/**
 * CAA preflight — run before the FIRST certificate issuance for a delegated
 * child domain (D8; dev-substrate design gap D1). ACM consults CAA up the
 * parent chain regardless of where the validation records live: a parent CAA
 * record set that does not authorise Amazon's CA makes ACM REFUSE issuance
 * even when the NS delegation is perfect, so the `phase: "full"` deploy would
 * hang exactly like an unpropagated delegation.
 *
 * RFC 8659 semantics: the RELEVANT record set is the closest ancestor (or the
 * name itself) that has any CAA records — once a set is found the walk stops.
 * No CAA records anywhere ⇒ issuance is permitted by spec ⇒ pass.
 */
import { type Result } from "@fjall/generator";
import type { DeployCallbacks } from "../../types/callbacks.js";
import { DomainDelegationError, type PublicCaaRecord, type PublicDnsResolver } from "./types.js";
/**
 * The CA domains ACM issues under (AWS documented set). A CAA `issue` /
 * `issuewild` value naming any of these authorises ACM.
 */
export declare const ACM_CAA_ISSUERS: readonly ["amazon.com", "amazontrust.com", "awstrust.com", "amazonawstrust.com"];
export interface CaaPreflightParams {
    /** The domain certificates will be requested for (the child zone name). */
    certificateDomain: string;
    /** Injectable resolvers (tests use fakes); defaults to 1.1.1.1 + 8.8.8.8. */
    resolvers?: readonly PublicDnsResolver[];
    abortSignal?: AbortSignal;
    callbacks?: DeployCallbacks;
}
export type CaaPreflightVerdict = 
/** No CAA record set exists anywhere up the chain — issuance permitted. */
{
    authorised: true;
    reason: "no-caa-found";
}
/** The relevant set authorises ACM (or restricts nothing). */
 | {
    authorised: true;
    reason: "acm-authorised" | "no-issue-restriction";
    /** The name carrying the relevant CAA record set. */
    caaName: string;
    records: string[];
};
/** `certificateDomain` and every ancestor down to the registrable pair. */
export declare function caaAncestorChain(certificateDomain: string): string[];
/** Render a CAA record in zone-file form for value-echoing errors. */
export declare function formatCaaRecord(record: PublicCaaRecord): string;
/**
 * Walk the parent chain and evaluate the relevant CAA record set. Read-only.
 *
 * Fail-closed polarity (fail-closed ADR): a restrictive set fails with the
 * EXACT records found and the cure (add an ACM-authorising CAA record, or
 * issue certificates outside ACM); a chain that cannot be READ also fails
 * closed — issuance cannot be proven safe — naming the `skipCaaPreflight`
 * pre-answer for an operator who has verified the chain out of band.
 */
export declare function runCaaPreflight(params: CaaPreflightParams): Promise<Result<CaaPreflightVerdict, DomainDelegationError>>;