/**
 * Custom TLS certificates — bring-your-own cert for apex or wildcard
 * hostnames. Private keys never leave the server after upload; `verify`
 * performs offline chain / expiry validation against the stored cert.
 *
 *   GET    /projects/:id/certs
 *   POST   /projects/:id/certs
 *   DELETE /projects/:id/certs/:domain
 *   POST   /projects/:id/certs/:domain/verify
 */
import type { Client } from './client.js';
export interface CustomCert {
    readonly id: string;
    readonly domain: string;
    readonly issuer: string | null;
    readonly expiresAt: string | null;
    readonly status: string;
    readonly projectId: string | null;
}
export declare const list: (client: Client, projectId: string) => Promise<{
    certs: readonly CustomCert[];
}>;
export interface AddInput {
    readonly domain: string;
    readonly certPem: string;
    readonly keyPem: string;
}
export declare const add: (client: Client, projectId: string, input: AddInput) => Promise<{
    id: string;
}>;
declare const _remove: (client: Client, projectId: string, domain: string) => Promise<void>;
export { _remove as remove };
export interface VerifyResult {
    readonly domain: string;
    readonly matches: boolean;
    readonly chainValid: boolean;
    readonly notExpired: boolean;
    readonly notes: readonly string[];
}
export declare const verify: (client: Client, projectId: string, domain: string) => Promise<VerifyResult>;
/**
 * Auto-provision a cert for `domain` via ACME (Let's Encrypt).
 * Platform performs HTTP-01 or DNS-01 challenge then installs the
 * resulting cert. Phase 4b Matrix-2 gap closure.
 */
export declare const autoProvision: (client: Client, projectId: string, body: {
    readonly domain: string;
    readonly challenge?: "http-01" | "dns-01";
}) => Promise<{
    jobId: string;
    domain: string;
    status: "pending" | "issued" | "failed";
}>;
/**
 * Query auto-provision job status.
 */
export declare const getAutoProvisionStatus: (client: Client, projectId: string, jobId: string) => Promise<{
    jobId: string;
    domain: string;
    status: "pending" | "issued" | "failed";
    error?: string;
}>;
//# sourceMappingURL=certs.d.ts.map