/**
 * Scoped TLS relaxation for `--insecure` / `skipSslVerify`.
 *
 * WHY THIS EXISTS
 * Disabling certificate verification used to be done by setting
 * `NODE_TLS_REJECT_UNAUTHORIZED = '0'` at start-up and leaving it set. That is
 * process-global and permanent: from the first LLM call onward, EVERY https
 * connection in the process was unverified — the update check, a git helper, any
 * later request — not just the endpoint the user opted out for. In the long-lived
 * `openlore mcp` daemon that meant the rest of the session.
 *
 * WHY IT IS DONE THIS WAY
 * Node's built-in `fetch` accepts no per-request TLS options, and an `Agent` from
 * the npm `undici` package is rejected by it (`UND_ERR_INVALID_ARG`) because the
 * built-in fetch is a separate undici instance. Verified on Node 25. So the env var
 * is still the only lever available without either adding `undici` as a dependency
 * AND switching these call sites to its `fetch` export, or rewriting them onto
 * `https.request`. Both are real options; see the note at the bottom.
 *
 * What changed is the LIFETIME. The variable is now set immediately before a
 * request and restored immediately after, which is safe because:
 *   - certificate verification happens during the TLS handshake, inside `fetch()`,
 *     so restoring once `fetch()` resolves does not affect an in-flight body — a
 *     streamed response continues to read fine afterwards, and
 *   - deleting the variable genuinely re-enables verification; Node does not cache
 *     the previous value.
 * Both behaviours are asserted in `tls-scope.test.ts` rather than assumed.
 *
 * REMAINING EXPOSURE, stated plainly: the variable is still process-global while a
 * scope is open. An unrelated https request that happens to be in flight during
 * that window is also unverified. The window is now one request rather than the
 * process lifetime, which is a large reduction but not elimination. Eliminating it
 * requires per-request TLS options, i.e. one of the two migrations above.
 */
/**
 * Record that the user opted out of TLS verification, and say so once.
 *
 * This deliberately does NOT disable anything by itself — it only grants
 * `withRelaxedTls` permission to relax verification around individual requests.
 *
 * `announce: false` is for callers that print their own (better) notice — the CLI
 * renders a colorized one and honours `--quiet`. Without that opt-out this would
 * both duplicate the message and write to stderr in quiet mode.
 */
export declare function allowInsecureTls(reason: string, opts?: {
    announce?: boolean;
}): void;
/** Whether the user has opted out of certificate verification. */
export declare function isInsecureTlsAllowed(): boolean;
/**
 * Run `fn` with certificate verification relaxed, if and only if the user opted in.
 *
 * Wrap the `await fetch(...)` itself — not the surrounding bookkeeping and not the
 * body read. That is the narrowest span that still covers the handshake.
 */
export declare function withRelaxedTls<T>(fn: () => Promise<T>): Promise<T>;
/** Test-only: clear module state between cases. */
export declare function resetTlsScopeForTests(): void;
//# sourceMappingURL=tls-scope.d.ts.map