import type { PeerCertInfo } from '@loopsy/protocol';
export interface TlsFiles {
    cert: string;
    key: string;
    fingerprint: string;
}
export declare class TlsManager {
    private dataDir;
    private tlsDir;
    private certPath;
    private keyPath;
    constructor(dataDir?: string);
    /** Check if TLS cert/key already exist */
    hasCerts(): boolean;
    /** Generate a self-signed EC certificate if none exists */
    ensureCerts(hostname: string): Promise<TlsFiles>;
    /** Generate a new self-signed certificate */
    generateCerts(hostname: string): Promise<TlsFiles>;
    /** Load existing cert/key files */
    loadCerts(): Promise<TlsFiles>;
    /** Compute SHA-256 fingerprint of a PEM certificate */
    computeFingerprint(certPem: string): string;
    /** Get cert info for display */
    getCertInfo(certPem: string): PeerCertInfo;
    /** Get Fastify HTTPS options */
    getHttpsOptions(): Promise<{
        key: string;
        cert: string;
    } | null>;
    /** Create a self-signed certificate using openssl CLI (widely available) */
    private createSelfSignedCert;
}
//# sourceMappingURL=tls-manager.d.ts.map