/**
 * warp's local certificate authority.
 *
 * On first use it generates a self-signed P-256 root, persists it under
 * ~/.pxpipe, and mints leaf certs per SNI host on demand so the CONNECT proxy
 * can terminate (and therefore route) the agent's TLS. Only the child process
 * trusts it: warp points the child's NODE_EXTRA_CA_CERTS at the root, so
 * nothing is installed in the system keychain and no other process on the
 * machine is affected.
 *
 * Ported from wardex ca.go. The certificate assembly is hand-rolled because
 * Node has no equivalent of Go's x509.CreateCertificate — see ./der.ts.
 */
import { type SecureContext } from 'node:tls';
export declare function findSystemRootBundle(candidates?: readonly string[]): string | null;
export declare class CertificateAuthority {
    private readonly certPem;
    private readonly caKey;
    private readonly leafKey;
    private readonly leafKeyPem;
    readonly certPath: string;
    /** Our CA followed by the system roots; see {@link writeBundle}. */
    readonly bundlePath: string;
    /** Null when no system root bundle was found and `bundlePath` is CA-only. */
    readonly systemRootsPath: string | null;
    private readonly leaves;
    private constructor();
    /**
     * Write `warp-ca-bundle.pem` = our CA + the system roots, for the env vars
     * that replace the trust store. Regenerated on every load: the system bundle
     * rotates underneath us and the cost is one file write.
     */
    private static writeBundle;
    /**
     * Load the persisted CA, or create and persist one. A CA that fails to load
     * or has expired is replaced rather than reported: it is entirely derived
     * state, and the only cost of regenerating is that the child process trusts a
     * new root it is about to be handed anyway.
     */
    static loadOrCreate(dir: string): CertificateAuthority;
    /**
     * Cached-or-minted TLS context for an SNI host. One leaf key is reused across
     * every host: these certs never leave the machine and are only trusted by the
     * child we spawned, so per-host keygen would buy nothing but latency on the
     * first request to each host.
     */
    secureContextFor(host: string): SecureContext;
}
//# sourceMappingURL=ca.d.ts.map