/**
 * WorkloadSVID - SVID data container with certificate file management
 * Mirrors Python WorkloadSVID dataclass
 */
import * as tls from 'node:tls';
export declare class WorkloadSVID {
    spiffeId: string;
    certificate: string;
    privateKey: string;
    trustBundle: string;
    certDir: string;
    certFilePath: string | null;
    keyFilePath: string | null;
    caFilePath: string | null;
    constructor(options: {
        spiffeId: string;
        certificate: string;
        privateKey: string;
        trustBundle: string;
        certDir?: string;
    });
    /** Write certificates to persistent files for mTLS */
    private writeCertsToFiles;
    /** Atomically write content to file */
    private atomicWrite;
    /**
     * Create TLS options for server (e.g., Express HTTPS).
     * Returns options suitable for `https.createServer(options, app)`.
     */
    createTlsOptionsForServer(): tls.SecureContextOptions & {
        requestCert: boolean;
        rejectUnauthorized: boolean;
    };
    /**
     * Create TLS options for client (e.g., fetch with custom agent).
     * Returns options suitable for `https.Agent(options)`.
     */
    createTlsOptionsForClient(): tls.SecureContextOptions & {
        rejectUnauthorized: boolean;
    };
    /** Refresh SVID data (called during renewal) */
    refresh(certificate: string, privateKey: string, trustBundle: string): void;
}
//# sourceMappingURL=workload-svid.d.ts.map