// Generated by Lisette bindgen
// Source: crypto/tls (Go stdlib)
// Go: 1.25.10
// Lisette: 0.3.0

import "go:context"
import "go:crypto"
import "go:crypto/x509"
import "go:io"
import "go:net"
import "go:time"

/// ClientAuthType declares the policy the server will follow for
/// TLS Client Authentication.
pub struct ClientAuthType(int)

pub const NoClientCert: ClientAuthType = 0

pub const RequestClientCert: ClientAuthType = 1

pub const RequireAndVerifyClientCert: ClientAuthType = 4

pub const RequireAnyClientCert: ClientAuthType = 2

pub const VerifyClientCertIfGiven: ClientAuthType = 3

/// CurveID is the type of a TLS identifier for a key exchange mechanism. See
/// https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8.
/// 
/// In TLS 1.2, this registry used to support only elliptic curves. In TLS 1.3,
/// it was extended to other groups and renamed NamedGroup. See RFC 8446, Section
/// 4.2.7. It was then also extended to other mechanisms, such as hybrid
/// post-quantum KEMs.
pub struct CurveID(uint16)

pub const CurveP256: CurveID = 23

pub const CurveP384: CurveID = 24

pub const CurveP521: CurveID = 25

pub const X25519: CurveID = 29

pub const X25519MLKEM768: CurveID = 4588

/// QUICEncryptionLevel represents a QUIC encryption level used to transmit
/// handshake messages.
pub struct QUICEncryptionLevel(int)

pub const QUICEncryptionLevelApplication: QUICEncryptionLevel = 3

pub const QUICEncryptionLevelEarly: QUICEncryptionLevel = 1

pub const QUICEncryptionLevelHandshake: QUICEncryptionLevel = 2

pub const QUICEncryptionLevelInitial: QUICEncryptionLevel = 0

/// A QUICEventKind is a type of operation on a QUIC connection.
pub struct QUICEventKind(int)

pub const QUICHandshakeDone: QUICEventKind = 7

pub const QUICNoEvent: QUICEventKind = 0

pub const QUICRejectedEarlyData: QUICEventKind = 6

pub const QUICResumeSession: QUICEventKind = 8

pub const QUICSetReadSecret: QUICEventKind = 1

pub const QUICSetWriteSecret: QUICEventKind = 2

pub const QUICStoreSession: QUICEventKind = 9

pub const QUICTransportParameters: QUICEventKind = 4

pub const QUICTransportParametersRequired: QUICEventKind = 5

pub const QUICWriteData: QUICEventKind = 3

/// RenegotiationSupport enumerates the different levels of support for TLS
/// renegotiation. TLS renegotiation is the act of performing subsequent
/// handshakes on a connection after the first. This significantly complicates
/// the state machine and has been the source of numerous, subtle security
/// issues. Initiating a renegotiation is not supported, but support for
/// accepting renegotiation requests may be enabled.
/// 
/// Even when enabled, the server may not change its identity between handshakes
/// (i.e. the leaf certificate must be the same). Additionally, concurrent
/// handshake and application data flow is not permitted so renegotiation can
/// only be used with protocols that synchronise with the renegotiation, such as
/// HTTPS.
/// 
/// Renegotiation is not defined in TLS 1.3.
pub struct RenegotiationSupport(int)

pub const RenegotiateFreelyAsClient: RenegotiationSupport = 2

pub const RenegotiateNever: RenegotiationSupport = 0

pub const RenegotiateOnceAsClient: RenegotiationSupport = 1

/// SignatureScheme identifies a signature algorithm supported by TLS. See
/// RFC 8446, Section 4.2.3.
pub struct SignatureScheme(uint16)

pub const ECDSAWithP256AndSHA256: SignatureScheme = 0x0403

pub const ECDSAWithP384AndSHA384: SignatureScheme = 0x0503

pub const ECDSAWithP521AndSHA512: SignatureScheme = 0x0603

pub const ECDSAWithSHA1: SignatureScheme = 0x0203

pub const Ed25519: SignatureScheme = 0x0807

pub const PKCS1WithSHA1: SignatureScheme = 0x0201

pub const PKCS1WithSHA256: SignatureScheme = 0x0401

pub const PKCS1WithSHA384: SignatureScheme = 0x0501

pub const PKCS1WithSHA512: SignatureScheme = 0x0601

pub const PSSWithSHA256: SignatureScheme = 0x0804

pub const PSSWithSHA384: SignatureScheme = 0x0805

pub const PSSWithSHA512: SignatureScheme = 0x0806

/// CipherSuiteName returns the standard name for the passed cipher suite ID
/// (e.g. "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"), or a fallback representation
/// of the ID value if the cipher suite is not implemented by this package.
pub fn CipherSuiteName(id: uint16) -> string

/// CipherSuites returns a list of cipher suites currently implemented by this
/// package, excluding those with security issues, which are returned by
/// [InsecureCipherSuites].
/// 
/// The list is sorted by ID. Note that the default cipher suites selected by
/// this package might depend on logic that can't be captured by a static list,
/// and might not match those returned by this function.
pub fn CipherSuites() -> Slice<Ref<CipherSuite>>

/// Client returns a new TLS client side connection
/// using conn as the underlying transport.
/// The config cannot be nil: users must set either ServerName or
/// InsecureSkipVerify in the config.
pub fn Client(conn: net.Conn, config: Ref<Config>) -> Ref<Conn>

/// Dial connects to the given network address using net.Dial
/// and then initiates a TLS handshake, returning the resulting
/// TLS connection.
/// Dial interprets a nil configuration as equivalent to
/// the zero configuration; see the documentation of Config
/// for the defaults.
pub fn Dial(network: string, addr: string, config: Ref<Config>) -> Result<Ref<Conn>, error>

/// DialWithDialer connects to the given network address using dialer.Dial and
/// then initiates a TLS handshake, returning the resulting TLS connection. Any
/// timeout or deadline given in the dialer apply to connection and TLS
/// handshake as a whole.
/// 
/// DialWithDialer interprets a nil configuration as equivalent to the zero
/// configuration; see the documentation of [Config] for the defaults.
/// 
/// DialWithDialer uses context.Background internally; to specify the context,
/// use [Dialer.DialContext] with NetDialer set to the desired dialer.
pub fn DialWithDialer(
  dialer: Ref<net.Dialer>,
  network: string,
  addr: string,
  config: Ref<Config>,
) -> Result<Ref<Conn>, error>

/// InsecureCipherSuites returns a list of cipher suites currently implemented by
/// this package and which have security issues.
/// 
/// Most applications should not use the cipher suites in this list, and should
/// only use those returned by [CipherSuites].
pub fn InsecureCipherSuites() -> Slice<Ref<CipherSuite>>

/// Listen creates a TLS listener accepting connections on the
/// given network address using net.Listen.
/// The configuration config must be non-nil and must include
/// at least one certificate or else set GetCertificate.
pub fn Listen(network: string, laddr: string, config: Ref<Config>) -> Result<net.Listener, error>

/// LoadX509KeyPair reads and parses a public/private key pair from a pair of
/// files. The files must contain PEM encoded data. The certificate file may
/// contain intermediate certificates following the leaf certificate to form a
/// certificate chain. On successful return, Certificate.Leaf will be populated.
/// 
/// Before Go 1.23 Certificate.Leaf was left nil, and the parsed certificate was
/// discarded. This behavior can be re-enabled by setting "x509keypairleaf=0"
/// in the GODEBUG environment variable.
pub fn LoadX509KeyPair(certFile: string, keyFile: string) -> Result<Certificate, error>

/// NewLRUClientSessionCache returns a [ClientSessionCache] with the given
/// capacity that uses an LRU strategy. If capacity is < 1, a default capacity
/// is used instead.
pub fn NewLRUClientSessionCache(capacity: int) -> ClientSessionCache

/// NewListener creates a Listener which accepts connections from an inner
/// Listener and wraps each connection with [Server].
/// The configuration config must be non-nil and must include
/// at least one certificate or else set GetCertificate.
pub fn NewListener(inner: net.Listener, config: Ref<Config>) -> net.Listener

/// NewResumptionState returns a state value that can be returned by
/// [ClientSessionCache.Get] to resume a previous session.
/// 
/// state needs to be returned by [ParseSessionState], and the ticket and session
/// state must have been returned by [ClientSessionState.ResumptionState].
pub fn NewResumptionState(ticket: Slice<byte>, state: Ref<SessionState>) -> Result<Ref<ClientSessionState>, error>

/// ParseSessionState parses a [SessionState] encoded by [SessionState.Bytes].
pub fn ParseSessionState(data: Slice<byte>) -> Result<Ref<SessionState>, error>

/// QUICClient returns a new TLS client side connection using QUICTransport as the
/// underlying transport. The config cannot be nil.
/// 
/// The config's MinVersion must be at least TLS 1.3.
pub fn QUICClient(config: Ref<QUICConfig>) -> Ref<QUICConn>

/// QUICServer returns a new TLS server side connection using QUICTransport as the
/// underlying transport. The config cannot be nil.
/// 
/// The config's MinVersion must be at least TLS 1.3.
pub fn QUICServer(config: Ref<QUICConfig>) -> Ref<QUICConn>

/// Server returns a new TLS server side connection
/// using conn as the underlying transport.
/// The configuration config must be non-nil and must include
/// at least one certificate or else set GetCertificate.
pub fn Server(conn: net.Conn, config: Ref<Config>) -> Ref<Conn>

/// VersionName returns the name for the provided TLS version number
/// (e.g. "TLS 1.3"), or a fallback representation of the value if the
/// version is not implemented by this package.
pub fn VersionName(version: uint16) -> string

/// X509KeyPair parses a public/private key pair from a pair of
/// PEM encoded data. On successful return, Certificate.Leaf will be populated.
/// 
/// Before Go 1.23 Certificate.Leaf was left nil, and the parsed certificate was
/// discarded. This behavior can be re-enabled by setting "x509keypairleaf=0"
/// in the GODEBUG environment variable.
pub fn X509KeyPair(certPEMBlock: Slice<byte>, keyPEMBlock: Slice<byte>) -> Result<Certificate, error>

/// An AlertError is a TLS alert.
/// 
/// When using a QUIC transport, QUICConn methods will return an error
/// which wraps AlertError rather than sending a TLS alert.
pub struct AlertError(uint8)

/// A Certificate is a chain of one or more certificates, leaf first.
pub struct Certificate {
  pub Certificate: Slice<Slice<byte>>,
  pub PrivateKey: crypto.PrivateKey,
  pub SupportedSignatureAlgorithms: Slice<SignatureScheme>,
  pub OCSPStaple: Slice<byte>,
  pub SignedCertificateTimestamps: Slice<Slice<byte>>,
  pub Leaf: Option<Ref<x509.Certificate>>,
}

/// CertificateRequestInfo contains information from a server's
/// CertificateRequest message, which is used to demand a certificate and proof
/// of control from a client.
pub struct CertificateRequestInfo {
  pub AcceptableCAs: Slice<Slice<byte>>,
  pub SignatureSchemes: Slice<SignatureScheme>,
  pub Version: uint16,
}

/// CertificateVerificationError is returned when certificate verification fails during the handshake.
pub struct CertificateVerificationError {
  pub UnverifiedCertificates: Slice<Option<Ref<x509.Certificate>>>,
  pub Err: error,
}

/// CipherSuite is a TLS cipher suite. Note that most functions in this package
/// accept and expose cipher suite IDs instead of this type.
pub struct CipherSuite {
  pub ID: uint16,
  pub Name: string,
  pub SupportedVersions: Slice<uint16>,
  pub Insecure: bool,
}

/// ClientHelloInfo contains information from a ClientHello message in order to
/// guide application logic in the GetCertificate and GetConfigForClient callbacks.
pub struct ClientHelloInfo {
  pub CipherSuites: Slice<uint16>,
  pub ServerName: string,
  pub SupportedCurves: Slice<CurveID>,
  pub SupportedPoints: Slice<uint8>,
  pub SignatureSchemes: Slice<SignatureScheme>,
  pub SupportedProtos: Slice<string>,
  pub SupportedVersions: Slice<uint16>,
  pub Extensions: Slice<uint16>,
  pub Conn: Option<net.Conn>,
}

/// ClientSessionCache is a cache of ClientSessionState objects that can be used
/// by a client to resume a TLS session with a given server. ClientSessionCache
/// implementations should expect to be called concurrently from different
/// goroutines. Up to TLS 1.2, only ticket-based resumption is supported, not
/// SessionID-based resumption. In TLS 1.3 they were merged into PSK modes, which
/// are supported via this interface.
pub interface ClientSessionCache {
  #[go(comma_ok)]
  fn Get(sessionKey: string) -> Option<Ref<ClientSessionState>>
  fn Put(sessionKey: string, cs: Ref<ClientSessionState>)
}

/// ClientSessionState contains the state needed by a client to
/// resume a previous TLS session.
pub type ClientSessionState

/// A Config structure is used to configure a TLS client or server.
/// After one has been passed to a TLS function it must not be
/// modified. A Config may be reused; the tls package will also not
/// modify it.
pub struct Config {
  pub Rand: Option<io.Reader>,
  pub Time: Option<fn() -> time.Time>,
  pub Certificates: Slice<Certificate>,
  pub NameToCertificate: Map<string, Option<Ref<Certificate>>>,
  pub GetCertificate: Option<fn(Ref<ClientHelloInfo>) -> Result<Ref<Certificate>, error>>,
  pub GetClientCertificate: Option<fn(Ref<CertificateRequestInfo>) -> Result<Ref<Certificate>, error>>,
  pub GetConfigForClient: Option<fn(Ref<ClientHelloInfo>) -> Result<Ref<Config>, error>>,
  pub VerifyPeerCertificate: Option<fn(Slice<Slice<byte>>, Slice<Slice<Ref<x509.Certificate>>>) -> Result<(), error>>,
  pub VerifyConnection: Option<fn(ConnectionState) -> Result<(), error>>,
  pub RootCAs: Option<Ref<x509.CertPool>>,
  pub NextProtos: Slice<string>,
  pub ServerName: string,
  pub ClientAuth: ClientAuthType,
  pub ClientCAs: Option<Ref<x509.CertPool>>,
  pub InsecureSkipVerify: bool,
  pub CipherSuites: Slice<uint16>,
  pub PreferServerCipherSuites: bool,
  pub SessionTicketsDisabled: bool,
  // SKIPPED field "SessionTicketKey": array-currently-not-representable — fixed-size array cannot currently be represented in Lisette
  pub ClientSessionCache: Option<ClientSessionCache>,
  pub UnwrapSession: Option<fn(Slice<byte>, ConnectionState) -> Result<Ref<SessionState>, error>>,
  pub WrapSession: Option<fn(ConnectionState, Ref<SessionState>) -> Result<Slice<byte>, error>>,
  pub MinVersion: uint16,
  pub MaxVersion: uint16,
  pub CurvePreferences: Slice<CurveID>,
  pub DynamicRecordSizingDisabled: bool,
  pub Renegotiation: RenegotiationSupport,
  pub KeyLogWriter: Option<io.Writer>,
  pub EncryptedClientHelloConfigList: Slice<byte>,
  pub EncryptedClientHelloRejectionVerify: Option<fn(ConnectionState) -> Result<(), error>>,
  pub GetEncryptedClientHelloKeys: Option<fn(Ref<ClientHelloInfo>) -> Result<Slice<EncryptedClientHelloKey>, error>>,
  pub EncryptedClientHelloKeys: Slice<EncryptedClientHelloKey>,
}

/// A Conn represents a secured connection.
/// It implements the net.Conn interface.
pub type Conn

/// ConnectionState records basic TLS details about the connection.
pub struct ConnectionState {
  pub Version: uint16,
  pub HandshakeComplete: bool,
  pub DidResume: bool,
  pub CipherSuite: uint16,
  pub CurveID: CurveID,
  pub NegotiatedProtocol: string,
  pub NegotiatedProtocolIsMutual: bool,
  pub ServerName: string,
  pub PeerCertificates: Slice<Option<Ref<x509.Certificate>>>,
  pub VerifiedChains: Slice<Slice<Option<Ref<x509.Certificate>>>>,
  pub SignedCertificateTimestamps: Slice<Slice<byte>>,
  pub OCSPResponse: Slice<byte>,
  pub TLSUnique: Slice<byte>,
  pub ECHAccepted: bool,
}

/// Dialer dials TLS connections given a configuration and a Dialer for the
/// underlying connection.
pub struct Dialer {
  pub NetDialer: Option<Ref<net.Dialer>>,
  pub Config: Option<Ref<Config>>,
}

/// ECHRejectionError is the error type returned when ECH is rejected by a remote
/// server. If the server offered a ECHConfigList to use for retries, the
/// RetryConfigList field will contain this list.
/// 
/// The client may treat an ECHRejectionError with an empty set of RetryConfigs
/// as a secure signal from the server.
pub struct ECHRejectionError {
  pub RetryConfigList: Slice<byte>,
}

/// EncryptedClientHelloKey holds a private key that is associated
/// with a specific ECH config known to a client.
pub struct EncryptedClientHelloKey {
  pub Config: Slice<byte>,
  pub PrivateKey: Slice<byte>,
  pub SendAsRetry: bool,
}

/// A QUICConfig configures a [QUICConn].
pub struct QUICConfig {
  pub TLSConfig: Option<Ref<Config>>,
  pub EnableSessionEvents: bool,
}

/// A QUICConn represents a connection which uses a QUIC implementation as the underlying
/// transport as described in RFC 9001.
/// 
/// Methods of QUICConn are not safe for concurrent use.
pub type QUICConn

/// A QUICEvent is an event occurring on a QUIC connection.
/// 
/// The type of event is specified by the Kind field.
/// The contents of the other fields are kind-specific.
pub struct QUICEvent {
  pub Kind: QUICEventKind,
  pub Level: QUICEncryptionLevel,
  pub Data: Slice<byte>,
  pub Suite: uint16,
  pub SessionState: Option<Ref<SessionState>>,
}

pub struct QUICSessionTicketOptions {
  pub EarlyData: bool,
  pub Extra: Slice<Slice<byte>>,
}

/// RecordHeaderError is returned when a TLS record header is invalid.
pub struct RecordHeaderError {
  pub Msg: string,
  // SKIPPED field "RecordHeader": array-currently-not-representable — fixed-size array cannot currently be represented in Lisette
  pub Conn: Option<net.Conn>,
}

/// A SessionState is a resumable session.
pub struct SessionState {
  pub Extra: Slice<Slice<byte>>,
  pub EarlyData: bool,
}

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_AES_128_GCM_SHA256 = 0x1301

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_AES_256_GCM_SHA384 = 0x1302

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_CHACHA20_POLY1305_SHA256 = 0x1303

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA = 0xc009

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 = 0xc023

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0xc02b

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0xc00a

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0xc02c

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = 52393

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 = 0xcca9

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_ECDSA_WITH_RC4_128_SHA = 0xc007

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA = 0xc012

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0xc013

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0xc027

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0xc02f

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0xc014

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0xc030

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 = 52392

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 = 0xcca8

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_ECDHE_RSA_WITH_RC4_128_SHA = 0xc011

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_FALLBACK_SCSV = 0x5600

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x000a

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_RSA_WITH_AES_128_CBC_SHA = 0x002f

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x003c

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x009c

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_RSA_WITH_AES_256_CBC_SHA = 0x0035

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x009d

/// A list of cipher suite IDs that are, or have been, implemented by this
/// package.
/// 
/// See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
pub const TLS_RSA_WITH_RC4_128_SHA = 0x0005

pub const VersionSSL30 = 0x0300

pub const VersionTLS10 = 0x0301

pub const VersionTLS11 = 0x0302

pub const VersionTLS12 = 0x0303

pub const VersionTLS13 = 0x0304

impl AlertError {
  fn Error(self) -> string
}

impl CertificateRequestInfo {
  /// Context returns the context of the handshake that is in progress.
  /// This context is a child of the context passed to HandshakeContext,
  /// if any, and is canceled when the handshake concludes.
  fn Context(self: Ref<CertificateRequestInfo>) -> Option<context.Context>

  /// SupportsCertificate returns nil if the provided certificate is supported by
  /// the server that sent the CertificateRequest. Otherwise, it returns an error
  /// describing the reason for the incompatibility.
  fn SupportsCertificate(self: Ref<CertificateRequestInfo>, c: Ref<Certificate>) -> Result<(), error>
}

impl CertificateVerificationError {
  fn Error(self: Ref<CertificateVerificationError>) -> string

  fn Unwrap(self: Ref<CertificateVerificationError>) -> Option<error>
}

impl ClientAuthType {
  fn String(self) -> string
}

impl ClientHelloInfo {
  /// Context returns the context of the handshake that is in progress.
  /// This context is a child of the context passed to HandshakeContext,
  /// if any, and is canceled when the handshake concludes.
  fn Context(self: Ref<ClientHelloInfo>) -> Option<context.Context>

  /// SupportsCertificate returns nil if the provided certificate is supported by
  /// the client that sent the ClientHello. Otherwise, it returns an error
  /// describing the reason for the incompatibility.
  /// 
  /// If this [ClientHelloInfo] was passed to a GetConfigForClient or GetCertificate
  /// callback, this method will take into account the associated [Config]. Note that
  /// if GetConfigForClient returns a different [Config], the change can't be
  /// accounted for by this method.
  /// 
  /// This function will call x509.ParseCertificate unless c.Leaf is set, which can
  /// incur a significant performance cost.
  fn SupportsCertificate(self: Ref<ClientHelloInfo>, c: Ref<Certificate>) -> Result<(), error>
}

impl ClientSessionState {
  /// ResumptionState returns the session ticket sent by the server (also known as
  /// the session's identity) and the state necessary to resume this session.
  /// 
  /// It can be called by [ClientSessionCache.Put] to serialize (with
  /// [SessionState.Bytes]) and store the session.
  fn ResumptionState(self: Ref<ClientSessionState>) -> Result<(Slice<byte>, Ref<SessionState>), error>
}

impl Config {
  /// BuildNameToCertificate parses c.Certificates and builds c.NameToCertificate
  /// from the CommonName and SubjectAlternateName fields of each of the leaf
  /// certificates.
  /// 
  /// Deprecated: NameToCertificate only allows associating a single certificate
  /// with a given name. Leave that field nil to let the library select the first
  /// compatible chain from Certificates.
  fn BuildNameToCertificate(self: Ref<Config>)

  /// Clone returns a shallow clone of c or nil if c is nil. It is safe to clone a
  /// [Config] that is being used concurrently by a TLS client or server.
  /// 
  /// The returned Config can share session ticket keys with the original Config,
  /// which means connections could be resumed across the two Configs. WARNING:
  /// [Config.VerifyPeerCertificate] does not get called on resumed connections,
  /// including connections that were originally established on the parent Config.
  /// If that is not intended, use [Config.VerifyConnection] instead, or set
  /// [Config.SessionTicketsDisabled].
  fn Clone(self: Ref<Config>) -> Ref<Config>

  /// DecryptTicket decrypts a ticket encrypted by [Config.EncryptTicket]. It can
  /// be used as a [Config.UnwrapSession] implementation.
  /// 
  /// If the ticket can't be decrypted or parsed, DecryptTicket returns (nil, nil).
  fn DecryptTicket(
    self: Ref<Config>,
    identity: Slice<byte>,
    cs: ConnectionState,
  ) -> Result<Ref<SessionState>, error>

  /// EncryptTicket encrypts a ticket with the [Config]'s configured (or default)
  /// session ticket keys. It can be used as a [Config.WrapSession] implementation.
  fn EncryptTicket(
    self: Ref<Config>,
    cs: ConnectionState,
    ss: Ref<SessionState>,
  ) -> Result<Slice<byte>, error>

  // SKIPPED method "SetSessionTicketKeys": array-currently-not-representable — fixed-size array cannot currently be represented in Lisette
}

impl Conn {
  /// Close closes the connection.
  #[allow(unused_result)]
  fn Close(self: Ref<Conn>) -> Result<(), error>

  /// CloseWrite shuts down the writing side of the connection. It should only be
  /// called once the handshake has completed and does not call CloseWrite on the
  /// underlying connection. Most callers should just use [Conn.Close].
  fn CloseWrite(self: Ref<Conn>) -> Result<(), error>

  /// ConnectionState returns basic TLS details about the connection.
  fn ConnectionState(self: Ref<Conn>) -> ConnectionState

  /// Handshake runs the client or server handshake
  /// protocol if it has not yet been run.
  /// 
  /// Most uses of this package need not call Handshake explicitly: the
  /// first [Conn.Read] or [Conn.Write] will call it automatically.
  /// 
  /// For control over canceling or setting a timeout on a handshake, use
  /// [Conn.HandshakeContext] or the [Dialer]'s DialContext method instead.
  /// 
  /// In order to avoid denial of service attacks, the maximum RSA key size allowed
  /// in certificates sent by either the TLS server or client is limited to 8192
  /// bits. This limit can be overridden by setting tlsmaxrsasize in the GODEBUG
  /// environment variable (e.g. GODEBUG=tlsmaxrsasize=4096).
  fn Handshake(self: Ref<Conn>) -> Result<(), error>

  /// HandshakeContext runs the client or server handshake
  /// protocol if it has not yet been run.
  /// 
  /// The provided Context must be non-nil. If the context is canceled before
  /// the handshake is complete, the handshake is interrupted and an error is returned.
  /// Once the handshake has completed, cancellation of the context will not affect the
  /// connection.
  /// 
  /// Most uses of this package need not call HandshakeContext explicitly: the
  /// first [Conn.Read] or [Conn.Write] will call it automatically.
  fn HandshakeContext(self: Ref<Conn>, ctx: context.Context) -> Result<(), error>

  /// LocalAddr returns the local network address.
  fn LocalAddr(self: Ref<Conn>) -> Option<net.Addr>

  /// NetConn returns the underlying connection that is wrapped by c.
  /// Note that writing to or reading from this connection directly will corrupt the
  /// TLS session.
  fn NetConn(self: Ref<Conn>) -> Option<net.Conn>

  /// OCSPResponse returns the stapled OCSP response from the TLS server, if
  /// any. (Only valid for client connections.)
  fn OCSPResponse(self: Ref<Conn>) -> Slice<byte>

  /// Read reads data from the connection.
  /// 
  /// As Read calls [Conn.Handshake], in order to prevent indefinite blocking a deadline
  /// must be set for both Read and [Conn.Write] before Read is called when the handshake
  /// has not yet completed. See [Conn.SetDeadline], [Conn.SetReadDeadline], and
  /// [Conn.SetWriteDeadline].
  fn Read(self: Ref<Conn>, mut b: Slice<byte>) -> Partial<int, error>

  /// RemoteAddr returns the remote network address.
  fn RemoteAddr(self: Ref<Conn>) -> Option<net.Addr>

  /// SetDeadline sets the read and write deadlines associated with the connection.
  /// A zero value for t means [Conn.Read] and [Conn.Write] will not time out.
  /// After a Write has timed out, the TLS state is corrupt and all future writes will return the same error.
  fn SetDeadline(self: Ref<Conn>, t: time.Time) -> Result<(), error>

  /// SetReadDeadline sets the read deadline on the underlying connection.
  /// A zero value for t means [Conn.Read] will not time out.
  fn SetReadDeadline(self: Ref<Conn>, t: time.Time) -> Result<(), error>

  /// SetWriteDeadline sets the write deadline on the underlying connection.
  /// A zero value for t means [Conn.Write] will not time out.
  /// After a [Conn.Write] has timed out, the TLS state is corrupt and all future writes will return the same error.
  fn SetWriteDeadline(self: Ref<Conn>, t: time.Time) -> Result<(), error>

  /// VerifyHostname checks that the peer certificate chain is valid for
  /// connecting to host. If so, it returns nil; if not, it returns an error
  /// describing the problem.
  fn VerifyHostname(self: Ref<Conn>, host: string) -> Result<(), error>

  /// Write writes data to the connection.
  /// 
  /// As Write calls [Conn.Handshake], in order to prevent indefinite blocking a deadline
  /// must be set for both [Conn.Read] and Write before Write is called when the handshake
  /// has not yet completed. See [Conn.SetDeadline], [Conn.SetReadDeadline], and
  /// [Conn.SetWriteDeadline].
  fn Write(self: Ref<Conn>, b: Slice<byte>) -> Partial<int, error>
}

impl ConnectionState {
  /// ExportKeyingMaterial returns length bytes of exported key material in a new
  /// slice as defined in RFC 5705. If context is nil, it is not used as part of
  /// the seed. If the connection was set to allow renegotiation via
  /// Config.Renegotiation, or if the connections supports neither TLS 1.3 nor
  /// Extended Master Secret, this function will return an error.
  /// 
  /// Exporting key material without Extended Master Secret or TLS 1.3 was disabled
  /// in Go 1.22 due to security issues (see the Security Considerations sections
  /// of RFC 5705 and RFC 7627), but can be re-enabled with the GODEBUG setting
  /// tlsunsafeekm=1.
  fn ExportKeyingMaterial(
    self: Ref<ConnectionState>,
    label: string,
    context: Slice<byte>,
    length: int,
  ) -> Result<Slice<byte>, error>
}

impl CurveID {
  fn String(self) -> string
}

impl Dialer {
  /// Dial connects to the given network address and initiates a TLS
  /// handshake, returning the resulting TLS connection.
  /// 
  /// The returned [Conn], if any, will always be of type *[Conn].
  /// 
  /// Dial uses context.Background internally; to specify the context,
  /// use [Dialer.DialContext].
  fn Dial(self: Ref<Dialer>, network: string, addr: string) -> Result<net.Conn, error>

  /// DialContext connects to the given network address and initiates a TLS
  /// handshake, returning the resulting TLS connection.
  /// 
  /// The provided Context must be non-nil. If the context expires before
  /// the connection is complete, an error is returned. Once successfully
  /// connected, any expiration of the context will not affect the
  /// connection.
  /// 
  /// The returned [Conn], if any, will always be of type *[Conn].
  fn DialContext(
    self: Ref<Dialer>,
    ctx: context.Context,
    network: string,
    addr: string,
  ) -> Result<net.Conn, error>
}

impl ECHRejectionError {
  fn Error(self: Ref<ECHRejectionError>) -> string
}

impl QUICConn {
  /// Close closes the connection and stops any in-progress handshake.
  #[allow(unused_result)]
  fn Close(self: Ref<QUICConn>) -> Result<(), error>

  /// ConnectionState returns basic TLS details about the connection.
  fn ConnectionState(self: Ref<QUICConn>) -> ConnectionState

  /// HandleData handles handshake bytes received from the peer.
  /// It may produce connection events, which may be read with [QUICConn.NextEvent].
  fn HandleData(
    self: Ref<QUICConn>,
    level: QUICEncryptionLevel,
    data: Slice<byte>,
  ) -> Result<(), error>

  /// NextEvent returns the next event occurring on the connection.
  /// It returns an event with a Kind of [QUICNoEvent] when no events are available.
  fn NextEvent(self: Ref<QUICConn>) -> QUICEvent

  /// SendSessionTicket sends a session ticket to the client.
  /// It produces connection events, which may be read with [QUICConn.NextEvent].
  /// Currently, it can only be called once.
  fn SendSessionTicket(self: Ref<QUICConn>, opts: QUICSessionTicketOptions) -> Result<(), error>

  /// SetTransportParameters sets the transport parameters to send to the peer.
  /// 
  /// Server connections may delay setting the transport parameters until after
  /// receiving the client's transport parameters. See [QUICTransportParametersRequired].
  fn SetTransportParameters(self: Ref<QUICConn>, params: Slice<byte>)

  /// Start starts the client or server handshake protocol.
  /// It may produce connection events, which may be read with [QUICConn.NextEvent].
  /// 
  /// Start must be called at most once.
  fn Start(self: Ref<QUICConn>, ctx: context.Context) -> Result<(), error>

  /// StoreSession stores a session previously received in a QUICStoreSession event
  /// in the ClientSessionCache.
  /// The application may process additional events or modify the SessionState
  /// before storing the session.
  fn StoreSession(self: Ref<QUICConn>, session: Ref<SessionState>) -> Result<(), error>
}

impl QUICEncryptionLevel {
  fn String(self) -> string
}

impl RecordHeaderError {
  fn Error(self) -> string
}

impl SessionState {
  /// Bytes encodes the session, including any private fields, so that it can be
  /// parsed by [ParseSessionState]. The encoding contains secret values critical
  /// to the security of future and possibly past sessions.
  /// 
  /// The specific encoding should be considered opaque and may change incompatibly
  /// between Go versions.
  fn Bytes(self: Ref<SessionState>) -> Result<Slice<byte>, error>
}

impl SignatureScheme {
  fn String(self) -> string
}
