import * as plugins from '../plugins.js';
import type { IHttpRedirectInfo, ILetsEncryptHttp01ForwardConfig, IRoute, IMergedRoute, IRouteWarning, IRouteMetadata } from '../../dist_ts_interfaces/data/route-management.js';
import type { IDcRouterRouteConfig } from '../../dist_ts_interfaces/data/remoteingress.js';
import { type IHttp3Config } from '../http3/index.js';
import { type IDomainOwnershipUnverified, type IDomainOwnershipZone } from '../dns/domain-ownership.js';
import type { ReferenceResolver } from './classes.reference-resolver.js';
export type TVpnClientAllowEntry = string | {
    clientId: string;
    domains: string[];
};
export interface IRouteMutationResult {
    success: boolean;
    message?: string;
}
/**
 * Supplies the ownership inputs a route's certificate requirement is checked
 * against. Injected (rather than importing DnsManager) so route management keeps
 * its single direction of dependency and stays unit-testable.
 */
export interface IRouteDomainOwnershipSource {
    listOwnershipZones: () => Promise<IDomainOwnershipZone[]>;
    getAuthorityZones: () => string[];
}
/** A route hostname whose certificate requirement has no ownership proof. */
export interface IUnverifiedRouteDomain {
    routeId: string;
    routeName: string;
    ownership: IDomainOwnershipUnverified;
}
/** Hostnames for which a terminating route asks SmartProxy to obtain a certificate. */
export declare function collectAutoCertificateHostnames(route: IDcRouterRouteConfig): string[];
interface IRouteMutationOptions {
    trustedManagedMutation?: boolean;
    replaceMetadata?: boolean;
    replaceRoute?: boolean;
}
export declare class RouteConfigManager {
    private getSmartProxy;
    private getHttp3Config?;
    private getVpnClientAccessForRoute?;
    private referenceResolver?;
    private onRoutesApplied?;
    private getRuntimeRoutes?;
    private hydrateStoredRoute?;
    private applyInboundProxyPolicies?;
    private routes;
    private warnings;
    private routeUpdateMutex;
    private domainOwnershipSource?;
    constructor(getSmartProxy: () => plugins.smartproxy.SmartProxy | undefined, getHttp3Config?: (() => IHttp3Config | undefined) | undefined, getVpnClientAccessForRoute?: ((route: IDcRouterRouteConfig, routeId?: string) => TVpnClientAllowEntry[]) | undefined, referenceResolver?: ReferenceResolver | undefined, onRoutesApplied?: ((routes: plugins.smartproxy.IRouteConfig[]) => void | Promise<void>) | undefined, getRuntimeRoutes?: ((preparedRoutes?: plugins.smartproxy.IRouteConfig[]) => plugins.smartproxy.IRouteConfig[] | Promise<plugins.smartproxy.IRouteConfig[]>) | undefined, hydrateStoredRoute?: ((storedRoute: IRoute) => plugins.smartproxy.IRouteConfig | undefined) | undefined, applyInboundProxyPolicies?: ((routes: plugins.smartproxy.IRouteConfig[]) => plugins.smartproxy.IRouteConfig[]) | undefined);
    /** Expose routes map for reference resolution lookups. */
    getRoutes(): Map<string, IRoute>;
    getRoute(id: string): IRoute | undefined;
    setVpnClientAccessResolver(resolver?: (route: IDcRouterRouteConfig, routeId?: string) => TVpnClientAllowEntry[]): void;
    /**
     * Wire the ownership inputs used to gate certificate requirements. Until this
     * is set, any route asking for an automatic certificate is refused — a missing
     * wiring must never silently disable the gate.
     */
    setDomainOwnershipSource(source?: IRouteDomainOwnershipSource): void;
    /**
     * Refuse a route whose certificate requirement covers a domain we cannot prove
     * we own. This is the point of attribution: the operator making the change gets
     * the reason, instead of a DNS-01 order failing hours later and consuming a
     * per-domain retry budget that no retry could ever satisfy.
     */
    private assertCertificateRequirementOwnership;
    /**
     * Audit already-stored routes for certificate requirements on unverified
     * domains.
     *
     * Deliberately an audit and not a refusal: these routes are already live, and
     * a route can be serving traffic on a certificate issued while the domain was
     * still verifiable, or on a static certificate elsewhere in the set. Refusing
     * them at startup would convert a latent misconfiguration into an immediate
     * outage, and the incident these checks exist for cost us silence, not serving.
     * New and updated routes are refused outright; existing ones are surfaced.
     */
    auditRouteDomainOwnership(): Promise<IUnverifiedRouteDomain[]>;
    /**
     * Run the audit, publish it as route warnings, and log each finding at `error`
     * so it reaches the ops log stream rather than only the warnings panel.
     *
     * Public because a DNS-authority change can make a previously unprovable
     * certificate requirement provable (or the reverse) without any route changing.
     */
    refreshDomainOwnershipWarnings(): Promise<void>;
    runExclusiveRouteUpdate<T>(fn: () => Promise<T>): Promise<T>;
    /**
     * Load persisted routes, seed serializable config/email/dns routes,
     * compute warnings, and apply the combined DB-backed + runtime route set to SmartProxy.
     */
    initialize(configRoutes?: IDcRouterRouteConfig[], emailRoutes?: IDcRouterRouteConfig[], dnsRoutes?: IDcRouterRouteConfig[]): Promise<void>;
    getMergedRoutes(): {
        routes: IMergedRoute[];
        warnings: IRouteWarning[];
    };
    getHttpRedirects(): IHttpRedirectInfo[];
    createRoute(route: IDcRouterRouteConfig, createdBy: string, enabled?: boolean, metadata?: IRouteMetadata, options?: IRouteMutationOptions): Promise<string>;
    createManagedRoute(route: IDcRouterRouteConfig, createdBy: string, enabled: boolean, metadata: IRouteMetadata): Promise<string>;
    createLetsEncryptHttp01Forward(config: ILetsEncryptHttp01ForwardConfig, createdBy: string, enabled?: boolean): Promise<string>;
    updateRoute(id: string, patch: {
        route?: Partial<IDcRouterRouteConfig>;
        enabled?: boolean;
        metadata?: Partial<IRouteMetadata>;
    }, options?: IRouteMutationOptions): Promise<IRouteMutationResult>;
    updateManagedRoute(id: string, patch: {
        route?: Partial<IDcRouterRouteConfig>;
        enabled?: boolean;
        metadata?: Partial<IRouteMetadata>;
    }, options?: Pick<IRouteMutationOptions, 'replaceMetadata' | 'replaceRoute'>): Promise<IRouteMutationResult>;
    updateLetsEncryptHttp01Forward(id: string, config: ILetsEncryptHttp01ForwardConfig, enabled?: boolean): Promise<IRouteMutationResult>;
    deleteRoute(id: string, options?: IRouteMutationOptions): Promise<IRouteMutationResult>;
    deleteManagedRoute(id: string): Promise<IRouteMutationResult>;
    deleteLetsEncryptHttp01Forward(id: string): Promise<IRouteMutationResult>;
    toggleRoute(id: string, enabled: boolean): Promise<IRouteMutationResult>;
    findApiRouteByExternalKey(externalKey: string): IRoute | undefined;
    /**
     * Upsert seed routes by name+origin. Preserves user's `enabled` state.
     * Deletes stale DB routes whose origin matches but name is not in the seed set.
     */
    private seedRoutes;
    private buildSystemRouteKey;
    private findExistingSeedRouteId;
    private loadRoutes;
    private persistRoute;
    private compileLetsEncryptHttp01Forward;
    private hasReservedManagedMetadata;
    private isManagedMetadata;
    private isManagedRoute;
    private normalizeRouteMetadata;
    private normalizeSourceBindings;
    private normalizePathPolicies;
    private validateSourceBindings;
    private normalizeRateLimit;
    private normalizeRateLimitExceeded;
    private normalizeChallenge;
    private computeWarnings;
    private logWarnings;
    /**
     * Re-resolve specific routes by ID (after a profile or target is updated).
     * Persists each route and calls applyRoutes() once at the end.
     */
    reResolveRoutes(routeIds: string[]): Promise<void>;
    applyRoutes(): Promise<void>;
    private getPreparedEnabledRoutesForApply;
    private prepareStoredRoutesForApply;
    private isManagedAccessRoute;
    private prepareRouteForApply;
    private injectVpnSecurity;
    private mergeVpnClientAllowEntries;
}
export {};