import 'reflect-metadata';
/**
 * Certificate Authority for the ACME server.
 * Generates a self-signed root CA and signs certificates from CSRs.
 * Uses @peculiar/x509 (already a project dependency).
 */
export declare class AcmeServerCA {
    private options;
    private caKeyPair;
    private caCert;
    private caCertPem;
    private certValidityDays;
    constructor(options?: {
        commonName?: string;
        validityDays?: number;
        certValidityDays?: number;
    });
    init(): Promise<void>;
    /**
     * Sign a CSR and return a PEM certificate chain (end-entity + root CA).
     * @param csrDerBase64url - The CSR in base64url-encoded DER format (as sent by ACME clients)
     */
    signCsr(csrDerBase64url: string): Promise<string>;
    getCaCertPem(): string;
    private randomSerialNumber;
}