import type { BaseXXEndeCoder, SuperThis } from "../types/sthis.js";
import type { Extensions, FPDeviceIDCSRPayload, Subject } from "../types/device-id-payload.js";
import type { IssueCertificateResult } from "../types/cert-payload.js";
import type { JWKPublic } from "../types/wire.js";
import type { ClerkClaim } from "../clerk-claim.js";
import { DeviceIdKey } from "./key.js";
import { Result } from "@adviser/cement";
import type { CAActions, CACertResult, DeviceIdCAIf, DeviceIdCAJsonParam } from "../types/device-id-types.js";
interface DeviceIdCAOpts {
    readonly base64: BaseXXEndeCoder;
    readonly caKey: DeviceIdKey;
    readonly caSubject: Subject;
    readonly actions: CAActions;
    readonly caChain?: string[];
    readonly validityPeriod?: number;
}
export declare class DeviceIdCA implements DeviceIdCAIf {
    #private;
    constructor(opts: DeviceIdCAOpts);
    static from(sthis: SuperThis, caJson: DeviceIdCAJsonParam, actions: CAActions): Promise<Result<DeviceIdCA>>;
    getCAKey(): DeviceIdKey;
    processCSR(csrJWS: string, addition: ClerkClaim): Promise<Result<IssueCertificateResult>>;
    caCertificate(): Promise<Result<CACertResult>>;
    issueCertificate(devId: FPDeviceIDCSRPayload): Promise<Result<IssueCertificateResult>>;
    buildCertificateExtensions(requestedExtensions: Extensions, subject: Subject, subjectPubKey: JWKPublic): Promise<{
        basicConstraints: {
            critical: boolean;
            cA: boolean;
            pathLenConstraint: null;
        };
        keyUsage: {
            critical: boolean;
            usage: ("cRLSign" | "dataEncipherment" | "decipherOnly" | "digitalSignature" | "encipherOnly" | "keyAgreement" | "keyCertSign" | "keyEncipherment" | "nonRepudiation")[];
        };
        extendedKeyUsage: {
            critical: boolean;
            usage: ("OCSPSigning" | "clientAuth" | "codeSigning" | "emailProtection" | "ipsecIKE" | "msCTLSign" | "msCodeCom" | "msCodeInd" | "msEFS" | "serverAuth" | "timeStamping")[];
        };
        subjectAltName: {
            critical: boolean;
            names: string[];
        };
        authorityKeyIdentifier: {
            keyIdentifier: string;
        };
        subjectKeyIdentifier: {
            keyIdentifier: string;
        };
    }>;
}
export {};