Revocation check method */
+    revocationMethod: RevocationCheckMethod;
+    /** OCSP configuration */
+    ocsp: OCSPConfig;
+    /** CRL configuration */
+    crl: CRLConfig;
+    /** PKCS#11 configuration */
+    pkcs11?: PKCS11Config;
+    /** Card removal policy */
+    cardRemovalPolicy: CardRemovalPolicy;
+    /** Certificate mapping rules */
+    mappingRules: CertificateMappingRule[];
+    /** Required key usage for authentication */
+    requiredKeyUsage: PIVKeyUsage[];
+    /** Required extended key usage OIDs */
+    requiredExtendedKeyUsage?: string[];
+    /** Required certificate policies OIDs */
+    requiredPolicies?: string[];
+    /** Allow expired certificates (not recommended) */
+    allowExpired: boolean;
+    /** Maximum certificate chain depth */
+    maxChainDepth: number;
+    /** Session TTL in milliseconds */
+    sessionTtl: number;
+    /** Enable DoD PKI compatibility mode */
+    dodPkiCompatibility: boolean;
+    /** Enable FIPS 201 compliance mode */
+    fips201Compliance: boolean;
+    /** Cache certificate validation results */
+    cacheValidation: boolean;
+    /** Validation cache TTL in milliseconds */
+    validationCacheTtl: number;
+}
+export declare const pivCacConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    trustedCAs: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        certificate: z.ZodString;
+        isRoot: z.ZodBoolean;
+        trustedPolicies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        maxPathLength: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string;
+        certificate?: string;
+        isRoot?: boolean;
+        trustedPolicies?: string[];
+        maxPathLength?: number;
+    }, {
+        name?: string;
+        certificate?: string;
+        isRoot?: boolean;
+        trustedPolicies?: string[];
+        maxPathLength?: number;
+    }>, "many">>;
+    revocationMethod: z.ZodDefault<z.ZodNativeEnum<typeof RevocationCheckMethod>>;
+    ocsp: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        responderUrl: z.ZodOptional<z.ZodString>;
+        timeout: z.ZodDefault<z.ZodNumber>;
+        cacheTtl: z.ZodDefault<z.ZodNumber>;
+        signRequests: z.ZodDefault<z.ZodBoolean>;
+        signingCertificate: z.ZodOptional<z.ZodString>;
+        signingKey: z.ZodOptional<z.ZodString>;
+        softFail: z.ZodDefault<z.ZodBoolean>;
+        useNonce: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        timeout?: number;
+        enabled?: boolean;
+        cacheTtl?: number;
+        useNonce?: boolean;
+        responderUrl?: string;
+        signRequests?: boolean;
+        signingCertificate?: string;
+        signingKey?: string;
+        softFail?: boolean;
+    }, {
+        timeout?: number;
+        enabled?: boolean;
+        cacheTtl?: number;
+        useNonce?: boolean;
+        responderUrl?: string;
+        signRequests?: boolean;
+        signingCertificate?: string;
+        signingKey?: string;
+        softFail?: boolean;
+    }>>;
+    crl: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        distributionPointUrl: z.ZodOptional<z.ZodString>;
+        timeout: z.ZodDefault<z.ZodNumber>;
+        cacheTtl: z.ZodOptional<z.ZodNumber>;
+        refreshBefore: z.ZodDefault<z.ZodNumber>;
+        maxSize: z.ZodDefault<z.ZodNumber>;
+        softFail: z.ZodDefault<z.ZodBoolean>;
+        checkDelta: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        timeout?: number;
+        enabled?: boolean;
+        cacheTtl?: number;
+        maxSize?: number;
+        softFail?: boolean;
+        distributionPointUrl?: string;
+        refreshBefore?: number;
+        checkDelta?: boolean;
+    }, {
+        timeout?: number;
+        enabled?: boolean;
+        cacheTtl?: number;
+        maxSize?: number;
+        softFail?: boolean;
+        distributionPointUrl?: string;
+        refreshBefore?: number;
+        checkDelta?: boolean;
+    }>>;
+    pkcs11: z.ZodOptional<z.ZodObject<{
+        libraryPath: z.ZodString;
+        slotId: z.ZodOptional<z.ZodNumber>;
+        tokenLabel: z.ZodOptional<z.ZodString>;
+        pin: z.ZodOptional<z.ZodString>;
+        initializeToken: z.ZodDefault<z.ZodBoolean>;
+        pollingInterval: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        pin?: string;
+        libraryPath?: string;
+        slotId?: number;
+        tokenLabel?: string;
+        initializeToken?: boolean;
+        pollingInterval?: number;
+    }, {
+        pin?: string;
+        libraryPath?: string;
+        slotId?: number;
+        tokenLabel?: string;
+        initializeToken?: boolean;
+        pollingInterval?: number;
+    }>>;
+    cardRemovalPolicy: z.ZodDefault<z.ZodObject<{
+        terminateSession: z.ZodDefault<z.ZodBoolean>;
+        gracePeriod: z.ZodDefault<z.ZodNumber>;
+        allowReauthentication: z.ZodDefault<z.ZodBoolean>;
+        reauthenticationTimeout: z.ZodDefault<z.ZodNumber>;
+        notificationWebhook: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        terminateSession?: boolean;
+        gracePeriod?: number;
+        allowReauthentication?: boolean;
+        reauthenticationTimeout?: number;
+        notificationWebhook?: string;
+    }, {
+        terminateSession?: boolean;
+        gracePeriod?: number;
+        allowReauthentication?: boolean;
+        reauthenticationTimeout?: number;
+        notificationWebhook?: string;
+    }>>;
+    mappingRules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        priority: z.ZodNumber;
+        issuerPattern: z.ZodOptional<z.ZodString>;
+        subjectPattern: z.ZodOptional<z.ZodString>;
+        requiredPolicyOid: z.ZodOptional<z.ZodString>;
+        strategy: z.ZodNativeEnum<typeof CertificateMappingStrategy>;
+        userIdAttribute: z.ZodOptional<z.ZodString>;
+        tenantId: z.ZodOptional<z.ZodString>;
+        attributeMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string;
+        priority?: number;
+        tenantId?: string;
+        issuerPattern?: string;
+        subjectPattern?: string;
+        requiredPolicyOid?: string;
+        strategy?: CertificateMappingStrategy;
+        userIdAttribute?: string;
+        attributeMappings?: Record<string, string>;
+    }, {
+        name?: string;
+        priority?: number;
+        tenantId?: string;
+        issuerPattern?: string;
+        subjectPattern?: string;
+        requiredPolicyOid?: string;
+        strategy?: CertificateMappingStrategy;
+        userIdAttribute?: string;
+        attributeMappings?: Record<string, string>;
+    }>, "many">>;
+    requiredKeyUsage: z.ZodDefault<z.ZodArray<z.ZodNativeEnum<typeof PIVKeyUsage>, "many">>;
+    requiredExtendedKeyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    requiredPolicies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    allowExpired: z.ZodDefault<z.ZodBoolean>;
+    maxChainDepth: z.ZodDefault<z.ZodNumber>;
+    sessionTtl: z.ZodDefault<z.ZodNumber>;
+    dodPkiCompatibility: z.ZodDefault<z.ZodBoolean>;
+    fips201Compliance: z.ZodDefault<z.ZodBoolean>;
+    cacheValidation: z.ZodDefault<z.ZodBoolean>;
+    validationCacheTtl: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean;
+    pkcs11?: {
+        pin?: string;
+        libraryPath?: string;
+        slotId?: number;
+        tokenLabel?: string;
+        initializeToken?: boolean;
+        pollingInterval?: number;
+    };
+    maxChainDepth?: number;
+    ocsp?: {
+        timeout?: number;
+        enabled?: boolean;
+        cacheTtl?: number;
+        useNonce?: boolean;
+        responderUrl?: string;
+        signRequests?: boolean;
+        signingCertificate?: string;
+        signingKey?: string;
+        softFail?: boolean;
+    };
+    trustedCAs?: {
+        name?: string;
+        certificate?: string;
+        isRoot?: boolean;
+        trustedPolicies?: string[];
+        maxPathLength?: number;
+    }[];
+    revocationMethod?: RevocationCheckMethod;
+    crl?: {
+        timeout?: number;
+        enabled?: boolean;
+        cacheTtl?: number;
+        maxSize?: number;
+        softFail?: boolean;
+        distributionPointUrl?: string;
+        refreshBefore?: number;
+        checkDelta?: boolean;
+    };
+    cardRemovalPolicy?: {
+        terminateSession?: boolean;
+        gracePeriod?: number;
+        allowReauthentication?: boolean;
+        reauthenticationTimeout?: number;
+        notificationWebhook?: string;
+    };
+    mappingRules?: {
+        name?: string;
+        priority?: number;
+        tenantId?: string;
+        issuerPattern?: string;
+        subjectPattern?: string;
+        requiredPolicyOid?: string;
+        strategy?: CertificateMappingStrategy;
+        userIdAttribute?: string;
+        attributeMappings?: Record<string, string>;
+    }[];
+    requiredKeyUsage?: PIVKeyUsage[];
+    requiredExtendedKeyUsage?: string[];
+    requiredPolicies?: string[];
+    allowExpired?: boolean;
+    sessionTtl?: number;
+    dodPkiCompatibility?: boolean;
+    fips201Compliance?: boolean;
+    cacheValidation?: boolean;
+    validationCacheTtl?: number;
+}, {
+    enabled?: boolean;
+    pkcs11?: {
+        pin?: string;
+        libraryPath?: string;
+        slotId?: number;
+        tokenLabel?: string;
+        initializeToken?: boolean;
+        pollingInterval?: number;
+    };
+    maxChainDepth?: number;
+    ocsp?: {
+        timeout?: number;
+        enabled?: boolean;
+        cacheTtl?: number;
+        useNonce?: boolean;
+        responderUrl?: string;
+        signRequests?: boolean;
+        signingCertificate?: string;
+        signingKey?: string;
+        softFail?: boolean;
+    };
+    trustedCAs?: {
+        name?: string;
+        certificate?: string;
+        isRoot?: boolean;
+        trustedPolicies?: string[];
+        maxPathLength?: number;
+    }[];
+    revocationMethod?: RevocationCheckMethod;
+    crl?: {
+        timeout?: number;
+        enabled?: boolean;
+        cacheTtl?: number;
+        maxSize?: number;
+        softFail?: boolean;
+        distributionPointUrl?: string;
+        refreshBefore?: number;
+        checkDelta?: boolean;
+    };
+    cardRemovalPolicy?: {
+        terminateSession?: boolean;
+        gracePeriod?: number;
+        allowReauthentication?: boolean;
+        reauthenticationTimeout?: number;
+        notificationWebhook?: string;
+    };
+    mappingRules?: {
+        name?: string;
+        priority?: number;
+        tenantId?: string;
+        issuerPattern?: string;
+        subjectPattern?: string;
+        requiredPolicyOid?: string;
+        strategy?: CertificateMappingStrategy;
+        userIdAttribute?: string;
+        attributeMappings?: Record<string, string>;
+    }[];
+    requiredKeyUsage?: PIVKeyUsage[];
+    requiredExtendedKeyUsage?: string[];
+    requiredPolicies?: string[];
+    allowExpired?: boolean;
+    sessionTtl?: number;
+    dodPkiCompatibility?: boolean;
+    fips201Compliance?: boolean;
+    cacheValidation?: boolean;
+    validationCacheTtl?: number;
+}>;
+/**
+ * PIV authentication request
+ */
+export interface PIVAuthRequest {
+    /** Client certificate in PEM format */
+    clientCertificate: string;
+    /** Certificate chain in PEM format */
+    certificateChain?: string;
+    /** PIN (if required) */
+    pin?: string;
+    /** Challenge nonce */
+    challenge?: string;
+    /** Signed challenge */
+    signedChallenge?: string;
+}
+export declare const pivAuthRequestSchema: z.ZodObject<{
+    clientCertificate: z.ZodString;
+    certificateChain: z.ZodOptional<z.ZodString>;
+    pin: z.ZodOptional<z.ZodString>;
+    challenge: z.ZodOptional<z.ZodString>;
+    signedChallenge: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    pin?: string;
+    certificateChain?: string;
+    challenge?: string;
+    clientCertificate?: string;
+    signedChallenge?: string;
+}, {
+    pin?: string;
+    certificateChain?: string;
+    challenge?: string;
+    clientCertificate?: string;
+    signedChallenge?: string;
+}>;
+/**
+ * PIV authentication result
+ */
+export interface PIVAuthResult {
+    /** Authentication success */
+    success: boolean;
+    /** Error message if failed */
+    error?: string;
+    /** Error code if failed */
+    errorCode?: string;
+    /** Mapped user identity */
+    user?: MappedUserIdentity;
+    /** Session ID */
+    sessionId?: string;
+    /** Session expiration */
+    expiresAt?: Date;
+    /** Certificate validation result */
+    validation?: CertificateValidationResult;
+    /** JWT access token */
+    accessToken?: string;
+    /** Refresh token */
+    refreshToken?: string;
+}
+export declare const pivAuthResultSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    errorCode: z.ZodOptional<z.ZodString>;
+    user: z.ZodOptional<z.ZodObject<{
+        userId: z.ZodString;
+        username: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        upn: z.ZodOptional<z.ZodString>;
+        edipi: z.ZodOptional<z.ZodString>;
+        tenantId: z.ZodOptional<z.ZodString>;
+        attributes: z.ZodRecord<z.ZodString, z.ZodString>;
+        mappingStrategy: z.ZodNativeEnum<typeof CertificateMappingStrategy>;
+        certificateFingerprint: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        email?: string;
+        tenantId?: string;
+        userId?: string;
+        attributes?: Record<string, string>;
+        username?: string;
+        upn?: string;
+        edipi?: string;
+        mappingStrategy?: CertificateMappingStrategy;
+        certificateFingerprint?: string;
+    }, {
+        email?: string;
+        tenantId?: string;
+        userId?: string;
+        attributes?: Record<string, string>;
+        username?: string;
+        upn?: string;
+        edipi?: string;
+        mappingStrategy?: CertificateMappingStrategy;
+        certificateFingerprint?: string;
+    }>>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodDate>;
+    validation: z.ZodOptional<z.ZodObject<{
+        status: z.ZodNativeEnum<typeof CertificateValidationStatus>;
+        isValid: z.ZodBoolean;
+        errors: z.ZodArray<z.ZodString, "many">;
+        warnings: z.ZodArray<z.ZodString, "many">;
+        chainValidation: z.ZodOptional<z.ZodObject<{
+            valid: z.ZodBoolean;
+            depth: z.ZodNumber;
+            errors: z.ZodArray<z.ZodString, "many">;
+        }, "strip", z.ZodTypeAny, {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        }, {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        }>>;
+        ocspResult: z.ZodOptional<z.ZodObject<{
+            status: z.ZodEnum<["good", "revoked", "unknown"]>;
+            revocationTime: z.ZodOptional<z.ZodDate>;
+            revocationReason: z.ZodOptional<z.ZodString>;
+            producedAt: z.ZodDate;
+            thisUpdate: z.ZodDate;
+            nextUpdate: z.ZodOptional<z.ZodDate>;
+            responderId: z.ZodString;
+            fromCache: z.ZodBoolean;
+            responderUrl: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        }, {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        }>>;
+        crlResult: z.ZodOptional<z.ZodObject<{
+            issuer: z.ZodObject<{
+                CN: z.ZodOptional<z.ZodString>;
+                O: z.ZodOptional<z.ZodString>;
+                OU: z.ZodOptional<z.ZodString>;
+                C: z.ZodOptional<z.ZodString>;
+                ST: z.ZodOptional<z.ZodString>;
+                L: z.ZodOptional<z.ZodString>;
+                E: z.ZodOptional<z.ZodString>;
+                serialNumber: z.ZodOptional<z.ZodString>;
+                full: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            }, {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            }>;
+            thisUpdate: z.ZodDate;
+            nextUpdate: z.ZodOptional<z.ZodDate>;
+            revokedCertificates: z.ZodArray<z.ZodObject<{
+                serialNumber: z.ZodString;
+                revocationDate: z.ZodDate;
+                reasonCode: z.ZodOptional<z.ZodNumber>;
+                reason: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }, {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }>, "many">;
+            crlNumber: z.ZodOptional<z.ZodString>;
+            isDelta: z.ZodBoolean;
+            distributionPoint: z.ZodString;
+            fromCache: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        }, {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        }>>;
+        validatedAt: z.ZodDate;
+        expiresAt: z.ZodDate;
+        trustAnchor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        status?: CertificateValidationStatus;
+        errors?: string[];
+        warnings?: string[];
+        expiresAt?: Date;
+        validatedAt?: Date;
+        isValid?: boolean;
+        chainValidation?: {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        };
+        ocspResult?: {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        };
+        crlResult?: {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        };
+        trustAnchor?: string;
+    }, {
+        status?: CertificateValidationStatus;
+        errors?: string[];
+        warnings?: string[];
+        expiresAt?: Date;
+        validatedAt?: Date;
+        isValid?: boolean;
+        chainValidation?: {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        };
+        ocspResult?: {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        };
+        crlResult?: {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        };
+        trustAnchor?: string;
+    }>>;
+    accessToken: z.ZodOptional<z.ZodString>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    user?: {
+        email?: string;
+        tenantId?: string;
+        userId?: string;
+        attributes?: Record<string, string>;
+        username?: string;
+        upn?: string;
+        edipi?: string;
+        mappingStrategy?: CertificateMappingStrategy;
+        certificateFingerprint?: string;
+    };
+    error?: string;
+    validation?: {
+        status?: CertificateValidationStatus;
+        errors?: string[];
+        warnings?: string[];
+        expiresAt?: Date;
+        validatedAt?: Date;
+        isValid?: boolean;
+        chainValidation?: {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        };
+        ocspResult?: {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        };
+        crlResult?: {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        };
+        trustAnchor?: string;
+    };
+    accessToken?: string;
+    refreshToken?: string;
+    success?: boolean;
+    sessionId?: string;
+    errorCode?: string;
+    expiresAt?: Date;
+}, {
+    user?: {
+        email?: string;
+        tenantId?: string;
+        userId?: string;
+        attributes?: Record<string, string>;
+        username?: string;
+        upn?: string;
+        edipi?: string;
+        mappingStrategy?: CertificateMappingStrategy;
+        certificateFingerprint?: string;
+    };
+    error?: string;
+    validation?: {
+        status?: CertificateValidationStatus;
+        errors?: string[];
+        warnings?: string[];
+        expiresAt?: Date;
+        validatedAt?: Date;
+        isValid?: boolean;
+        chainValidation?: {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        };
+        ocspResult?: {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        };
+        crlResult?: {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        };
+        trustAnchor?: string;
+    };
+    accessToken?: string;
+    refreshToken?: string;
+    success?: boolean;
+    sessionId?: string;
+    errorCode?: string;
+    expiresAt?: Date;
+}>;
+/**
+ * PIV authentication context added to requests
+ */
+export interface PIVAuthContext {
+    /** Whether PIV authentication is present */
+    isPIVAuthenticated: boolean;
+    /** Mapped user identity */
+    user?: MappedUserIdentity;
+    /** Parsed client certificate */
+    certificate?: ParsedCertificate;
+    /** Certificate validation result */
+    validation?: CertificateValidationResult;
+    /** Session binding */
+    sessionBinding?: CardSessionBinding;
+}
+export declare const pivAuthContextSchema: z.ZodObject<{
+    isPIVAuthenticated: z.ZodBoolean;
+    user: z.ZodOptional<z.ZodObject<{
+        userId: z.ZodString;
+        username: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        upn: z.ZodOptional<z.ZodString>;
+        edipi: z.ZodOptional<z.ZodString>;
+        tenantId: z.ZodOptional<z.ZodString>;
+        attributes: z.ZodRecord<z.ZodString, z.ZodString>;
+        mappingStrategy: z.ZodNativeEnum<typeof CertificateMappingStrategy>;
+        certificateFingerprint: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        email?: string;
+        tenantId?: string;
+        userId?: string;
+        attributes?: Record<string, string>;
+        username?: string;
+        upn?: string;
+        edipi?: string;
+        mappingStrategy?: CertificateMappingStrategy;
+        certificateFingerprint?: string;
+    }, {
+        email?: string;
+        tenantId?: string;
+        userId?: string;
+        attributes?: Record<string, string>;
+        username?: string;
+        upn?: string;
+        edipi?: string;
+        mappingStrategy?: CertificateMappingStrategy;
+        certificateFingerprint?: string;
+    }>>;
+    certificate: z.ZodOptional<z.ZodObject<{
+        version: z.ZodNumber;
+        serialNumber: z.ZodString;
+        signatureAlgorithm: z.ZodString;
+        issuer: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        subject: z.ZodObject<{
+            CN: z.ZodOptional<z.ZodString>;
+            O: z.ZodOptional<z.ZodString>;
+            OU: z.ZodOptional<z.ZodString>;
+            C: z.ZodOptional<z.ZodString>;
+            ST: z.ZodOptional<z.ZodString>;
+            L: z.ZodOptional<z.ZodString>;
+            E: z.ZodOptional<z.ZodString>;
+            serialNumber: z.ZodOptional<z.ZodString>;
+            full: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }, {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        }>;
+        notBefore: z.ZodDate;
+        notAfter: z.ZodDate;
+        publicKeyAlgorithm: z.ZodString;
+        publicKey: z.ZodString;
+        subjectAltNames: z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<["email", "dns", "uri", "ip", "upn", "other"]>;
+            value: z.ZodString;
+            oid: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }, {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }>, "many">;
+        keyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        extendedKeyUsage: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        extensions: z.ZodArray<z.ZodObject<{
+            oid: z.ZodString;
+            critical: z.ZodBoolean;
+            value: z.ZodString;
+            parsed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }, {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }>, "many">;
+        authorityInfoAccess: z.ZodOptional<z.ZodObject<{
+            ocsp: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            caIssuers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            ocsp?: string[];
+            caIssuers?: string[];
+        }, {
+            ocsp?: string[];
+            caIssuers?: string[];
+        }>>;
+        crlDistributionPoints: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        fingerprint: z.ZodString;
+        publicKeyFingerprint: z.ZodString;
+        pem: z.ZodString;
+        der: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }, {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    }>>;
+    validation: z.ZodOptional<z.ZodObject<{
+        status: z.ZodNativeEnum<typeof CertificateValidationStatus>;
+        isValid: z.ZodBoolean;
+        errors: z.ZodArray<z.ZodString, "many">;
+        warnings: z.ZodArray<z.ZodString, "many">;
+        chainValidation: z.ZodOptional<z.ZodObject<{
+            valid: z.ZodBoolean;
+            depth: z.ZodNumber;
+            errors: z.ZodArray<z.ZodString, "many">;
+        }, "strip", z.ZodTypeAny, {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        }, {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        }>>;
+        ocspResult: z.ZodOptional<z.ZodObject<{
+            status: z.ZodEnum<["good", "revoked", "unknown"]>;
+            revocationTime: z.ZodOptional<z.ZodDate>;
+            revocationReason: z.ZodOptional<z.ZodString>;
+            producedAt: z.ZodDate;
+            thisUpdate: z.ZodDate;
+            nextUpdate: z.ZodOptional<z.ZodDate>;
+            responderId: z.ZodString;
+            fromCache: z.ZodBoolean;
+            responderUrl: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        }, {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        }>>;
+        crlResult: z.ZodOptional<z.ZodObject<{
+            issuer: z.ZodObject<{
+                CN: z.ZodOptional<z.ZodString>;
+                O: z.ZodOptional<z.ZodString>;
+                OU: z.ZodOptional<z.ZodString>;
+                C: z.ZodOptional<z.ZodString>;
+                ST: z.ZodOptional<z.ZodString>;
+                L: z.ZodOptional<z.ZodString>;
+                E: z.ZodOptional<z.ZodString>;
+                serialNumber: z.ZodOptional<z.ZodString>;
+                full: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            }, {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            }>;
+            thisUpdate: z.ZodDate;
+            nextUpdate: z.ZodOptional<z.ZodDate>;
+            revokedCertificates: z.ZodArray<z.ZodObject<{
+                serialNumber: z.ZodString;
+                revocationDate: z.ZodDate;
+                reasonCode: z.ZodOptional<z.ZodNumber>;
+                reason: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }, {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }>, "many">;
+            crlNumber: z.ZodOptional<z.ZodString>;
+            isDelta: z.ZodBoolean;
+            distributionPoint: z.ZodString;
+            fromCache: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        }, {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        }>>;
+        validatedAt: z.ZodDate;
+        expiresAt: z.ZodDate;
+        trustAnchor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        status?: CertificateValidationStatus;
+        errors?: string[];
+        warnings?: string[];
+        expiresAt?: Date;
+        validatedAt?: Date;
+        isValid?: boolean;
+        chainValidation?: {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        };
+        ocspResult?: {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        };
+        crlResult?: {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        };
+        trustAnchor?: string;
+    }, {
+        status?: CertificateValidationStatus;
+        errors?: string[];
+        warnings?: string[];
+        expiresAt?: Date;
+        validatedAt?: Date;
+        isValid?: boolean;
+        chainValidation?: {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        };
+        ocspResult?: {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        };
+        crlResult?: {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        };
+        trustAnchor?: string;
+    }>>;
+    sessionBinding: z.ZodOptional<z.ZodObject<{
+        sessionId: z.ZodString;
+        userId: z.ZodString;
+        certificateFingerprint: z.ZodString;
+        readerName: z.ZodString;
+        atr: z.ZodString;
+        createdAt: z.ZodDate;
+        lastActivity: z.ZodDate;
+        expiresAt: z.ZodDate;
+    }, "strip", z.ZodTypeAny, {
+        userId?: string;
+        sessionId?: string;
+        createdAt?: Date;
+        expiresAt?: Date;
+        certificateFingerprint?: string;
+        readerName?: string;
+        atr?: string;
+        lastActivity?: Date;
+    }, {
+        userId?: string;
+        sessionId?: string;
+        createdAt?: Date;
+        expiresAt?: Date;
+        certificateFingerprint?: string;
+        readerName?: string;
+        atr?: string;
+        lastActivity?: Date;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    user?: {
+        email?: string;
+        tenantId?: string;
+        userId?: string;
+        attributes?: Record<string, string>;
+        username?: string;
+        upn?: string;
+        edipi?: string;
+        mappingStrategy?: CertificateMappingStrategy;
+        certificateFingerprint?: string;
+    };
+    validation?: {
+        status?: CertificateValidationStatus;
+        errors?: string[];
+        warnings?: string[];
+        expiresAt?: Date;
+        validatedAt?: Date;
+        isValid?: boolean;
+        chainValidation?: {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        };
+        ocspResult?: {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        };
+        crlResult?: {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        };
+        trustAnchor?: string;
+    };
+    certificate?: {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    };
+    isPIVAuthenticated?: boolean;
+    sessionBinding?: {
+        userId?: string;
+        sessionId?: string;
+        createdAt?: Date;
+        expiresAt?: Date;
+        certificateFingerprint?: string;
+        readerName?: string;
+        atr?: string;
+        lastActivity?: Date;
+    };
+}, {
+    user?: {
+        email?: string;
+        tenantId?: string;
+        userId?: string;
+        attributes?: Record<string, string>;
+        username?: string;
+        upn?: string;
+        edipi?: string;
+        mappingStrategy?: CertificateMappingStrategy;
+        certificateFingerprint?: string;
+    };
+    validation?: {
+        status?: CertificateValidationStatus;
+        errors?: string[];
+        warnings?: string[];
+        expiresAt?: Date;
+        validatedAt?: Date;
+        isValid?: boolean;
+        chainValidation?: {
+            valid?: boolean;
+            errors?: string[];
+            depth?: number;
+        };
+        ocspResult?: {
+            status?: "unknown" | "revoked" | "good";
+            fromCache?: boolean;
+            revocationReason?: string;
+            revocationTime?: Date;
+            producedAt?: Date;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            responderId?: string;
+            responderUrl?: string;
+        };
+        crlResult?: {
+            issuer?: {
+                full?: string;
+                C?: string;
+                E?: string;
+                L?: string;
+                O?: string;
+                CN?: string;
+                OU?: string;
+                ST?: string;
+                serialNumber?: string;
+            };
+            fromCache?: boolean;
+            thisUpdate?: Date;
+            nextUpdate?: Date;
+            revokedCertificates?: {
+                reason?: string;
+                serialNumber?: string;
+                revocationDate?: Date;
+                reasonCode?: number;
+            }[];
+            crlNumber?: string;
+            isDelta?: boolean;
+            distributionPoint?: string;
+        };
+        trustAnchor?: string;
+    };
+    certificate?: {
+        version?: number;
+        issuer?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        publicKey?: string;
+        signatureAlgorithm?: string;
+        fingerprint?: string;
+        extensions?: {
+            value?: string;
+            critical?: boolean;
+            parsed?: Record<string, unknown>;
+            oid?: string;
+        }[];
+        subject?: {
+            full?: string;
+            C?: string;
+            E?: string;
+            L?: string;
+            O?: string;
+            CN?: string;
+            OU?: string;
+            ST?: string;
+            serialNumber?: string;
+        };
+        serialNumber?: string;
+        notBefore?: Date;
+        notAfter?: Date;
+        publicKeyAlgorithm?: string;
+        subjectAltNames?: {
+            value?: string;
+            type?: "email" | "ip" | "other" | "uri" | "dns" | "upn";
+            oid?: string;
+        }[];
+        keyUsage?: string[];
+        extendedKeyUsage?: string[];
+        authorityInfoAccess?: {
+            ocsp?: string[];
+            caIssuers?: string[];
+        };
+        crlDistributionPoints?: string[];
+        publicKeyFingerprint?: string;
+        pem?: string;
+        der?: string;
+    };
+    isPIVAuthenticated?: boolean;
+    sessionBinding?: {
+        userId?: string;
+        sessionId?: string;
+        createdAt?: Date;
+        expiresAt?: Date;
+        certificateFingerprint?: string;
+        readerName?: string;
+        atr?: string;
+        lastActivity?: Date;
+    };
+}>;
+/**
+ * PIV middleware options
+ */
+export interface PIVMiddlewareOptions {
+    /** Skip authentication for these paths */
+    skipPaths?: string[];
+    /** Require PIV for these paths (all others optional) */
+    requiredPaths?: string[];
+    /** Extract certificate from header name (default: x-client-certificate) */
+    certificateHeader?: string;
+    /** Extract certificate from header (alternative) */
+    certificateChainHeader?: string;
+    /** Custom trust anchor resolver */
+    trustAnchorResolver?: (cert: ParsedCertificate) => Promise<TrustedCAConfig | undefined>;
+    /** Custom user lookup after mapping */
+    userLookup?: (identity: MappedUserIdentity) => Promise<Record<string, unknown> | undefined>;
+    /** Failure handler */
+    onFailure?: (error: Error, request: unknown, reply: unknown) => Promise<void>;
+    /** Success handler */
+    onSuccess?: (context: PIVAuthContext, request: unknown) => Promise<void>;
+}
+export declare const pivMiddlewareOptionsSchema: z.ZodObject<{
+    skipPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    requiredPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    certificateHeader: z.ZodDefault<z.ZodString>;
+    certificateChainHeader: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    skipPaths?: string[];
+    requiredPaths?: string[];
+    certificateHeader?: string;
+    certificateChainHeader?: string;
+}, {
+    skipPaths?: string[];
+    requiredPaths?: string[];
+    certificateHeader?: string;
+    certificateChainHeader?: string;
+}>;
+/**
+ * Default PIV/CAC configuration
+ */
+export declare const DEFAULT_PIVCAC_CONFIG: PIVCACConfig;
+/**
+ * DoD PKI compatible configuration preset
+ */
+export declare const DOD_PKI_CONFIG: Partial<PIVCACConfig>;
+/**
+ * PIV authentication error codes
+ */
+export declare enum PIVErrorCode {
+    /** Certificate not provided */
+    CERTIFICATE_MISSING = "CERTIFICATE_MISSING",
+    /** Certificate parsing failed */
+    CERTIFICATE_PARSE_ERROR = "CERTIFICATE_PARSE_ERROR",
+    /** Certificate expired */
+    CERTIFICATE_EXPIRED = "CERTIFICATE_EXPIRED",
+    /** Certificate not yet valid */
+    CERTIFICATE_NOT_YET_VALID = "CERTIFICATE_NOT_YET_VALID",
+    /** Certificate revoked */
+    CERTIFICATE_REVOKED = "CERTIFICATE_REVOKED",
+    /** Certificate chain invalid */
+    CERTIFICATE_CHAIN_INVALID = "CERTIFICATE_CHAIN_INVALID",
+    /** Certificate signature invalid */
+    CERTIFICATE_SIGNATURE_INVALID = "CERTIFICATE_SIGNATURE_INVALID",
+    /** Certificate key usage invalid */
+    CERTIFICATE_KEY_USAGE_INVALID = "CERTIFICATE_KEY_USAGE_INVALID",
+    /** Certificate policy invalid */
+    CERTIFICATE_POLICY_INVALID = "CERTIFICATE_POLICY_INVALID",
+    /** OCSP check failed */
+    OCSP_CHECK_FAILED = "OCSP_CHECK_FAILED",
+    /** CRL check failed */
+    CRL_CHECK_FAILED = "CRL_CHECK_FAILED",
+    /** User mapping failed */
+    USER_MAPPING_FAILED = "USER_MAPPING_FAILED",
+    /** User not found */
+    USER_NOT_FOUND = "USER_NOT_FOUND",
+    /** Card removed */
+    CARD_REMOVED = "CARD_REMOVED",
+    /** Card locked */
+    CARD_LOCKED = "CARD_LOCKED",
+    /** PIN required */
+    PIN_REQUIRED = "PIN_REQUIRED",
+    /** PIN invalid */
+    PIN_INVALID = "PIN_INVALID",
+    /** PKCS#11 error */
+    PKCS11_ERROR = "PKCS11_ERROR",
+    /** Session expired */
+    SESSION_EXPIRED = "SESSION_EXPIRED",
+    /** Configuration error */
+    CONFIGURATION_ERROR = "CONFIGURATION_ERROR",
+    /** Internal error */
+    INTERNAL_ERROR = "INTERNAL_ERROR"
+}
+export declare const pivErrorCodeSchema: z.ZodNativeEnum<typeof PIVErrorCode>;
+//# sourceMappingURL=types.d.ts.map