/**
 * Minimal DER writer — just enough ASN.1 to mint an X.509 certificate.
 *
 * Node can generate keys and sign bytes, but unlike Go's crypto/x509 it has no
 * certificate *issuer*: `new X509Certificate()` only parses. Everything here
 * exists to build the handful of structures in RFC 5280 that a leaf and a root
 * need, so warp can run its own CA without pulling in a dependency.
 *
 * Only the write path is implemented. Parsing is left to node:crypto's
 * X509Certificate, which is why nothing here reads DER back.
 */
export declare const TAG: {
    readonly BOOLEAN: 1;
    readonly INTEGER: 2;
    readonly BIT_STRING: 3;
    readonly OCTET_STRING: 4;
    readonly OID: 6;
    readonly UTF8_STRING: 12;
    readonly SEQUENCE: 48;
    readonly SET: 49;
    readonly IA5_STRING: 22;
    readonly UTC_TIME: 23;
};
export declare function concatBytes(chunks: Uint8Array[]): Uint8Array;
/** tag + length + contents, the shape every other helper is built from. */
export declare function tlv(tag: number, body: Uint8Array): Uint8Array;
export declare function seq(...items: Uint8Array[]): Uint8Array;
export declare function set(...items: Uint8Array[]): Uint8Array;
export declare function bool(value: boolean): Uint8Array;
/**
 * INTEGER is signed two's complement: strip redundant leading zero bytes, then
 * re-add one if the top bit would otherwise read as negative. Serial numbers
 * are the reason this matters — a random 16-byte serial is negative half the
 * time, and a negative serial is a spec violation some verifiers reject.
 */
export declare function integer(value: number | Uint8Array): Uint8Array;
/**
 * OID: first two arcs pack into one byte (40*a + b), the rest are base-128 with
 * a continuation bit on every byte but the last.
 */
export declare function oid(dotted: string): Uint8Array;
export declare function utf8String(value: string): Uint8Array;
export declare function ia5String(value: string): Uint8Array;
export declare function octetString(body: Uint8Array): Uint8Array;
/** BIT STRING carries a leading count of unused bits in its final byte. */
export declare function bitString(body: Uint8Array, unusedBits?: number): Uint8Array;
/** Context-specific tag, e.g. [0] EXPLICIT / [2] IMPLICIT in a SAN. */
export declare function contextTag(n: number, body: Uint8Array, constructed?: boolean): Uint8Array;
/**
 * UTCTime is YYMMDDHHMMSSZ and is only unambiguous through 2049; RFC 5280
 * requires GeneralizedTime past that. Both certs we mint are short-lived
 * relative to that ceiling, but assert rather than silently emit a date that
 * verifiers will read as 19xx.
 */
export declare function utcTime(date: Date): Uint8Array;
export declare function pem(label: string, der: Uint8Array): string;
//# sourceMappingURL=der.d.ts.map