import * as plugins from '../../plugins.js';
import type { IDnsAuthorityZone } from '../../../dist_ts_interfaces/data/dns-authority.js';
/**
 * Singleton DNS-authority document. One row per dcrouter instance, keyed on the
 * fixed `settingsId`, following the `AcmeConfigDoc` / `RemoteIngressHubSettingsDoc`
 * pattern rather than introducing a third settings shape.
 *
 * Holds the zones whose authority was **proven** by an observed public
 * delegation to our nameservers. This is the authority set — the whole of it.
 * Deployment configuration contributes nothing: `dnsScopes` used to add an
 * always-in-effect floor, and duplicating one fact into two places is what let
 * the two representations drift, which is the bug class this document closes.
 *
 * Reading it is therefore load-bearing. `DnsAuthorityManager.start()` treats an
 * absent document (known-empty: claim nothing) differently from an unreadable
 * one (unknown: refuse to start), because rendering the second as the first
 * would turn a database blip into every zone dropping off the air.
 */
export declare class DnsAuthorityDoc extends plugins.smartdata.SmartDataDbDoc<DnsAuthorityDoc, DnsAuthorityDoc> {
    settingsId: string;
    /**
     * Delegation-verified zones. Each entry carries the evidence that justified
     * it, so a later audit can tell what was observed and when.
     */
    verifiedZones: IDnsAuthorityZone[];
    updatedAt: number;
    updatedBy: string;
    constructor();
    static load(): Promise<DnsAuthorityDoc | null>;
}