export declare function getMacosLoginKeychainPath(): string;
export declare function getMacosTrustKeychains(): string[];
export declare function listCertSha256HashesByCommonName(keychain: string, commonName?: string): string[];
/**
 * Remove older rpx Root CA copies from keychains, keeping only the fingerprint
 * that matches the on-disk `caPath` file.
 */
export declare function pruneStaleRootCas(options: PruneStaleRootCasOptions): void;
/**
 * True when the Root CA is trusted for SSL to `serverName` (macOS verify-cert).
 * On other platforms, falls back to fingerprint presence in trust stores.
 */
export declare function isRootCaTrustedForSsl(caPath: string, serverName: string, options?: { verbose?: boolean }): boolean;
export declare function isRootCaFingerprintInKeychains(caPath: string, options?: { verbose?: boolean }): boolean;
/**
 * Install the Root CA into login + system keychains with SSL/basic policies,
 * pruning stale copies first. Returns true when SSL verification succeeds or
 * the cert fingerprint is present in a keychain.
 */
export declare function trustRootCaForBrowsers(caPath: string, options: TrustRootCaForBrowsersOptions): boolean;
/** Chrome/Edge need SSL + basic trust policies — plain trustRoot often leaves "trust settings: 0". */
export declare const MACOS_CA_TRUST_FLAGS: '-d -r trustRoot -p ssl -p basic';
export declare const MACOS_SYSTEM_KEYCHAIN: '/Library/Keychains/System.keychain';
/** Default CN label for the shared rpx Root CA in macOS keychain listings. */
export declare const RPX_ROOT_CA_COMMON_NAME: 'rpx.localhost';
export declare interface ListCertsByCommonNameOptions {
  keychain: string
  commonName?: string
}
export declare interface PruneStaleRootCasOptions {
  caPath: string
  commonName?: string
  keychains?: string[]
  verbose?: boolean
}
export declare interface TrustRootCaForBrowsersOptions {
  serverName: string
  commonName?: string
  verbose?: boolean
}