export declare function buildBridgeTlsOptions(cert: Buffer): Record<string, unknown>;
/** Read the Bridge CA cert at `certPath`, verifying it matches the hash we
 *  pinned on first read. Throws if the bytes have changed since startup. */
export declare function readPinnedBridgeCert(certPath: string): Buffer;
export interface BridgeTlsConfig {
    /** TLS options to hand to imapflow / nodemailer. */
    tlsOptions: Record<string, unknown>;
    /** True when certificate validation was disabled (insecure fallback). */
    insecure: boolean;
    /** Messages for the caller to emit with its own logger + context. */
    logs: Array<{
        level: "info" | "warn";
        msg: string;
    }>;
}
/**
 * Resolve TLS options for a Proton Bridge connection from (host, cert path,
 * allow-insecure) — the single decision both the IMAP service `connect()` and
 * the settings connection-check need:
 *  - non-localhost          → standard validation (minVersion TLSv1.2);
 *  - localhost + cert       → pin the cert (buildBridgeTlsOptions);
 *  - localhost + cert fails  → throw UNLESS allowInsecure (then validation off);
 *  - localhost + no cert     → throw UNLESS allowInsecure (then validation off).
 * `insecure` reports whether validation was disabled; `logs` are returned (not
 * emitted) so the caller controls the logger/context. fs access (statSync for
 * dir→cert.pem resolution, readFileSync via readPinnedBridgeCert) keeps the
 * cert-pin TOCTOU protection.
 */
export declare function buildBridgeTlsConfig(host: string, bridgeCertPath: string | undefined, allowInsecure: boolean): BridgeTlsConfig;
/** Reset the pinned-hash table. Test-only. */
export declare function _resetBridgeCertPinsForTests(): void;
//# sourceMappingURL=bridge-tls.d.ts.map