/**
 * Build the additive set of trusted CA certificates:
 *   (a) Node's bundled root certificates (always),
 *   (b) an explicit PEM bundle from the first configured source (always, when set),
 *   (c) the OS trust store, ONLY when explicitly opted in.
 *
 * Never throws: every source that fails is warned-once and skipped, and the
 * bundled defaults are always retained.
 */
export declare function resolveTrustedCAs(): string[];
/**
 * Install the resolved CA set on the global HTTPS agent and return it so the
 * caller can thread the same trust set into other dispatchers (e.g. undici).
 * Warns once if `NODE_TLS_REJECT_UNAUTHORIZED=0` is set, since that disables
 * verification globally and defeats the purpose of trusting a specific CA.
 */
export declare function configureGlobalTLS(): string[];
//# sourceMappingURL=tls-ca.d.ts.map