from __future__ import annotations
import httpx


async def check_spki(spki_sha256_hex: str, timeout: float = 6.0) -> tuple[bool, str | None]:
    """Query pwnedkeys.com for a given SPKI SHA-256 fingerprint.

    Returns (is_pwned, error).
    pwnedkeys.com responds 200 if the key is pwned, 404 if not known.
    """
    url = f"https://v1.pwnedkeys.com/{spki_sha256_hex.lower()}"
    try:
        async with httpx.AsyncClient(timeout=timeout, headers={"User-Agent": "nercone-tls-test/1.0"}) as client:
            resp = await client.head(url)
            if resp.status_code == 200:
                return True, None
            if resp.status_code == 404:
                return False, None
            return False, f"unexpected status {resp.status_code}"
    except Exception as e:
        return False, f"{e.__class__.__name__}: {e}"
