/**
 * If `pathname` is an ACME http-01 challenge request, return the token's
 * key-authorization contents from `<webroot>/<token>`; otherwise (or on any
 * unsafe/missing token) return `null` so the caller falls through to its normal
 * handling.
 *
 * The token must be a single path segment of ACME's `base64url` alphabet — this
 * never rejects a real Let's Encrypt token, but refuses slashes, `..`, and other
 * traversal so a crafted request can't read outside the challenge directory.
 */
export declare function readAcmeChallenge(webroot: string, pathname: string): string | null;
/** The fixed request prefix Let's Encrypt fetches an http-01 token from. */
export declare const ACME_CHALLENGE_PREFIX: '/.well-known/acme-challenge/';