/// <reference path="node-forge-ed25519.d.ts" />
/// <reference path="../../storage/storage.d.ts" />
/// <reference types="node" />
/// <reference types="node" />
import * as forge from "node-forge";
export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
export declare const identityStorageKey = "machineCA_14";
export type IdentityStorageType = {
    domain: string;
    certB64: string;
    keyB64: string;
};
export declare function DEV_getIdentityFilePath(domain: string): string;
export declare function DEV_listIdentityDomains(): string[];
export interface X509KeyPair {
    domain: string;
    cert: Buffer;
    key: Buffer;
}
export declare function getCommonName(cert: Buffer | string): string;
export declare function createX509(config: {
    domain: string;
    issuer: X509KeyPair | "self";
    lifeSpan: number;
    keyPair: {
        publicKey: forge.Ed25519PublicKey;
        privateKey: forge.Ed25519PrivateKey;
    };
}): X509KeyPair;
export declare function privateKeyToPem(key: forge.Ed25519PrivateKey): string;
export declare function parseCert(PEMorDER: string | Buffer): forge.pki.Certificate;
export declare function getPublicIdentifier(PEMorDER: string | Buffer): Buffer;
export declare const sign: (keyPair: {
    key: string | Buffer;
}, data: unknown) => string;
export declare function verify(cert: string, signature: string, data: unknown): void;
export declare function validateCACert(domain: string, cert: string | Buffer): void;
export declare function validateCertificate(domain: string, cert: Buffer | string, issuerCert: Buffer | string): void;
export declare function generateKeyPair(): {
    publicKey: forge.Ed25519PublicKey;
    privateKey: forge.Ed25519PrivateKey;
};
export declare function generateCA(domain: string): X509KeyPair;
export declare function createCertFromCA(config: {
    CAKeyPair: X509KeyPair;
}): X509KeyPair;
export declare function getMachineId(domainNameOrNodeId: string, domain: string): string;
export type NodeIdParts = {
    threadId: string;
    machineId: string;
    domain: string;
    port: number;
};
export declare function decodeNodeId(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts | undefined;
export declare function decodeNodeIdAssert(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts;
export declare function encodeNodeId(parts: NodeIdParts): string;
export declare function setIdentityCARaw(domain: string, json: string): Promise<void>;
export declare function loadIdentityCA(domain: string): Promise<void>;
export declare function getIdentityCA(domain: string): X509KeyPair;
export declare function getIdentityCAPromise(domain: string): X509KeyPair;
export declare function getOwnMachineId(domain: string): string;
export declare function getOwnThreadId(domain: string): string;
/** Part of the machineId comes from the publicKey, so we can use it to verify.

    Fairly weak: it only proves the id names this key, not that the caller holds the key - usually a
    better workflow should be used, with a back and forth (ex, validateCertificate over a signed
    exchange). In some cases it is sufficient, such as exposing source maps to the client. */
export declare function verifyMachineIdForPublicKey(config: {
    machineId: string;
    publicKey: Buffer;
}): boolean;
export declare function getThreadKeyCert(domain: string): X509KeyPair;
export declare function getOwnNodeId(): string;
export declare function getOwnNodeIdAllowUndefined(): string;