import type { IEmailDomainConfig } from '@push.rocks/smartmta';
import { EmailDomainDoc } from '../db/documents/classes.email-domain.doc.js';
import type { IEmailDomain, IEmailDnsRecord, IEmailDomainRemoteIngress, IEmailDomainOperationError, TEmailDomainLifecycleStatus } from '../../dist_ts_interfaces/data/email-domain.js';
export interface IEmailDomainManagerActionResult {
    success: boolean;
    message?: string;
    lifecycleStatus?: TEmailDomainLifecycleStatus;
    code?: string;
    errors?: IEmailDomainOperationError[];
    retryAt?: string;
    capability?: 'supported' | 'unsupported';
    domain?: IEmailDomain;
    records?: IEmailDnsRecord[];
    provisioned?: number;
}
export interface IManagedDkimRepairResult {
    repairedDomainIds: string[];
    repairedConfiguredDomains: string[];
    failedConfiguredDomains: string[];
    failedDomainIds: string[];
}
/**
 * Persists managed email domains and projects them into SmartMTA. DNS mutation
 * is delegated exclusively to MailDnsSync.
 */
export declare class EmailDomainManager {
    private dcRouter;
    private baseEmailDomains;
    private failedBaseDkimDomainNames;
    private mutationChain;
    /** Explicit upstream capability marker; absence is deliberately fail-closed. */
    private get selectorCorrectSigningCapability();
    constructor(dcRouterRef: any);
    setBaseEmailDomains(domains: IEmailDomainConfig[] | undefined): void;
    private get dkimCreator();
    start(): Promise<void>;
    stop(): Promise<void>;
    supportsSelectorCorrectSigning(): boolean;
    private runMutationExclusive;
    getAll(): Promise<IEmailDomain[]>;
    getById(id: string): Promise<IEmailDomain | null>;
    getByDomain(domainName: string): Promise<IEmailDomain | null>;
    ensureEmailDomainForDomainName(domainName: string): Promise<IEmailDomain | null>;
    createEmailDomain(opts: {
        linkedDomainId: string;
        subdomain?: string;
        dkimSelector?: string;
        dkimKeySize?: number;
        rotateKeys?: boolean;
        rotationIntervalDays?: number;
        remoteIngress?: IEmailDomainRemoteIngress;
    }): Promise<IEmailDomain>;
    updateEmailDomain(id: string, changes: {
        rotateKeys?: boolean;
        rotationIntervalDays?: number;
        rateLimits?: IEmailDomain['rateLimits'];
        remoteIngress?: IEmailDomainRemoteIngress | null;
    }): Promise<IEmailDomainManagerActionResult>;
    deleteEmailDomain(id: string): Promise<IEmailDomainManagerActionResult>;
    getRequiredDnsRecords(id: string): Promise<IEmailDnsRecord[]>;
    provisionDnsRecords(id: string): Promise<IEmailDomainManagerActionResult>;
    validateDns(id: string): Promise<IEmailDomainManagerActionResult>;
    getOutboundReadiness(domainName: string): Promise<{
        ready: boolean;
        reason?: string;
        edgeIds: string[];
        selector?: string;
    }>;
    /**
     * Caller-owned repair for legacy managed domains. SmartMTA remains in
     * validation-only mode; dcrouter explicitly owns any required key creation.
     */
    repairManagedDkimBeforeEmailStart(): Promise<IManagedDkimRepairResult>;
    /** Retry a previously failed managed-domain repair when its bounded retry is due. */
    repairManagedDkimIfDue(id: string, now?: number): Promise<EmailDomainDoc | undefined>;
    private repairManagedDkimDocument;
    private ensureValidatedDkimMaterial;
    requestDkimRotation(id: string): Promise<IEmailDomainManagerActionResult>;
    /** Called by the reconciler before planning so scheduled external rotation is durable first. */
    stageDkimRotationIfDue(id: string): Promise<EmailDomainDoc | undefined>;
    private stageDkimRotation;
    private normalizeRemoteIngressPin;
    private normalizeRotationIntervalDays;
    private extractDkimPublicKey;
    private getActiveDkim;
    private invalidateReconciliation;
    private invalidateDkimReconciliation;
    private capabilityError;
    private unsupportedResult;
    private hasDnsMutationFailure;
    private resultForDoc;
    private docToInterface;
    private isDomainAlreadyConfigured;
    private findLinkedDnsDomain;
    private buildManagedDomainConfigs;
    syncManagedDomainsToRuntime(optionsArg?: {
        excludeDkimRepairFailures?: boolean;
    }): Promise<void>;
    private hasDkimRepairFailure;
}