import * as tls from 'node:tls';
export declare const constants: {
    SSL_EXT_TLS_ONLY: number;
    SSL_EXT_DTLS_ONLY: number;
    SSL_EXT_TLS_IMPLEMENTATION_ONLY: number;
    SSL_EXT_SSL3_ALLOWED: number;
    SSL_EXT_TLS1_2_AND_BELOW_ONLY: number;
    SSL_EXT_TLS1_3_ONLY: number;
    SSL_EXT_IGNORE_ON_RESUMPTION: number;
    SSL_EXT_CLIENT_HELLO: number;
    SSL_EXT_TLS1_2_SERVER_HELLO: number;
    SSL_EXT_TLS1_3_SERVER_HELLO: number;
    SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS: number;
    SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST: number;
    SSL_EXT_TLS1_3_CERTIFICATE: number;
    SSL_EXT_TLS1_3_NEW_SESSION_TICKET: number;
    SSL_EXT_TLS1_3_CERTIFICATE_REQUEST: number;
    TLSEXT_comp_cert_zlib: number;
    TLSEXT_comp_cert_brotli: number;
    TLSEXT_comp_cert_zstd: number;
};
/**
 * Add a custom TLS extension to a SecureContext.
 * Only works for extensions not predefined by OpenSSL.
 */
export declare function addCustomExtension(ctx: tls.SecureContext, options: {
    extensionType: number;
    context: number;
    data: Buffer;
}): void;
/**
 * Check if an extension type is predefined by OpenSSL
 * (and therefore cannot be added as a custom extension).
 */
export declare function isPredefinedExtension(extType: number): boolean;
/**
 * Whether node::crypto::GetSSLCtx resolved on this runtime (Node >= 24.15).
 */
export declare function getSSLCtxAvailable(): boolean;
/**
 * Enable certificate compression on a SecureContext.
 * Causes the compress_certificate extension (27) to be sent.
 *
 * Note: Requires OpenSSL to be built with compression support.
 * May throw if the compression algorithms are not available.
 *
 * @param algorithms - Array of compression algorithm IDs in preference order.
 *   Use constants: TLSEXT_comp_cert_zlib (1), TLSEXT_comp_cert_brotli (2), TLSEXT_comp_cert_zstd (3)
 */
export declare function enableCompressCertificate(ctx: tls.SecureContext, algorithms: number[]): void;
/**
 * Enable post-handshake authentication on a SecureContext.
 * Causes the post_handshake_auth extension (49) to be sent in ClientHello.
 */
export declare function enablePostHandshakeAuth(ctx: tls.SecureContext): void;
/**
 * Set the TLS 1.3 ciphersuite list and order (SSL_CTX_set_ciphersuites).
 * Node's `ciphers` option cannot control the TLS 1.3 order independently of
 * the TLS 1.2 cipher list, so this is set directly on the SecureContext.
 */
export declare function setCiphersuites(ctx: tls.SecureContext, ciphersuites: string): void;
/**
 * Return the IANA cipher-suite ids actually configured on the context. Ciphers
 * requested but not compiled into this OpenSSL build (e.g. 3DES) are silently
 * dropped, so this reveals which requested ciphers survived.
 */
export declare function getCiphers(ctx: tls.SecureContext): number[];
/**
 * Set SSL_CTX options. Uses SSL_CTX_set_options which ORs the provided
 * flags with existing options.
 */
export declare function setOptions(ctx: tls.SecureContext, options: number): void;
/**
 * Clear SSL_CTX options.
 */
export declare function clearOptions(ctx: tls.SecureContext, options: number): void;
export declare function setSecurityLevel(ctx: tls.SecureContext, level: number): void;
export declare function getSecurityLevel(ctx: tls.SecureContext): number;
/**
 * Install a security callback that keeps SHA-1 signature algorithms in the
 * advertised ClientHello (preserving the fingerprint) while delegating every
 * other security decision - including the peer's certificate and signature
 * checks - to OpenSSL's default policy at the context's current security level.
 * This is how 'secure' mode reproduces a SHA-1-bearing fingerprint without
 * relaxing what the handshake accepts from the server.
 */
export declare function installSecureSigalgCallback(ctx: tls.SecureContext): void;
//# sourceMappingURL=native.d.ts.map