import { DnsRecordDoc } from '../db/documents/classes.dns-record.doc.js';
import { EmailDomainDoc } from '../db/documents/classes.email-domain.doc.js';
import type { DcRouter } from '../classes.dcrouter.js';
import type { IEmailDnsRecordIntent, IEmailDomainEdgeIdentity, TEmailDnsVerificationOutcome } from '../../dist_ts_interfaces/data/email-domain.js';
import { MailEdgeEligibility } from './classes.mail-edge-eligibility.js';
import { type IMailDnsTxtPolicyResult } from './mail-dns-txt-policy.js';
export declare const MAIL_DNS_SYNC_CREATED_BY = "mail-dns-reconciler";
export declare const MAIL_DNS_MANAGED_BY = "mail-dns-reconciler";
export declare const MAIL_DNS_RETRY_INTERVAL_MS: number;
export declare const MAIL_DNS_MAX_RETRY_INTERVAL_MS: number;
export declare const MAIL_DNS_RECONCILIATION_INTERVAL_MS: number;
export declare const MAIL_DNS_EDGE_ELIGIBILITY_DEBOUNCE_MS = 250;
export declare const MAIL_DNS_EDGE_ELIGIBILITY_COOLDOWN_MS = 5000;
export declare const MAIL_DNS_PUBLIC_RESOLVER_OPTIONS: {
    strategy: "prefer-udp";
    allowDohFallback: boolean;
    timeoutMs: number;
};
export interface IMailDnsVerificationResult {
    valid: boolean;
    outcome?: TEmailDnsVerificationOutcome;
    reason?: string;
    effectiveValue?: string;
}
export interface IMailDnsVerifier {
    verifyRecord(intent: IEmailDnsRecordIntent): Promise<IMailDnsVerificationResult>;
    verifyMxSet?(intents: IEmailDnsRecordIntent[], previousValues?: string[]): Promise<IMailDnsVerificationResult>;
    verifyForwardConfirmedIdentity(identity: IEmailDomainEdgeIdentity): Promise<IMailDnsVerificationResult>;
    evaluateTxtRecords?(intent: IEmailDnsRecordIntent, values: string[]): Promise<IMailDnsTxtPolicyResult>;
    destroy?(): void;
}
export declare function evaluateMailMxValues(intents: IEmailDnsRecordIntent[], rawValues: string[], previousValues?: string[]): IMailDnsVerificationResult;
export declare class SmartDnsMailVerifier implements IMailDnsVerifier {
    private client?;
    private getClient;
    private queryValues;
    verifyRecord(intent: IEmailDnsRecordIntent): Promise<IMailDnsVerificationResult>;
    evaluateTxtRecords(intent: IEmailDnsRecordIntent, values: string[]): Promise<IMailDnsTxtPolicyResult>;
    verifyMxSet(intents: IEmailDnsRecordIntent[], previousValues?: string[]): Promise<IMailDnsVerificationResult>;
    verifyForwardConfirmedIdentity(identity: IEmailDomainEdgeIdentity): Promise<IMailDnsVerificationResult>;
    destroy(): void;
}
/**
 * Sole owner of managed mail DNS. API, topology, timer, and startup events only
 * mark this globally serialized reconciler dirty.
 */
export declare class MailDnsSync {
    private dcRouterRef;
    private verifier;
    private started;
    private stopped;
    private dirty;
    private runPromise?;
    private retryTimer?;
    private schedulePromises;
    private scheduleGeneration;
    private lastScheduledReconciliationAt;
    private requestedGeneration;
    private completedGeneration;
    private forceAll;
    private forcedDomainIds;
    private edgeEligibility;
    private edgeEligibilitySignature?;
    private edgeEligibilityCheckTimer?;
    private edgeEligibilityCheckPromise?;
    private pendingEdgeEligibilityReason?;
    private lastEdgeEligibilitySyncAt;
    private edgeEligibilityDebounceMs;
    private edgeEligibilityCooldownMs;
    constructor(dcRouterRef: DcRouter, edgeEligibility?: MailEdgeEligibility, verifier?: IMailDnsVerifier);
    start(): Promise<void>;
    stop(): Promise<void>;
    requestSync(reason: string, domainIds?: string[]): void;
    /**
     * RemoteIngress topology events are advisory. Resolve the actual mail-edge
     * eligibility snapshot and only reconcile DNS when its semantic shape
     * changes. Volatile heartbeat/observation timestamps never enter the
     * signature.
     */
    requestEdgeEligibilityCheck(reason: string): void;
    private scheduleEdgeEligibilityCheck;
    private runEdgeEligibilityCheck;
    /** Coalescing entry point used by API actions that need the durable outcome. */
    sync(reason: string, domainIds?: string[]): Promise<void>;
    syncDomain(domainId: string, reason: string): Promise<{
        requestedGeneration: number;
        completedGeneration: number;
        domain: EmailDomainDoc | null;
        records: DnsRecordDoc[];
    }>;
    private queueRequest;
    private kick;
    private runLoop;
    private reconcile;
    private reconcileExclusive;
    private isDomainDue;
    private getDkimRotationDueAt;
    private getDkimRetirementDueAt;
    private scheduleNextDue;
    private queueScheduleNextDue;
    private buildPlan;
    private getActiveDkim;
    private buildDkimIntent;
    private intentForName;
    private toDomainEdgeIdentity;
    private allocateMxSlots;
    private buildSpfValue;
    private persistDesiredPlan;
    private persistDeletingAttempt;
    private reconcileZones;
    private sortIntents;
    private reconcileIntent;
    private evaluateTxtRecords;
    private valuesEqual;
    private isRelevantUnmanagedTxt;
    private validateAndActivate;
    private promotePendingDkim;
    private refreshProviderZonesForCleanup;
    private cleanupStaleManagedRecords;
    private pruneRetiredDkimMaterial;
    private finalizeDeletingDomains;
    private findZoneForName;
}