import 'reflect-metadata';
import type { IAcmeCsrOptions } from './acme.interfaces.js';
/**
 * All cryptographic operations for the ACME protocol.
 * Uses node:crypto for key gen, JWK, JWS signing.
 * Uses @peculiar/x509 for CSR generation (no native Node.js CSR API).
 */
export declare class AcmeCrypto {
    /**
     * Generate an RSA private key in PEM format
     */
    static createRsaPrivateKey(modulusLength?: number): string;
    /**
     * Export public JWK from PEM private key, keys sorted alphabetically per RFC 7638
     */
    static getJwk(keyPem: string): Record<string, string>;
    /**
     * Compute JWK Thumbprint (SHA-256, base64url) per RFC 7638
     */
    static getJwkThumbprint(jwk: Record<string, string>): string;
    /**
     * Create a flattened JWS for ACME requests (RFC 7515)
     * payload=null means POST-as-GET (empty string payload)
     */
    static createJws(keyPem: string, url: string, payload: any | null, options: {
        nonce: string;
        kid?: string;
        jwk?: Record<string, string>;
    }): {
        protected: string;
        payload: string;
        signature: string;
    };
    /**
     * Create a CSR (PKCS#10) via @peculiar/x509
     * Returns [privateKeyPem, csrPem]
     */
    static createCsr(options: IAcmeCsrOptions, existingKeyPem?: string): Promise<[string, string]>;
    /**
     * Convert PEM to raw DER Buffer (strip headers, decode base64)
     */
    static pemToBuffer(pem: string): Buffer;
    /**
     * Determine JWS algorithm from key type
     */
    static getAlg(keyPem: string): string;
    /**
     * Import a PEM private key into WebCrypto as a CryptoKeyPair
     */
    private static importKeyPairToWebCrypto;
}