export type OutboundTrustMode = 'bundled' | 'bundled+custom' | 'custom';
type FetchTlsOptions = Bun.TLSOptions & {
    checkServerIdentity?: NonNullable<import('node:tls').ConnectionOptions['checkServerIdentity']> | undefined;
};
type FetchInitWithTls = RequestInit & {
    tls?: FetchTlsOptions | undefined;
};
export interface OutboundTlsSnapshot {
    readonly mode: OutboundTrustMode;
    readonly allowInsecureLocalhost: boolean;
    readonly customCaFile?: string | undefined;
    readonly customCaDir?: string | undefined;
    readonly customCaEntryCount: number;
    readonly effectiveCaStrategy: 'bun-default' | 'bundled+custom' | 'custom';
    readonly errors: readonly string[];
}
export interface OutboundTlsConfigReader {
    get(path: string): unknown;
    getControlPlaneConfigDir(): string;
}
export declare function inspectOutboundTls(configManager: OutboundTlsConfigReader): OutboundTlsSnapshot;
export declare function applyOutboundTlsToFetchInit(input: RequestInfo | URL, init: RequestInit | undefined, configManager: OutboundTlsConfigReader): FetchInitWithTls;
export declare function createNetworkFetch(fetchImpl: typeof globalThis.fetch, configManager: OutboundTlsConfigReader): typeof globalThis.fetch;
export declare class GlobalNetworkTransportInstaller {
    private originalFetchRef;
    private configManager;
    setConfigManager(configManager: OutboundTlsConfigReader): void;
    install(configManager: OutboundTlsConfigReader): void;
}
export {};
//# sourceMappingURL=outbound.d.ts.map