@rio-cloud/cdk-v2-constructs 8.2.0 → 8.2.1-alpha.0

package/node_modules/@types/node/tls.d.ts

@@ -4,41 +4,42 @@
  * The module can be accessed using:
  *
  * ```js
- * const tls = require('node:tls');
+ * import tls from 'node:tls';
  * ```
- * @see [source](https://github.com/nodejs/node/blob/v20.2.0/lib/tls.js)
+ * @see [source](https://github.com/nodejs/node/blob/v24.x/lib/tls.js)
  */
 declare module "tls" {
+    import { NonSharedBuffer } from "node:buffer";
     import { X509Certificate } from "node:crypto";
     import * as net from "node:net";
     import * as stream from "stream";
     const CLIENT_RENEG_LIMIT: number;
     const CLIENT_RENEG_WINDOW: number;
-    interface Certificate {
+    interface Certificate extends NodeJS.Dict<string | string[]> {
         /**
          * Country code.
          */
-        C: string;
+        C?: string | string[];
         /**
          * Street.
          */
-        ST: string;
+        ST?: string | string[];
         /**
          * Locality.
          */
-        L: string;
+        L?: string | string[];
         /**
          * Organization.
          */
-        O: string;
+        O?: string | string[];
         /**
          * Organizational unit.
          */
-        OU: string;
+        OU?: string | string[];
         /**
          * Common name.
          */
-        CN: string;
+        CN?: string | string[];
     }
     interface PeerCertificate {
         /**
@@ -49,7 +50,7 @@ declare module "tls" {
         /**
          * The DER encoded X.509 certificate data.
          */
-        raw: Buffer;
+        raw: NonSharedBuffer;
         /**
          * The certificate subject.
          */
@@ -115,7 +116,7 @@ declare module "tls" {
         /**
          * The public key.
          */
-        pubkey?: Buffer;
+        pubkey?: NonSharedBuffer;
         /**
          * The ASN.1 name of the OID of the elliptic curve.
          * Well-known curves are identified by an OID.
@@ -125,7 +126,7 @@ declare module "tls" {
          */
         asn1Curve?: string;
         /**
-         * The NIST name for the elliptic curve,if it has one
+         * The NIST name for the elliptic curve, if it has one
          * (not all well-known curves have been assigned names by NIST).
          */
         nistCurve?: string;
@@ -199,12 +200,6 @@ declare module "tls" {
          * An optional Buffer instance containing a TLS session.
          */
         session?: Buffer | undefined;
-        /**
-         * If true, specifies that the OCSP status request extension will be
-         * added to the client hello and an 'OCSPResponse' event will be
-         * emitted on the socket before establishing a secure communication
-         */
-        requestOCSP?: boolean | undefined;
     }
     /**
      * Performs transparent encryption of written data and all required TLS
@@ -220,7 +215,7 @@ declare module "tls" {
         /**
          * Construct a new tls.TLSSocket object from an existing TCP socket.
          */
-        constructor(socket: net.Socket, options?: TLSSocketOptions);
+        constructor(socket: net.Socket | stream.Duplex, options?: TLSSocketOptions);
         /**
          * This property is `true` if the peer certificate was signed by one of the CAs
          * specified when creating the `tls.TLSSocket` instance, otherwise `false`.
@@ -244,6 +239,10 @@ declare module "tls" {
          * When a handshake is completed but not ALPN protocol was selected, tlsSocket.alpnProtocol equals false.
          */
         alpnProtocol: string | false | null;
+        /**
+         * String containing the server name requested via SNI (Server Name Indication) TLS extension.
+         */
+        servername: string | false | null;
         /**
          * Returns an object representing the local certificate. The returned object has
          * some properties corresponding to the fields of the certificate.
@@ -278,7 +277,7 @@ declare module "tls" {
          * an ephemeral key exchange in `perfect forward secrecy` on a client
          * connection. It returns an empty object when the key exchange is not
          * ephemeral. As this is only supported on a client socket; `null` is returned
-         * if called on a server socket. The supported types are `'DH'` and `'ECDH'`. The`name` property is available only when type is `'ECDH'`.
+         * if called on a server socket. The supported types are `'DH'` and `'ECDH'`. The `name` property is available only when type is `'ECDH'`.
          *
          * For example: `{ type: 'ECDH', name: 'prime256v1', size: 256 }`.
          * @since v5.0.0
@@ -295,7 +294,7 @@ declare module "tls" {
          * @since v9.9.0
          * @return The latest `Finished` message that has been sent to the socket as part of a SSL/TLS handshake, or `undefined` if no `Finished` message has been sent yet.
          */
-        getFinished(): Buffer | undefined;
+        getFinished(): NonSharedBuffer | undefined;
         /**
          * Returns an object representing the peer's certificate. If the peer does not
          * provide a certificate, an empty object will be returned. If the socket has been
@@ -322,7 +321,7 @@ declare module "tls" {
          * @return The latest `Finished` message that is expected or has actually been received from the socket as part of a SSL/TLS handshake, or `undefined` if there is no `Finished` message so
          * far.
          */
-        getPeerFinished(): Buffer | undefined;
+        getPeerFinished(): NonSharedBuffer | undefined;
         /**
          * Returns a string containing the negotiated SSL/TLS protocol version of the
          * current connection. The value `'unknown'` will be returned for connected
@@ -352,7 +351,7 @@ declare module "tls" {
          * must use the `'session'` event (it also works for TLSv1.2 and below).
          * @since v0.11.4
          */
-        getSession(): Buffer | undefined;
+        getSession(): NonSharedBuffer | undefined;
         /**
          * See [SSL\_get\_shared\_sigalgs](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_shared_sigalgs.html) for more information.
          * @since v12.11.0
@@ -367,7 +366,7 @@ declare module "tls" {
          * See `Session Resumption` for more information.
          * @since v0.11.4
          */
-        getTLSTicket(): Buffer | undefined;
+        getTLSTicket(): NonSharedBuffer | undefined;
         /**
          * See `Session Resumption` for more information.
          * @since v0.5.6
@@ -382,7 +381,7 @@ declare module "tls" {
          * This method can be used to request a peer's certificate after the secure
          * connection has been established.
          *
-         * When running as the server, the socket will be destroyed with an error after`handshakeTimeout` timeout.
+         * When running as the server, the socket will be destroyed with an error after `handshakeTimeout` timeout.
          *
          * For TLSv1.3, renegotiation cannot be initiated, it is not supported by the
          * protocol.
@@ -398,6 +397,14 @@ declare module "tls" {
             },
             callback: (err: Error | null) => void,
         ): undefined | boolean;
+        /**
+         * The `tlsSocket.setKeyCert()` method sets the private key and certificate to use for the socket.
+         * This is mainly useful if you wish to select a server certificate from a TLS server's `ALPNCallback`.
+         * @since v22.5.0, v20.17.0
+         * @param context An object containing at least `key` and `cert` properties from the {@link createSecureContext()} `options`,
+         * or a TLS context object created with {@link createSecureContext()} itself.
+         */
+        setKeyCert(context: SecureContextOptions | SecureContext): void;
         /**
          * The `tlsSocket.setMaxSendFragment()` method sets the maximum TLS fragment size.
          * Returns `true` if setting the limit succeeded; `false` otherwise.
@@ -470,37 +477,43 @@ declare module "tls" {
          * @param context Optionally provide a context.
          * @return requested bytes of the keying material
          */
-        exportKeyingMaterial(length: number, label: string, context: Buffer): Buffer;
+        exportKeyingMaterial(length: number, label: string, context: Buffer): NonSharedBuffer;
         addListener(event: string, listener: (...args: any[]) => void): this;
-        addListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
+        addListener(event: "OCSPResponse", listener: (response: NonSharedBuffer) => void): this;
+        addListener(event: "secure", listener: () => void): this;
         addListener(event: "secureConnect", listener: () => void): this;
-        addListener(event: "session", listener: (session: Buffer) => void): this;
-        addListener(event: "keylog", listener: (line: Buffer) => void): this;
+        addListener(event: "session", listener: (session: NonSharedBuffer) => void): this;
+        addListener(event: "keylog", listener: (line: NonSharedBuffer) => void): this;
         emit(event: string | symbol, ...args: any[]): boolean;
-        emit(event: "OCSPResponse", response: Buffer): boolean;
+        emit(event: "OCSPResponse", response: NonSharedBuffer): boolean;
+        emit(event: "secure"): boolean;
         emit(event: "secureConnect"): boolean;
-        emit(event: "session", session: Buffer): boolean;
-        emit(event: "keylog", line: Buffer): boolean;
+        emit(event: "session", session: NonSharedBuffer): boolean;
+        emit(event: "keylog", line: NonSharedBuffer): boolean;
         on(event: string, listener: (...args: any[]) => void): this;
-        on(event: "OCSPResponse", listener: (response: Buffer) => void): this;
+        on(event: "OCSPResponse", listener: (response: NonSharedBuffer) => void): this;
+        on(event: "secure", listener: () => void): this;
         on(event: "secureConnect", listener: () => void): this;
-        on(event: "session", listener: (session: Buffer) => void): this;
-        on(event: "keylog", listener: (line: Buffer) => void): this;
+        on(event: "session", listener: (session: NonSharedBuffer) => void): this;
+        on(event: "keylog", listener: (line: NonSharedBuffer) => void): this;
         once(event: string, listener: (...args: any[]) => void): this;
-        once(event: "OCSPResponse", listener: (response: Buffer) => void): this;
+        once(event: "OCSPResponse", listener: (response: NonSharedBuffer) => void): this;
+        once(event: "secure", listener: () => void): this;
         once(event: "secureConnect", listener: () => void): this;
-        once(event: "session", listener: (session: Buffer) => void): this;
-        once(event: "keylog", listener: (line: Buffer) => void): this;
+        once(event: "session", listener: (session: NonSharedBuffer) => void): this;
+        once(event: "keylog", listener: (line: NonSharedBuffer) => void): this;
         prependListener(event: string, listener: (...args: any[]) => void): this;
-        prependListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
+        prependListener(event: "OCSPResponse", listener: (response: NonSharedBuffer) => void): this;
+        prependListener(event: "secure", listener: () => void): this;
         prependListener(event: "secureConnect", listener: () => void): this;
-        prependListener(event: "session", listener: (session: Buffer) => void): this;
-        prependListener(event: "keylog", listener: (line: Buffer) => void): this;
+        prependListener(event: "session", listener: (session: NonSharedBuffer) => void): this;
+        prependListener(event: "keylog", listener: (line: NonSharedBuffer) => void): this;
         prependOnceListener(event: string, listener: (...args: any[]) => void): this;
-        prependOnceListener(event: "OCSPResponse", listener: (response: Buffer) => void): this;
+        prependOnceListener(event: "OCSPResponse", listener: (response: NonSharedBuffer) => void): this;
+        prependOnceListener(event: "secure", listener: () => void): this;
         prependOnceListener(event: "secureConnect", listener: () => void): this;
-        prependOnceListener(event: "session", listener: (session: Buffer) => void): this;
-        prependOnceListener(event: "keylog", listener: (line: Buffer) => void): this;
+        prependOnceListener(event: "session", listener: (session: NonSharedBuffer) => void): this;
+        prependOnceListener(event: "keylog", listener: (line: NonSharedBuffer) => void): this;
     }
     interface CommonConnectionOptions {
         /**
@@ -523,7 +536,7 @@ declare module "tls" {
          * An array of strings or a Buffer naming possible ALPN protocols.
          * (Protocols should be ordered by their priority.)
          */
-        ALPNProtocols?: string[] | Uint8Array[] | Uint8Array | undefined;
+        ALPNProtocols?: readonly string[] | NodeJS.ArrayBufferView | undefined;
         /**
          * SNICallback(servername, cb) <Function> A function that will be
          * called if the client supports SNI TLS extension. Two arguments
@@ -541,6 +554,12 @@ declare module "tls" {
          * @default true
          */
         rejectUnauthorized?: boolean | undefined;
+        /**
+         * If true, specifies that the OCSP status request extension will be
+         * added to the client hello and an 'OCSPResponse' event will be
+         * emitted on the socket before establishing a secure communication.
+         */
+        requestOCSP?: boolean | undefined;
     }
     interface TlsOptions extends SecureContextOptions, CommonConnectionOptions, net.ServerOpts {
         /**
@@ -578,7 +597,7 @@ declare module "tls" {
          * requires explicitly specifying a cipher suite with the `ciphers` option.
          * More information can be found in the RFC 4279.
          */
-        pskCallback?(socket: TLSSocket, identity: string): DataView | NodeJS.TypedArray | null;
+        pskCallback?: ((socket: TLSSocket, identity: string) => NodeJS.ArrayBufferView | null) | undefined;
         /**
          * hint to send to a client to help
          * with selecting the identity during TLS-PSK negotiation. Will be ignored
@@ -588,7 +607,7 @@ declare module "tls" {
         pskIdentityHint?: string | undefined;
     }
     interface PSKCallbackNegotation {
-        psk: DataView | NodeJS.TypedArray;
+        psk: NodeJS.ArrayBufferView;
         identity: string;
     }
     interface ConnectionOptions extends SecureContextOptions, CommonConnectionOptions {
@@ -619,7 +638,7 @@ declare module "tls" {
          * compatible with the selected cipher's digest.
          * `identity` must use UTF-8 encoding.
          */
-        pskCallback?(hint: string | null): PSKCallbackNegotation | null;
+        pskCallback?: ((hint: string | null) => PSKCallbackNegotation | null) | undefined;
     }
     /**
      * Accepts encrypted connections using TLS or SSL.
@@ -639,7 +658,7 @@ declare module "tls" {
          * @param context An object containing any of the possible properties from the {@link createSecureContext} `options` arguments (e.g. `key`, `cert`, `ca`, etc), or a TLS context object created
          * with {@link createSecureContext} itself.
          */
-        addContext(hostname: string, context: SecureContextOptions): void;
+        addContext(hostname: string, context: SecureContextOptions | SecureContext): void;
         /**
          * Returns the session ticket keys.
          *
@@ -647,7 +666,7 @@ declare module "tls" {
          * @since v3.0.0
          * @return A 48-byte buffer containing the session ticket keys.
          */
-        getTicketKeys(): Buffer;
+        getTicketKeys(): NonSharedBuffer;
         /**
          * The `server.setSecureContext()` method replaces the secure context of an
          * existing server. Existing connections to the server are not interrupted.
@@ -679,122 +698,138 @@ declare module "tls" {
         addListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
         addListener(
             event: "newSession",
-            listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void,
+            listener: (sessionId: NonSharedBuffer, sessionData: NonSharedBuffer, callback: () => void) => void,
         ): this;
         addListener(
             event: "OCSPRequest",
             listener: (
-                certificate: Buffer,
-                issuer: Buffer,
-                callback: (err: Error | null, resp: Buffer) => void,
+                certificate: NonSharedBuffer,
+                issuer: NonSharedBuffer,
+                callback: (err: Error | null, resp: Buffer | null) => void,
             ) => void,
         ): this;
         addListener(
             event: "resumeSession",
-            listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
+            listener: (
+                sessionId: NonSharedBuffer,
+                callback: (err: Error | null, sessionData: Buffer | null) => void,
+            ) => void,
         ): this;
         addListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
-        addListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
+        addListener(event: "keylog", listener: (line: NonSharedBuffer, tlsSocket: TLSSocket) => void): this;
         emit(event: string | symbol, ...args: any[]): boolean;
         emit(event: "tlsClientError", err: Error, tlsSocket: TLSSocket): boolean;
-        emit(event: "newSession", sessionId: Buffer, sessionData: Buffer, callback: () => void): boolean;
+        emit(
+            event: "newSession",
+            sessionId: NonSharedBuffer,
+            sessionData: NonSharedBuffer,
+            callback: () => void,
+        ): boolean;
         emit(
             event: "OCSPRequest",
-            certificate: Buffer,
-            issuer: Buffer,
-            callback: (err: Error | null, resp: Buffer) => void,
+            certificate: NonSharedBuffer,
+            issuer: NonSharedBuffer,
+            callback: (err: Error | null, resp: Buffer | null) => void,
         ): boolean;
         emit(
             event: "resumeSession",
-            sessionId: Buffer,
+            sessionId: NonSharedBuffer,
             callback: (err: Error | null, sessionData: Buffer | null) => void,
         ): boolean;
         emit(event: "secureConnection", tlsSocket: TLSSocket): boolean;
-        emit(event: "keylog", line: Buffer, tlsSocket: TLSSocket): boolean;
+        emit(event: "keylog", line: NonSharedBuffer, tlsSocket: TLSSocket): boolean;
         on(event: string, listener: (...args: any[]) => void): this;
         on(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
-        on(event: "newSession", listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void): this;
+        on(
+            event: "newSession",
+            listener: (sessionId: NonSharedBuffer, sessionData: NonSharedBuffer, callback: () => void) => void,
+        ): this;
         on(
             event: "OCSPRequest",
             listener: (
-                certificate: Buffer,
-                issuer: Buffer,
-                callback: (err: Error | null, resp: Buffer) => void,
+                certificate: NonSharedBuffer,
+                issuer: NonSharedBuffer,
+                callback: (err: Error | null, resp: Buffer | null) => void,
             ) => void,
         ): this;
         on(
             event: "resumeSession",
-            listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
+            listener: (
+                sessionId: NonSharedBuffer,
+                callback: (err: Error | null, sessionData: Buffer | null) => void,
+            ) => void,
         ): this;
         on(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
-        on(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
+        on(event: "keylog", listener: (line: NonSharedBuffer, tlsSocket: TLSSocket) => void): this;
         once(event: string, listener: (...args: any[]) => void): this;
         once(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
         once(
             event: "newSession",
-            listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void,
+            listener: (sessionId: NonSharedBuffer, sessionData: NonSharedBuffer, callback: () => void) => void,
         ): this;
         once(
             event: "OCSPRequest",
             listener: (
-                certificate: Buffer,
-                issuer: Buffer,
-                callback: (err: Error | null, resp: Buffer) => void,
+                certificate: NonSharedBuffer,
+                issuer: NonSharedBuffer,
+                callback: (err: Error | null, resp: Buffer | null) => void,
             ) => void,
         ): this;
         once(
             event: "resumeSession",
-            listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
+            listener: (
+                sessionId: NonSharedBuffer,
+                callback: (err: Error | null, sessionData: Buffer | null) => void,
+            ) => void,
         ): this;
         once(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
-        once(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
+        once(event: "keylog", listener: (line: NonSharedBuffer, tlsSocket: TLSSocket) => void): this;
         prependListener(event: string, listener: (...args: any[]) => void): this;
         prependListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
         prependListener(
             event: "newSession",
-            listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void,
+            listener: (sessionId: NonSharedBuffer, sessionData: NonSharedBuffer, callback: () => void) => void,
         ): this;
         prependListener(
             event: "OCSPRequest",
             listener: (
-                certificate: Buffer,
-                issuer: Buffer,
-                callback: (err: Error | null, resp: Buffer) => void,
+                certificate: NonSharedBuffer,
+                issuer: NonSharedBuffer,
+                callback: (err: Error | null, resp: Buffer | null) => void,
             ) => void,
         ): this;
         prependListener(
             event: "resumeSession",
-            listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
+            listener: (
+                sessionId: NonSharedBuffer,
+                callback: (err: Error | null, sessionData: Buffer | null) => void,
+            ) => void,
         ): this;
         prependListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
-        prependListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
+        prependListener(event: "keylog", listener: (line: NonSharedBuffer, tlsSocket: TLSSocket) => void): this;
         prependOnceListener(event: string, listener: (...args: any[]) => void): this;
         prependOnceListener(event: "tlsClientError", listener: (err: Error, tlsSocket: TLSSocket) => void): this;
         prependOnceListener(
             event: "newSession",
-            listener: (sessionId: Buffer, sessionData: Buffer, callback: () => void) => void,
+            listener: (sessionId: NonSharedBuffer, sessionData: NonSharedBuffer, callback: () => void) => void,
         ): this;
         prependOnceListener(
             event: "OCSPRequest",
             listener: (
-                certificate: Buffer,
-                issuer: Buffer,
-                callback: (err: Error | null, resp: Buffer) => void,
+                certificate: NonSharedBuffer,
+                issuer: NonSharedBuffer,
+                callback: (err: Error | null, resp: Buffer | null) => void,
             ) => void,
         ): this;
         prependOnceListener(
             event: "resumeSession",
-            listener: (sessionId: Buffer, callback: (err: Error | null, sessionData: Buffer | null) => void) => void,
+            listener: (
+                sessionId: NonSharedBuffer,
+                callback: (err: Error | null, sessionData: Buffer | null) => void,
+            ) => void,
         ): this;
         prependOnceListener(event: "secureConnection", listener: (tlsSocket: TLSSocket) => void): this;
-        prependOnceListener(event: "keylog", listener: (line: Buffer, tlsSocket: TLSSocket) => void): this;
-    }
-    /**
-     * @deprecated since v0.11.3 Use `tls.TLSSocket` instead.
-     */
-    interface SecurePair {
-        encrypted: TLSSocket;
-        cleartext: TLSSocket;
+        prependOnceListener(event: "keylog", listener: (line: NonSharedBuffer, tlsSocket: TLSSocket) => void): this;
     }
     type SecureVersion = "TLSv1.3" | "TLSv1.2" | "TLSv1.1" | "TLSv1";
     interface SecureContextOptions {
@@ -809,6 +844,12 @@ declare module "tls" {
          * This option cannot be used with the `ALPNProtocols` option, and setting both options will throw an error.
          */
         ALPNCallback?: ((arg: { servername: string; protocols: string[] }) => string | undefined) | undefined;
+        /**
+         * Treat intermediate (non-self-signed)
+         * certificates in the trust CA certificate list as trusted.
+         * @since v22.9.0, v20.18.0
+         */
+        allowPartialTrustChain?: boolean | undefined;
         /**
          * Optionally override the trusted CA certificates. Default is to trust
          * the well-known CAs curated by Mozilla. Mozilla's CAs are completely
@@ -843,6 +884,7 @@ declare module "tls" {
         ciphers?: string | undefined;
         /**
          * Name of an OpenSSL engine which can provide the client certificate.
+         * @deprecated
          */
         clientCertEngine?: string | undefined;
         /**
@@ -885,12 +927,14 @@ declare module "tls" {
         /**
          * Name of an OpenSSL engine to get private key from. Should be used
          * together with privateKeyIdentifier.
+         * @deprecated
          */
         privateKeyEngine?: string | undefined;
         /**
          * Identifier of a private key managed by an OpenSSL engine. Should be
          * used together with privateKeyEngine. Should not be set together with
          * key, because both options define a private key in different ways.
+         * @deprecated
          */
         privateKeyIdentifier?: string | undefined;
         /**
@@ -975,7 +1019,7 @@ declare module "tls" {
      * This function is intended to be used in combination with the`checkServerIdentity` option that can be passed to {@link connect} and as
      * such operates on a `certificate object`. For other purposes, consider using `x509.checkHost()` instead.
      *
-     * This function can be overwritten by providing an alternative function as the`options.checkServerIdentity` option that is passed to `tls.connect()`. The
+     * This function can be overwritten by providing an alternative function as the `options.checkServerIdentity` option that is passed to `tls.connect()`. The
      * overwriting function can call `tls.checkServerIdentity()` of course, to augment
      * the checks done with additional verification.
      *
@@ -984,7 +1028,7 @@ declare module "tls" {
      *
      * Earlier versions of Node.js incorrectly accepted certificates for a given`hostname` if a matching `uniformResourceIdentifier` subject alternative name
      * was present (see [CVE-2021-44531](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531)). Applications that wish to accept`uniformResourceIdentifier` subject alternative names can use
-     * a custom`options.checkServerIdentity` function that implements the desired behavior.
+     * a custom `options.checkServerIdentity` function that implements the desired behavior.
      * @since v0.8.4
      * @param hostname The host name or IP address to verify the certificate against.
      * @param cert A `certificate object` representing the peer's certificate.
@@ -1000,8 +1044,8 @@ declare module "tls" {
      * The following illustrates a simple echo server:
      *
      * ```js
-     * const tls = require('node:tls');
-     * const fs = require('node:fs');
+     * import tls from 'node:tls';
+     * import fs from 'node:fs';
      *
      * const options = {
      *   key: fs.readFileSync('server-key.pem'),
@@ -1046,8 +1090,8 @@ declare module "tls" {
      *
      * ```js
      * // Assumes an echo server that is listening on port 8000.
-     * const tls = require('node:tls');
-     * const fs = require('node:fs');
+     * import tls from 'node:tls';
+     * import fs from 'node:fs';
      *
      * const options = {
      *   // Necessary only if the server requires client certificate authentication.
@@ -1086,49 +1130,10 @@ declare module "tls" {
     ): TLSSocket;
     function connect(port: number, options?: ConnectionOptions, secureConnectListener?: () => void): TLSSocket;
     /**
-     * Creates a new secure pair object with two streams, one of which reads and writes
-     * the encrypted data and the other of which reads and writes the cleartext data.
-     * Generally, the encrypted stream is piped to/from an incoming encrypted data
-     * stream and the cleartext one is used as a replacement for the initial encrypted
-     * stream.
-     *
-     * `tls.createSecurePair()` returns a `tls.SecurePair` object with `cleartext` and`encrypted` stream properties.
-     *
-     * Using `cleartext` has the same API as {@link TLSSocket}.
-     *
-     * The `tls.createSecurePair()` method is now deprecated in favor of`tls.TLSSocket()`. For example, the code:
-     *
-     * ```js
-     * pair = tls.createSecurePair(// ... );
-     * pair.encrypted.pipe(socket);
-     * socket.pipe(pair.encrypted);
-     * ```
-     *
-     * can be replaced by:
-     *
-     * ```js
-     * secureSocket = tls.TLSSocket(socket, options);
-     * ```
-     *
-     * where `secureSocket` has the same API as `pair.cleartext`.
-     * @since v0.3.2
-     * @deprecated Since v0.11.3 - Use {@link TLSSocket} instead.
-     * @param context A secure context object as returned by `tls.createSecureContext()`
-     * @param isServer `true` to specify that this TLS connection should be opened as a server.
-     * @param requestCert `true` to specify whether a server should request a certificate from a connecting client. Only applies when `isServer` is `true`.
-     * @param rejectUnauthorized If not `false` a server automatically reject clients with invalid certificates. Only applies when `isServer` is `true`.
-     */
-    function createSecurePair(
-        context?: SecureContext,
-        isServer?: boolean,
-        requestCert?: boolean,
-        rejectUnauthorized?: boolean,
-    ): SecurePair;
-    /**
-     * {@link createServer} sets the default value of the `honorCipherOrder` option
+     * `{@link createServer}` sets the default value of the `honorCipherOrder` option
      * to `true`, other APIs that create secure contexts leave it unset.
      *
-     * {@link createServer} uses a 128 bit truncated SHA1 hash value generated
+     * `{@link createServer}` uses a 128 bit truncated SHA1 hash value generated
      * from `process.argv` as the default value of the `sessionIdContext` option, other
      * APIs that create secure contexts have no default value.
      *
@@ -1136,12 +1141,12 @@ declare module "tls" {
      * usable as an argument to several `tls` APIs, such as `server.addContext()`,
      * but has no public methods. The {@link Server} constructor and the {@link createServer} method do not support the `secureContext` option.
      *
-     * A key is _required_ for ciphers that use certificates. Either `key` or`pfx` can be used to provide it.
+     * A key is _required_ for ciphers that use certificates. Either `key` or `pfx` can be used to provide it.
      *
      * If the `ca` option is not given, then Node.js will default to using [Mozilla's publicly trusted list of
      * CAs](https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt).
      *
-     * Custom DHE parameters are discouraged in favor of the new `dhparam: 'auto'`option. When set to `'auto'`, well-known DHE parameters of sufficient strength
+     * Custom DHE parameters are discouraged in favor of the new `dhparam: 'auto' `option. When set to `'auto'`, well-known DHE parameters of sufficient strength
      * will be selected automatically. Otherwise, if necessary, `openssl dhparam` can
      * be used to create custom parameters. The key length must be greater than or
      * equal to 1024 bits or else an error will be thrown. Although 1024 bits is
@@ -1149,12 +1154,38 @@ declare module "tls" {
      * @since v0.11.13
      */
     function createSecureContext(options?: SecureContextOptions): SecureContext;
+    /**
+     * Returns an array containing the CA certificates from various sources, depending on `type`:
+     *
+     * * `"default"`: return the CA certificates that will be used by the Node.js TLS clients by default.
+     *   * When `--use-bundled-ca` is enabled (default), or `--use-openssl-ca` is not enabled,
+     *     this would include CA certificates from the bundled Mozilla CA store.
+     *   * When `--use-system-ca` is enabled, this would also include certificates from the system's
+     *     trusted store.
+     *   * When `NODE_EXTRA_CA_CERTS` is used, this would also include certificates loaded from the specified
+     *     file.
+     * * `"system"`: return the CA certificates that are loaded from the system's trusted store, according
+     *   to rules set by `--use-system-ca`. This can be used to get the certificates from the system
+     *   when `--use-system-ca` is not enabled.
+     * * `"bundled"`: return the CA certificates from the bundled Mozilla CA store. This would be the same
+     *   as `tls.rootCertificates`.
+     * * `"extra"`: return the CA certificates loaded from `NODE_EXTRA_CA_CERTS`. It's an empty array if
+     *   `NODE_EXTRA_CA_CERTS` is not set.
+     * @since v22.15.0
+     * @param type The type of CA certificates that will be returned. Valid values
+     * are `"default"`, `"system"`, `"bundled"` and `"extra"`.
+     * **Default:** `"default"`.
+     * @returns An array of PEM-encoded certificates. The array may contain duplicates
+     * if the same certificate is repeatedly stored in multiple sources.
+     */
+    function getCACertificates(type?: "default" | "system" | "bundled" | "extra"): string[];
     /**
      * Returns an array with the names of the supported TLS ciphers. The names are
      * lower-case for historical reasons, but must be uppercased to be used in
-     * the `ciphers` option of {@link createSecureContext}.
+     * the `ciphers` option of `{@link createSecureContext}`.
      *
-     * Not all supported ciphers are enabled by default. See `Modifying the default TLS cipher suite`.
+     * Not all supported ciphers are enabled by default. See
+     * [Modifying the default TLS cipher suite](https://nodejs.org/docs/latest-v24.x/api/tls.html#modifying-the-default-tls-cipher-suite).
      *
      * Cipher names that start with `'tls_'` are for TLSv1.3, all the others are for
      * TLSv1.2 and below.
@@ -1165,43 +1196,81 @@ declare module "tls" {
      * @since v0.10.2
      */
     function getCiphers(): string[];
+    /**
+     * Sets the default CA certificates used by Node.js TLS clients. If the provided
+     * certificates are parsed successfully, they will become the default CA
+     * certificate list returned by {@link getCACertificates} and used
+     * by subsequent TLS connections that don't specify their own CA certificates.
+     * The certificates will be deduplicated before being set as the default.
+     *
+     * This function only affects the current Node.js thread. Previous
+     * sessions cached by the HTTPS agent won't be affected by this change, so
+     * this method should be called before any unwanted cachable TLS connections are
+     * made.
+     *
+     * To use system CA certificates as the default:
+     *
+     * ```js
+     * import tls from 'node:tls';
+     * tls.setDefaultCACertificates(tls.getCACertificates('system'));
+     * ```
+     *
+     * This function completely replaces the default CA certificate list. To add additional
+     * certificates to the existing defaults, get the current certificates and append to them:
+     *
+     * ```js
+     * import tls from 'node:tls';
+     * const currentCerts = tls.getCACertificates('default');
+     * const additionalCerts = ['-----BEGIN CERTIFICATE-----\n...'];
+     * tls.setDefaultCACertificates([...currentCerts, ...additionalCerts]);
+     * ```
+     * @since v24.5.0
+     * @param certs An array of CA certificates in PEM format.
+     */
+    function setDefaultCACertificates(certs: ReadonlyArray<string | NodeJS.ArrayBufferView>): void;
     /**
      * The default curve name to use for ECDH key agreement in a tls server.
-     * The default value is 'auto'. See tls.createSecureContext() for further
+     * The default value is `'auto'`. See `{@link createSecureContext()}` for further
      * information.
+     * @since v0.11.13
      */
     let DEFAULT_ECDH_CURVE: string;
     /**
-     * The default value of the maxVersion option of
-     * tls.createSecureContext(). It can be assigned any of the supported TLS
-     * protocol versions, 'TLSv1.3', 'TLSv1.2', 'TLSv1.1', or 'TLSv1'. Default:
-     * 'TLSv1.3', unless changed using CLI options. Using --tls-max-v1.2 sets
-     * the default to 'TLSv1.2'. Using --tls-max-v1.3 sets the default to
-     * 'TLSv1.3'. If multiple of the options are provided, the highest maximum
-     * is used.
+     * The default value of the `maxVersion` option of `{@link createSecureContext()}`.
+     * It can be assigned any of the supported TLS protocol versions,
+     * `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. **Default:** `'TLSv1.3'`, unless
+     * changed using CLI options. Using `--tls-max-v1.2` sets the default to `'TLSv1.2'`. Using
+     * `--tls-max-v1.3` sets the default to `'TLSv1.3'`. If multiple of the options
+     * are provided, the highest maximum is used.
+     * @since v11.4.0
      */
     let DEFAULT_MAX_VERSION: SecureVersion;
     /**
-     * The default value of the minVersion option of tls.createSecureContext().
+     * The default value of the `minVersion` option of `{@link createSecureContext()}`.
      * It can be assigned any of the supported TLS protocol versions,
-     * 'TLSv1.3', 'TLSv1.2', 'TLSv1.1', or 'TLSv1'. Default: 'TLSv1.2', unless
-     * changed using CLI options. Using --tls-min-v1.0 sets the default to
-     * 'TLSv1'. Using --tls-min-v1.1 sets the default to 'TLSv1.1'. Using
-     * --tls-min-v1.3 sets the default to 'TLSv1.3'. If multiple of the options
+     * `'TLSv1.3'`, `'TLSv1.2'`, `'TLSv1.1'`, or `'TLSv1'`. **Default:** `'TLSv1.2'`, unless
+     * changed using CLI options. Using `--tls-min-v1.0` sets the default to
+     * `'TLSv1'`. Using `--tls-min-v1.1` sets the default to `'TLSv1.1'`. Using
+     * `--tls-min-v1.3` sets the default to `'TLSv1.3'`. If multiple of the options
      * are provided, the lowest minimum is used.
+     * @since v11.4.0
      */
     let DEFAULT_MIN_VERSION: SecureVersion;
     /**
-     * The default value of the ciphers option of tls.createSecureContext().
+     * The default value of the `ciphers` option of `{@link createSecureContext()}`.
      * It can be assigned any of the supported OpenSSL ciphers.
-     * Defaults to the content of crypto.constants.defaultCoreCipherList, unless
-     * changed using CLI options using --tls-default-ciphers.
+     * Defaults to the content of `crypto.constants.defaultCoreCipherList`, unless
+     * changed using CLI options using `--tls-default-ciphers`.
+     * @since v19.8.0
      */
     let DEFAULT_CIPHERS: string;
     /**
-     * An immutable array of strings representing the root certificates (in PEM
-     * format) used for verifying peer certificates. This is the default value
-     * of the ca option to tls.createSecureContext().
+     * An immutable array of strings representing the root certificates (in PEM format)
+     * from the bundled Mozilla CA store as supplied by the current Node.js version.
+     *
+     * The bundled CA store, as supplied by Node.js, is a snapshot of Mozilla CA store
+     * that is fixed at release time. It is identical on all supported platforms.
+     * @since v12.3.0
      */
     const rootCertificates: readonly string[];
 }