from __future__ import annotations

class RustlsConfigBuilder:
    """Accumulates TLS configuration, then builds immutable client/server configs."""

    def __init__(self) -> None: ...
    def add_root_certs_from_pem(self, pem_data: bytes) -> int: ...
    def add_root_cert_from_der(self, der_data: bytes) -> None: ...
    def set_client_cert_chain_pem(
        self,
        cert_pem: bytes,
        key_pem: bytes,
        password: bytes | None = None,
    ) -> None: ...
    def set_server_cert_chain_pem(
        self,
        cert_pem: bytes,
        key_pem: bytes,
        password: bytes | None = None,
    ) -> None: ...
    def set_alpn(self, protocols: list[bytes]) -> None: ...
    def set_min_version(self, version: int) -> None: ...
    def set_max_version(self, version: int) -> None: ...
    def set_cipher_suites(self, suites: list[str]) -> None: ...
    def set_verify_mode(self, mode: int) -> None: ...
    def set_check_hostname(self, check: bool) -> None: ...
    def set_sni_enabled(self, enabled: bool) -> None: ...
    def set_keylog_filename(self, path: str) -> None: ...
    def set_ech_configs(self, data: bytes) -> None: ...
    def has_ech(self) -> bool: ...
    def clone_builder(self) -> RustlsConfigBuilder: ...
    def root_cert_count(self) -> int: ...
    def get_root_certs_der(self) -> list[bytes]: ...
    def build_client_connection(self, server_name: str) -> RustlsClientConnection: ...
    def build_server_connection(self) -> RustlsServerConnection: ...
    def set_verify_flags(self, flags: int) -> None: ...

class RustlsClientConnection:
    """Client-side TLS state machine. No network I/O."""

    def read_tls(self, data: bytes) -> int: ...
    def process_new_packets(self) -> None: ...
    def read_plaintext(self, max_len: int) -> bytes: ...
    def write_plaintext(self, data: bytes) -> int: ...
    def write_tls(self) -> bytes: ...
    def send_close_notify(self) -> None: ...
    def is_handshaking(self) -> bool: ...
    def wants_read(self) -> bool: ...
    def wants_write(self) -> bool: ...
    def peer_certificates(self) -> list[bytes] | None: ...
    def alpn_protocol(self) -> bytes | None: ...
    def protocol_version(self) -> int | None: ...
    def negotiated_cipher_suite(self) -> str | None: ...
    def negotiated_cipher_suite_bits(self) -> int | None: ...
    def ech_status(self) -> str: ...
    def decrypt_incoming(
        self, ciphertext: bytes, max_plaintext: int
    ) -> tuple[bytes, bytes]: ...

class RustlsServerConnection:
    """Server-side TLS state machine. No network I/O."""

    def read_tls(self, data: bytes) -> int: ...
    def process_new_packets(self) -> None: ...
    def read_plaintext(self, max_len: int) -> bytes: ...
    def write_plaintext(self, data: bytes) -> int: ...
    def write_tls(self) -> bytes: ...
    def send_close_notify(self) -> None: ...
    def is_handshaking(self) -> bool: ...
    def wants_read(self) -> bool: ...
    def wants_write(self) -> bool: ...
    def peer_certificates(self) -> list[bytes] | None: ...
    def alpn_protocol(self) -> bytes | None: ...
    def protocol_version(self) -> int | None: ...
    def negotiated_cipher_suite(self) -> str | None: ...
    def negotiated_cipher_suite_bits(self) -> int | None: ...
    def decrypt_incoming(
        self, ciphertext: bytes, max_plaintext: int
    ) -> tuple[bytes, bytes]: ...

def parse_certificate_dict(der_bytes: bytes) -> dict[str, object]: ...
def rustls_version() -> str: ...
def aws_lc_rs_version() -> str: ...
def rand_bytes(n: int) -> bytes: ...
