import type { DefaultTlsContext, SniTlsEntry } from './sni';
import type { LocalCaConfig, OnDemandTlsConfig } from './types';
/** Where the CA and the leaf live inside `dir`. */
export declare function localCaPaths(dir: string): LocalCaPaths;
/**
 * Normalize and validate a {@link LocalCaConfig}. Throws on an empty host
 * list, a malformed host or IP, and on any host that a public on-demand set
 * also claims (the two flows would fight over one SNI name, and ACME would be
 * asked for a name it can never issue).
 */
export declare function resolveLocalCaConfig(cfg: LocalCaConfig, onDemandTls?: OnDemandTlsConfig): ResolvedLocalCaConfig;
/** Parse Node's `subjectAltName` string into the dNSName and iPAddress sets. */
export declare function parseSanNames(subjectAltName: string | undefined): { dns: Set<string>, ips: Set<string> };
/**
 * Why an on-disk leaf must be re-minted, or `null` when it can be reused.
 * Checked on every start: SAN coverage (a host or IP added to the config),
 * the signing CA (a rotated CA orphans its leaves), the key pair, and the
 * expiry window (`renewBeforeDays`).
 */
export declare function leafRenewalReason(material: { cert: string, key: string, caCert: string }, cfg: Pick<ResolvedLocalCaConfig, 'hosts' | 'ips' | 'renewBeforeDays'>, now?: Date): string | null;
/**
 * Install the local Root CA into the system trust store (tlsx `installCA`),
 * skipped when it is already trusted. Never throws: on a box where the trust
 * store cannot be written rpx must still serve; the operator sees a warning
 * and can trust the CA by hand.
 */
export declare function installLocalCaTrust(paths: LocalCaPaths, verbose?: boolean): Promise<{ alreadyTrusted: boolean, installed: boolean }>;
/**
 * Load-or-create the Root CA under `cfg.dir`, then reuse or (re)mint the one
 * LAN leaf. Idempotent: a second start with the same config touches nothing.
 */
export declare function ensureLocalCa(cfg: LocalCaConfig, options?: EnsureLocalCaOptions): Promise<LocalCaMaterial>;
export declare const LOCAL_CA_LEAF_CERT_FILENAME: 'rpx-local-host.crt';
export declare const LOCAL_CA_LEAF_KEY_FILENAME: 'rpx-local-host.key';
/** Common name of the Root CA rpx mints for a LAN gateway. */
export declare const LOCAL_CA_COMMON_NAME: 'rpx Local CA';
export declare const DEFAULT_LOCAL_CA_VALIDITY_DAYS: 825;
export declare const DEFAULT_LOCAL_CA_RENEW_BEFORE_DAYS: 30;
export declare interface LocalCaPaths {
  caCertPath: string
  caKeyPath: string
  certPath: string
  keyPath: string
}
export declare interface ResolvedLocalCaConfig {
  dir: string
  hosts: string[]
  ips: string[]
  installTrust: boolean
  validityDays: number
  renewBeforeDays: number
}
export declare interface LocalCaMaterial {
  paths: LocalCaPaths
  caCert: string
  cert: string
  key: string
  caCreated: boolean
  leafMinted: boolean
  renewalReason: string | null
  notAfter: Date
  entries: SniTlsEntry[]
  defaultTls: DefaultTlsContext
  trust?: { alreadyTrusted: boolean, installed: boolean }
}
export declare interface EnsureLocalCaOptions {
  verbose?: boolean
  onDemandTls?: OnDemandTlsConfig
  now?: () => Date
}
/**
 * Newer tlsx releases ship their own `isCertTrusted` (with a Linux trust-store
 * check). Prefer it when the installed tlsx has one; fall back to rpx's own
 * fingerprint check otherwise. Resolved at call time so rpx keeps working
 * against both older and newer tlsx builds.
 */
declare type TrustCheck = (certPath: string, options?: { verbose?: boolean }) => Promise<boolean> | boolean;