/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { BinaryKeyPair, Bytes, Construction, Crypto, Environment, Environmental, StorageContext } from "#general";
import { CaseAuthenticatedTag, FabricId, NodeId } from "#types";
/**
 * Manages the root key pair for a fabric owned by a local node.
 *
 * Supports optional Intermediate Certificate Authority (ICAC) for 3-tier PKI hierarchy.
 * When ICAC is enabled, the certificate chain becomes: RCAC -> ICAC -> NOC instead of RCAC -> NOC.
 *
 * Behavior:
 * - When ICAC exists, it is always used to sign NOCs (operational certificates)
 * - When no ICAC exists, the root certificate signs NOCs directly
 *
 * Security implications:
 * - 3-tier PKI allows RCAC to remain in secure storage while ICAC signs operational certificates
 * - Storage of existing certificates is preserved when loading from storage
 * - Configuration changes after creation are not supported
 */
export declare class CertificateAuthority {
    #private;
    get crypto(): Crypto;
    get construction(): Construction<CertificateAuthority>;
    /**
     * Creates a new CertificateAuthority instance and use the provided storage to store and retrieve the values.
     * A new certificate is only created when the storage does not contain any credentials.
     * Use the generateIntermediateCert parameter to specify if an ICAC should be created too. The parameter, when set,
     * must match to the storage content if a certificate is stored!
     */
    static create(crypto: Crypto, storage: StorageContext, generateIntermediateCert?: boolean): Promise<CertificateAuthority>;
    /**
     * Creates a new CertificateAuthority instance with the provided configuration. The used certificate is loaded from
     * the configuration object.
     */
    static create(crypto: Crypto, options: CertificateAuthority.Configuration): Promise<CertificateAuthority>;
    /**
     * Creates a new CertificateAuthority instance with the provided configuration. The configuration is not stored.
     * Use the generateIntermediateCert parameter to specify if an ICAC should be created too.
     */
    static create(crypto: Crypto, generateIntermediateCert?: boolean): Promise<CertificateAuthority>;
    constructor(crypto: Crypto, options?: StorageContext | CertificateAuthority.Configuration | boolean, generateIntermediateCert?: boolean);
    static [Environmental.create](env: Environment): CertificateAuthority;
    get rootCert(): Bytes;
    get icacCert(): Bytes | undefined;
    get config(): CertificateAuthority.Configuration;
    generateNoc(publicKey: Bytes, fabricId: FabricId, nodeId: NodeId, caseAuthenticatedTags?: CaseAuthenticatedTag[]): Promise<AllowSharedBufferSource>;
}
export declare namespace CertificateAuthority {
    /** Base configuration fields shared by both 2-tier and 3-tier PKI */
    type ConfigurationBase = {
        rootCertId: bigint;
        rootKeyIdentifier: Bytes;
        rootCertBytes: Bytes;
        nextCertificateId: bigint;
    };
    /**
     * Configuration for 2-tier PKI (RCAC -> NOC).
     * rootKeyPair is REQUIRED since RCAC signs NOCs directly.
     */
    export type ConfigurationWithoutIcac = ConfigurationBase & {
        rootKeyPair: BinaryKeyPair;
    };
    /**
     * Configuration for 3-tier PKI (RCAC -> ICAC -> NOC).
     * rootKeyPair is OPTIONAL since ICAC signs NOCs, not RCAC.
     * This allows controllers to operate without access to the RCAC private key.
     */
    export type ConfigurationWithIcac = ConfigurationBase & {
        rootKeyPair?: BinaryKeyPair;
        icacCertId: bigint;
        icacKeyPair: BinaryKeyPair;
        icacKeyIdentifier: Bytes;
        icacCertBytes: Bytes;
    };
    /**
     * Configuration for CertificateAuthority with external certificates.
     *
     * When using ICAC (3-tier PKI), the rootKeyPair can be omitted since NOCs are signed
     * by the ICAC, not the RCAC. This allows controllers to operate without access to
     * the RCAC private key.
     */
    export type Configuration = ConfigurationWithoutIcac | ConfigurationWithIcac;
    export {};
}
//# sourceMappingURL=CertificateAuthority.d.ts.map