export interface DevCert {
    key: string;
    cert: string;
    /** Where the pair lives, so the banner can point at it if a creator wants to trust it properly. */
    dir: string;
}
export interface DevCertDeps {
    /** `~/.bitmagic` by default. Injected by the test — see the note below. */
    baseDir?: string;
    /**
     * Runs openssl. Returns its exit status and whatever it said, never throws.
     *
     * A seam rather than a spy on `child_process`, and `baseDir` above is a parameter rather than a
     * `$HOME` redirect, for the same reason: `os.homedir()` ignores `$HOME` on some platforms, so a
     * test that only moved the env var would generate into the creator's REAL `~/.bitmagic`.
     */
    run?: (command: string, args: string[]) => {
        status: number | null;
        stderr: string;
    };
    now?: () => number;
}
/**
 * The certificate for `address`, generated if there is not a usable one already.
 *
 * Returns null when openssl is missing or refuses — a machine without it still gets a working
 * `--mobile`, over http, minus WebGPU. The caller says so; nothing here fails the dev server, and
 * nothing here is worth an exception: this is a capability, and its absence has a fallback.
 */
export declare function ensureDevCert(address: string, deps?: DevCertDeps): DevCert | null;