import { Repository } from 'typeorm';
import { CAKeypairEntity } from '../entities/ca-keypair.entity';
import { SSHKeyGeneratorService } from './ssh-key-generator.service';
import { KeyStorageService } from './key-storage.service';
export declare class CAManagerService {
    private readonly caRepository;
    private readonly keyGenerator;
    private readonly keyStorage;
    private readonly logger;
    constructor(caRepository: Repository<CAKeypairEntity>, keyGenerator: SSHKeyGeneratorService, keyStorage: KeyStorageService);
    initializeCA(): Promise<CAKeypairEntity>;
    getActiveCA(): Promise<CAKeypairEntity | null>;
    /**
     * Resolves the CLI CA directory for the active profile.
     * Priority: FLUI_PROFILE env var > ~/.flui/context file > 'default'
     * Path: ~/.flui/profiles/<profile>/ca/
     */
    private getCliCaDir;
    getCAPrivateKey(tenantId?: string): Promise<string>;
    getCAPublicKey(tenantId?: string): Promise<string>;
    getCAInfo(): Promise<CAKeypairEntity>;
    getEnrollmentScript(tenantId?: string): Promise<string>;
    /**
     * Register an external CA public key (from CLI)
     * @param publicKey - SSH CA public key in OpenSSH format
     * @param options - Registration options (name, replace, metadata)
     */
    registerExternalCA(publicKey: string, options?: {
        name?: string;
        replace?: boolean;
        metadata?: Record<string, any>;
        privateKey?: string;
    }): Promise<CAKeypairEntity>;
    /**
     * Backfill the encrypted private key on an existing CA row that was
     * originally seeded with only the public half. Used by the bootstrap
     * seeder so once SSH_CA_PRIVATE_KEY appears in the environment the DB
     * row becomes self-sufficient and survives even when the env var is no
     * longer mounted.
     */
    attachPrivateKey(caId: string, privateKey: string): Promise<void>;
    /**
     * Compute SHA256 fingerprint for a public key
     * @param publicKey - OpenSSH format public key
     * @param keyType - Key type (ed25519 or rsa)
     */
    private computeFingerprint;
}
