import * as plugins from '../plugins.js';
import type { IGatewayClient } from '../../dist_ts_interfaces/data/workhoster.js';
import type { IGatewayCredentialLifecycle } from '../../dist_ts_interfaces/data/route-management.js';
export interface IStagedGatewayClientProvisioning {
    action: plugins.servezoneInterfaces.data.TGatewayClientProvisioningAction;
    gatewayClient: IGatewayClient;
    credentialSequence: number;
    policyDigest: string;
}
export declare class GatewayClientManager {
    initialize(): Promise<void>;
    listClients(): Promise<IGatewayClient[]>;
    getClient(id: string): Promise<IGatewayClient | null>;
    createClient(options: {
        id?: string;
        type: IGatewayClient['type'];
        name: string;
        description?: string;
        hostnamePatterns?: string[];
        allowedRouteTargets?: IGatewayClient['allowedRouteTargets'];
        capabilities?: IGatewayClient['capabilities'];
        createdBy: string;
        applyCapabilityDefaults?: boolean;
    }): Promise<IGatewayClient>;
    updateClient(id: string, patch: Partial<Pick<IGatewayClient, 'name' | 'description' | 'hostnamePatterns' | 'allowedRouteTargets' | 'capabilities' | 'enabled'>>, options?: {
        applyCapabilityDefaults?: boolean;
    }): Promise<IGatewayClient | null>;
    deleteClient(id: string): Promise<boolean>;
    upsertClient(spec: plugins.servezoneInterfaces.data.IGatewayClientProvisioningSpec, createdBy: string): Promise<{
        action: plugins.servezoneInterfaces.data.TGatewayClientProvisioningAction;
        gatewayClient: IGatewayClient;
    }>;
    /**
     * Stage an idempotent provisioning policy without changing the live policy.
     * Sequence gaps after a later credential write failure are intentional.
     */
    stageClientProvisioning(spec: plugins.servezoneInterfaces.data.IGatewayClientProvisioningSpec, stagedBy: string): Promise<IStagedGatewayClientProvisioning>;
    /** Resolve the exact durable policy a provisioned credential was issued for. */
    getClientForProvisionedCredential(idArg: string, typeArg: IGatewayClient['type'], lifecycleArg: IGatewayCredentialLifecycle): Promise<IGatewayClient | null>;
    /** Promote only the pending policy owned by this exact credential sequence. */
    promoteProvisionedPolicy(idArg: string, typeArg: IGatewayClient['type'], lifecycleArg: IGatewayCredentialLifecycle): Promise<IGatewayClient>;
    digestPublicClientPolicy(clientArg: IGatewayClient): string;
    private normalizeId;
    private normalizeHostnamePatterns;
    private normalizeHostnamePattern;
    private normalizeAllowedRouteTargets;
    private normalizeTargetHost;
    private normalizeProvisioningSpec;
    private activePolicyFromDoc;
    private digestPolicy;
    private normalizeCredentialSequence;
    private normalizePolicyGeneration;
    private normalizeMutationRevision;
    private toPublicPendingClient;
    private toPublicClient;
}