/**
 * CLI SSH Certificate Authority (CA) Management Service
 *
 * Manages SSH CA for secure server access with ephemeral certificates:
 * - Generates ED25519 SSH CA keypair if not exists
 * - Stores in ~/.flui/ca/
 * - Signs ephemeral SSH certificates for server access
 * - Provides enrollment script for server CA installation
 * - One CA per CLI installation (shared across all clusters)
 */
export declare class CliCaService {
    private readonly logger;
    private readonly caDir;
    private readonly caKeyPath;
    private readonly caPubKeyPath;
    constructor();
    /**
     * Ensure ~/.flui/ca directory exists
     */
    private ensureCaDir;
    /**
     * Get or generate SSH CA keypair
     */
    getOrCreateCaCertificate(): Promise<{
        publicKey: string;
        privateKeyPath: string;
    }>;
    /**
     * Get CA public key content
     */
    getCaPublicKey(): Promise<string>;
    /**
     * Sign a public key to create an ephemeral certificate
     *
     * @param publicKey - SSH public key to sign
     * @param validitySeconds - Certificate validity in seconds (default: 300 = 5 minutes)
     * @param principals - Principals (usernames) the certificate is valid for
     * @returns Signed certificate content
     */
    signPublicKey(publicKey: string, validitySeconds?: number, principals?: string[]): Promise<string>;
    /**
     * Get enrollment script that installs CA on a server
     * This script should be included in cloud-init or run manually on servers
     */
    getEnrollmentScript(): Promise<string>;
    /**
     * Get CA certificate info
     */
    getCaInfo(): Promise<{
        algorithm: string;
        fingerprint: string;
        comment: string;
    }>;
    /**
     * Get CA private key path (for internal use)
     */
    getCaKeyPath(): string;
    /**
     * Get CA public key path
     */
    getCaPubKeyPath(): string;
}
