/**
 * Types for the njs SAN extractor so `tsc --noEmit` resolves `import certsub from './getCertSub.js'`
 * without `allowJs`. The runtime module is plain njs-compatible ECMAScript (getCertSub.js).
 */

/** The nginx request object surface `getCertSub` touches (only `variables.ssl_client_cert`). */
export interface NjsRequestLike {
  readonly variables: { readonly ssl_client_cert?: string }
}

export interface GetCertSubModule {
  /**
   * Leftmost label of the first dNSName SAN in a PEM client cert (e.g. 'alice.terminal…' → 'alice').
   * Returns '' on ANY parse failure / missing SAN / missing dNSName (fail-closed → the nginx map denies).
   */
  extractLeftmostDnsLabel(pemClientCert: string): string
  /** njs `js_set` entrypoint: reads `r.variables.ssl_client_cert` and delegates to the extractor. */
  getCertSub(r: NjsRequestLike): string
}

declare const mod: GetCertSubModule
export default mod