import { TargetValueType } from './internal/assertion-grammar.js';
import type { SignatureAlgorithmValue, TlsVersionValue } from './ssl-assertion.js';
export declare const certificateGrammar: {
    /** Days until the certificate expires (numeric). */
    readonly daysUntilExpiry: {
        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
    };
    /** Certificate key size in bits (numeric). */
    readonly keySizeBits: {
        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
    };
    /** Certificate subject common name (free-form string). */
    readonly subjectCN: {
        readonly operators: readonly ["equals", "notEquals", "contains", "notContains"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** Certificate issuer common name (free-form string). */
    readonly issuerCN: {
        readonly operators: readonly ["equals", "notEquals", "contains", "notContains"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** Certificate serial number — an opaque identifier, compared whole. */
    readonly serialNumber: {
        readonly operators: readonly ["equals", "notEquals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** Certificate SHA-256 fingerprint — an opaque identifier, compared whole. */
    readonly fingerprintSha256: {
        readonly operators: readonly ["equals", "notEquals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** Issuer SHA-256 fingerprint — an opaque identifier, compared whole. */
    readonly issuerFingerprintSha256: {
        readonly operators: readonly ["equals", "notEquals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** Certificate public key algorithm (e.g. `'RSA'`, `'ECDSA'`), compared whole. */
    readonly keyAlgorithm: {
        readonly operators: readonly ["equals", "notEquals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** Certificate signature algorithm — a Go `x509 SignatureAlgorithm.String()` value. */
    readonly signatureAlgorithm: {
        readonly operators: readonly ["equals", "notEquals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<SignatureAlgorithmValue>;
    };
    /** Certificate subject alternative names. A list, so only membership can be asserted. */
    readonly sans: {
        readonly operators: readonly ["contains", "notContains"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** Whether the certificate is self-signed (boolean). */
    readonly selfSigned: {
        readonly operators: readonly ["equals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
    };
    /** Whether the certificate is a CA certificate (boolean). */
    readonly isCA: {
        readonly operators: readonly ["equals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
    };
};
export declare const connectionGrammar: {
    /** Negotiated TLS version. Ordered, so `greaterThan` expresses a minimum. */
    readonly tlsVersion: {
        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<TlsVersionValue>;
    };
    /** Negotiated cipher suite (free-form string; hundreds of IANA names). */
    readonly cipherSuite: {
        readonly operators: readonly ["equals", "notEquals", "contains", "notContains"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** Whether the hostname is verified against the certificate (boolean). */
    readonly hostnameVerified: {
        readonly operators: readonly ["equals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
    };
    /** Whether the certificate chain is trusted (boolean). */
    readonly chainTrusted: {
        readonly operators: readonly ["equals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
    };
    /** Whether a stapled OCSP response was provided during the handshake (boolean). */
    readonly ocspStapled: {
        readonly operators: readonly ["equals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
    };
    /** OCSP revocation status (e.g. `'good'`, `'revoked'`), compared whole. */
    readonly ocspStatus: {
        readonly operators: readonly ["equals", "notEquals"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
    /** The IP address the hostname resolved to (free-form string). */
    readonly resolvedIp: {
        readonly operators: readonly ["equals", "notEquals", "contains", "notContains"];
        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
    };
};
/**
 * The wire comparisons each property of a source accepts, keyed by property name. Empty for
 * a source with no property-scoped grammar. Used by validation to reject an unsupported
 * comparison written as an object literal.
 */
export declare function sslComparisonsForSource(source: string): Record<string, Record<string, true>>;
/**
 * How the target of a property-scoped SSL assertion is written, or `undefined` for a
 * property the backend does not define. Callers must handle the unknown case: object
 * literals bypass the builder's compile-time check and are reported by
 * `validateSslAssertion` instead.
 */
export declare function sslPropertyValueType(source: string, property: string): TargetValueType | undefined;
/**
 * Whether a target is one this CLI treats as a number.
 *
 * Validation and codegen must agree: anything validation accepts, codegen has to render as
 * a bare numeric literal, because the property's operators take a `number` and a quoted
 * target would not compile. Targets are plain strings on the wire and reach here from object
 * literals and remote monitors, so this is a runtime predicate rather than a type.
 */
export declare function isSslNumericTarget(target: string): boolean;