/** A caller-supplied `trustedIssuers` value, resolved into something a guard
 *  can branch on without knowing what shape arrived. */
export interface NormalizedTrustAnchors {
    /** Usable anchors. ALWAYS an array, and always empty when `malformed`. */
    anchors: string[];
    /** True when the caller supplied a value that is not a usable anchor list.
     *  Distinct from an empty list: an empty list is a deliberate "no anchors",
     *  a malformed value is a configuration error that must not be read as
     *  either "no anchors" or "all anchors". */
    malformed: boolean;
    /** Why the value is unusable. Present iff `malformed`. */
    reason?: string;
}
/**
 * Normalize a caller-supplied trust-anchor list.
 *
 * `undefined` and `null` mean "no anchors configured", which is a legitimate
 * state that the gate then refuses to admit on without an explicit
 * `allowSelfSigned`. Anything that is not an array of non-empty strings is a
 * configuration error and is reported as malformed, never quietly coerced:
 * coercing it to `[]` would make a typo indistinguishable from a deliberate
 * empty list, and that is the same conflation this whole branch exists to
 * remove.
 *
 * Note on the string case specifically: a bare 64-character key string has a
 * numeric `.length`, so it passed the old `> 0` test, and the membership test
 * downstream was `String.prototype.includes`, i.e. SUBSTRING matching against
 * the issuer key. That is refused here too.
 */
export declare function normalizeTrustAnchors(value: unknown): NormalizedTrustAnchors;
//# sourceMappingURL=trust-anchors.d.ts.map