/**
 * SHA-256 of the DER SubjectPublicKeyInfo of each compromised intermediate.
 * Identical to Node.js's kBlockedSPKIs (nodejs/node#66871) and Go's fix
 * (CVE-2026-111943). Each key was issued twice, under emSign Root TLS/CS CA -
 * G3 and under Sectigo's AAA Certificate Services, so hashing the key rather
 * than the certificate covers both.
 */
export declare const BLOCKED_SPKI_SHA256: ReadonlySet<string>;
export declare const BLOCKED_CERT_ERROR_CODE = "ERR_TLS_CERT_BLOCKED";
/** The subset of tls.PeerCertificate this check reads. */
export interface PeerCertificateLike {
    raw?: Uint8Array | undefined;
    fingerprint256?: string | undefined;
    issuer?: {
        CN?: string | string[] | undefined;
    } | undefined;
    issuerCertificate?: PeerCertificateLike | undefined;
}
export declare function isBlockedIssuerName(cn: string | string[] | undefined): boolean;
export declare function spkiSha256(raw: Uint8Array): string;
/**
 * Walks the peer chain (the full chain on Node.js, the leaf only on Bun) and
 * returns a description of the first blocked certificate, if any.
 */
export declare function findBlockedCertificate(cert: PeerCertificateLike): string | undefined;
/**
 * A tls checkServerIdentity replacement: rejects blocked chains, then runs
 * the runtime's normal hostname verification.
 */
export declare function checkServerIdentity(hostname: string, cert: PeerCertificateLike): Error | undefined;
/**
 * Installs the blocklist for this process. On Node.js, global fetch (undici)
 * and node:https read tls.checkServerIdentity when they connect. Bun's fetch
 * ignores it, so on Bun global fetch is wrapped to pass the check through
 * Bun's `tls` fetch option.
 */
export declare function installTlsBlocklist(): void;
export declare function isNodeVersionPatched(version: string): boolean;
export declare function isBunVersionPatched(version: string): boolean;
/**
 * Returns a warning when the current runtime does not block the compromised
 * eMudhra intermediates natively, or undefined when it does.
 */
export declare function unpatchedRuntimeWarning(versions?: {
    node?: string | undefined;
    bun?: string | undefined;
}): string | undefined;
//# sourceMappingURL=tls-blocklist.d.ts.map