interface ClusterCertificateManagerOptions {
    signalEndpoint: string;
    nodeId: string;
    nodeToken: string;
    certificateKeyPath: string;
    certificatePath: string;
    fullChainPath?: string;
    renewBeforeDays?: number;
    checkIntervalMs?: number;
    onCertificateInstalled?: () => Promise<void> | void;
}
export interface RuntimeCertificateStatus {
    status: 'valid' | 'renewal_due' | 'missing';
    expiresAt?: string;
    domains?: string[];
    updatedAt?: string;
}
export interface RuntimeCertificateRenewalResult {
    status: 'renewed';
}
export declare class ClusterCertificateManager {
    private readonly logger;
    private readonly endpoint;
    private readonly nodeId;
    private readonly nodeToken;
    private readonly certificateKeyPath;
    private readonly certificatePath;
    private readonly fullChainPath?;
    private readonly renewBeforeMs;
    private readonly checkIntervalMs;
    private readonly onCertificateInstalled?;
    private assignedDomain?;
    private status;
    private interval?;
    private issuing;
    constructor(options: ClusterCertificateManagerOptions);
    start(): Promise<void>;
    stop(): void;
    handleHeartbeatMetadata(metadata?: Record<string, unknown>): void;
    getHeartbeatPayload(): Record<string, unknown> | undefined;
    readCertificateStatus(): Promise<RuntimeCertificateStatus>;
    isAvailable(): boolean;
    renewCertificate(): Promise<RuntimeCertificateRenewalResult>;
    private ensureCertificate;
    private isCertificateValid;
    private refreshCertificateStatus;
    private extractDomainsFromCertificate;
    private requestCertificate;
    private generateKeyAndCsr;
    private ensureDirectory;
}
export {};