import type { DnsProvider } from '../../dns/DnsProvider';
/**
 * DNS 验证处理器接口
 */
export interface DnsChallengeHandler {
    setChallenge(host: string, value: string): Promise<void>;
    removeChallenge(host: string, value?: string): Promise<void>;
}
/**
 * 使用 DnsProvider 的本地 DNS 验证处理器
 */
export declare class LocalDnsChallengeHandler implements DnsChallengeHandler {
    private readonly provider;
    private readonly rootDomain;
    constructor(provider: DnsProvider, rootDomain: string);
    setChallenge(host: string, value: string): Promise<void>;
    removeChallenge(host: string, value?: string): Promise<void>;
    private extractSubdomain;
}
export interface AcmeCertificateManagerOptions {
    /** Cloud 模式: 通过 signal endpoint 操作 DNS */
    signalEndpoint?: string;
    nodeId?: string;
    nodeToken?: string;
    /** Local 模式: 直接使用 DNS Provider */
    dnsProvider?: DnsProvider;
    rootDomain?: string;
    /** 或者直接提供自定义的 DNS 验证处理器 */
    dnsChallengeHandler?: DnsChallengeHandler;
    email: string;
    domains: string[];
    directoryUrl?: string;
    fallbackDirectoryUrls?: string[];
    accountKeyPath: string;
    certificateKeyPath: string;
    certificatePath: string;
    fullChainPath?: string;
    renewBeforeDays?: number;
    propagationDelayMs?: number;
}
export interface RuntimeCertificateStatus {
    status: 'valid' | 'renewal_due' | 'missing' | 'invalid';
    expiresAt?: string;
    domains?: string[];
}
export interface RuntimeCertificateRenewalResult {
    status: 'renewed';
}
export declare class AcmeCertificateManager {
    private readonly logger;
    private readonly dnsHandler;
    private readonly email;
    private readonly domains;
    private readonly directoryUrl;
    private readonly fallbackDirectoryUrls;
    private readonly accountKeyPath;
    private readonly certificateKeyPath;
    private readonly certificatePath;
    private readonly fullChainPath?;
    private readonly renewBeforeDays;
    private readonly propagationDelayMs;
    private issuing;
    constructor(options: AcmeCertificateManagerOptions);
    ensureCertificate(): Promise<boolean>;
    readCertificateStatus(): Promise<RuntimeCertificateStatus>;
    isAvailable(): boolean;
    renewCertificate(): Promise<RuntimeCertificateRenewalResult>;
    private extractDomainsFromCertificate;
    private issueCertificateWithLock;
    private issueCertificate;
    private issueCertificateFromCA;
    private ensureAccount;
    private loadOrCreateAccountKey;
    private readOptionalFile;
    private ensureDirectory;
    private delay;
    private isConflictError;
}