import type { IEmailRoute, IExtendedSmtpSession, IMessageAcceptanceContext, IMessageAcceptanceDecision, IUnifiedEmailServerOptions } from '@push.rocks/smartmta';
import type { Buffer } from 'node:buffer';
import * as plugins from '../plugins.js';
import { CachedEmail } from '../db/index.js';
import type { DcRouter } from '../classes.dcrouter.js';
import type * as interfaces from '../../dist_ts_interfaces/index.js';
import { type IStoredWorkAppMailIdentity } from './gateway-mail-domain-authority.js';
type TSyncRequest = {
    ownership: interfaces.data.IWorkAppMailOwnership;
    localPart: string;
    domain: string;
    displayName?: string;
    inbound?: interfaces.data.IWorkAppMailInboundRoute;
    inboundTarget?: plugins.servezoneInterfaces.data.IMailInboundTarget;
    enabled?: boolean;
    smtpEnabled?: boolean;
    resetSmtpPassword?: boolean;
    delete?: boolean;
};
type TMailResourceOwner = plugins.servezoneInterfaces.data.IMailResourceOwner;
type TMailAddressBinding = plugins.servezoneInterfaces.data.IMailAddressBinding;
type TMailAddressBindingSync = plugins.servezoneInterfaces.requests.mail.TMailAddressBindingSync;
type TMailAddressBindingSyncResponse = plugins.servezoneInterfaces.requests.mail.IReq_SyncMailAddressBinding['response'];
type TMailAddressBindingDeleteResponse = plugins.servezoneInterfaces.requests.mail.IReq_DeleteMailAddressBinding['response'];
type TMailCredentialRotateResponse = plugins.servezoneInterfaces.requests.mail.IReq_RotateMailCredential['response'];
type TMailEnqueueResponse = plugins.servezoneInterfaces.requests.mail.IReq_EnqueueMail['response'];
type TMailDeliveryStatusResponse = plugins.servezoneInterfaces.requests.mail.IReq_GetMailDeliveryStatus['response'];
type TMailEndpointRegistrationResponse = plugins.servezoneInterfaces.requests.mail.IReq_RegisterServiceMailEndpoint['response'];
type TWorkAppMailBinding = plugins.servezoneInterfaces.data.IWorkAppMailBinding;
/**
 * WorkApp-generated routes and SMTP users contributed to the composed email
 * runtime config. Consumed by SmtpAccountManager, the single owner of the
 * final `auth` block and route-list composition.
 */
export interface IWorkAppMailRuntimeContribution {
    routes: IEmailRoute[];
    users: Array<{
        username: string;
        password: string;
    }>;
}
/** Route names generated (and owned wholesale) by WorkAppMailManager. */
export declare function isWorkAppManagedMailRouteName(routeName: string): boolean;
/** SMTP usernames generated (and owned wholesale) by WorkAppMailManager. */
export declare function isWorkAppManagedSmtpUsername(username: string): boolean;
export declare class WorkAppMailManager {
    private dcRouterRef;
    private readonly emailValidator;
    private readonly gatewayMailDomainStore;
    private identityMutationPromise;
    constructor(dcRouterRef: DcRouter);
    listMailIdentities(ownership?: Partial<interfaces.data.IWorkAppMailOwnership>): Promise<interfaces.data.IWorkAppMailIdentity[]>;
    syncMailIdentity(request: TSyncRequest, createdBy: string): Promise<interfaces.data.IWorkAppMailIdentitySyncResult>;
    private runIdentityMutationExclusive;
    private syncMailIdentityInner;
    listMailAddressBindings(options?: {
        owner?: Partial<TMailResourceOwner>;
        domain?: string;
        address?: string;
    }): Promise<TMailAddressBinding[]>;
    listWorkAppMailBindings(owner?: Partial<TMailResourceOwner>): Promise<TWorkAppMailBinding[]>;
    countMailDomains(ownerArg: Pick<TMailResourceOwner, 'gatewayClientType' | 'gatewayClientId'>): Promise<number>;
    syncMailAddressBinding(binding: TMailAddressBindingSync, createdBy: string): Promise<TMailAddressBindingSyncResponse>;
    rotateMailCredential(credentialId: string, createdBy: string, owner?: Partial<TMailResourceOwner>): Promise<TMailCredentialRotateResponse>;
    private rotateMailCredentialInner;
    enforceManagedSmtpSender(context: IMessageAcceptanceContext): Promise<IMessageAcceptanceDecision | undefined>;
    enqueueMail(authArg: plugins.servezoneInterfaces.requests.mail.IMailSubmissionRequestAuth, messageArg: plugins.servezoneInterfaces.data.IMailOutboundMessagePayload, outboundIdentityIdArg?: string, idempotencyKeyArg?: string): Promise<TMailEnqueueResponse>;
    private normalizeMailIdempotencyKey;
    private canonicalMailSubmissionJson;
    private getMailSubmissionDigest;
    private getMailSubmissionReplay;
    getMailDeliveryStatus(spoolItemIdArg: string): Promise<TMailDeliveryStatusResponse>;
    getMailDeliveryStatusForCredential(authArg: plugins.servezoneInterfaces.requests.mail.IMailSubmissionRequestAuth, spoolItemIdArg: string): Promise<TMailDeliveryStatusResponse>;
    registerServiceMailEndpoint(authArg: plugins.servezoneInterfaces.requests.mail.IMailSubmissionRequestAuth, peerArg: {
        tags?: Set<string>;
    }, addressesArg?: string[]): Promise<TMailEndpointRegistrationResponse>;
    deliverCachedEmailToTypedEndpoint(cachedEmailArg: CachedEmail, rawMessageArg: Buffer | plugins.buffer.Buffer, sessionArg: IExtendedSmtpSession): Promise<boolean>;
    deleteMailAddressBinding(id: string, createdBy: string): Promise<TMailAddressBindingDeleteResponse>;
    private deleteMailAddressBindingInner;
    /**
     * Compute the workapp-generated routes and SMTP users for the given
     * candidate email config. Pure contribution — the final composition of
     * routes and the `auth` block is owned exclusively by SmtpAccountManager.
     */
    getStoredIdentityContribution(emailConfig: IUnifiedEmailServerOptions, identities?: IStoredWorkAppMailIdentity[] | undefined): Promise<IWorkAppMailRuntimeContribution>;
    applyStoredIdentitiesToRuntime(identities?: IStoredWorkAppMailIdentity[] | undefined): Promise<void>;
    private readStoredIdentities;
    private writeStoredIdentities;
    private buildInboundRoute;
    private buildOutboundRoute;
    private ensureEmailDomainConfigured;
    private getReadyOutboundDomains;
    private getActiveDkimSelector;
    private assertIdentityOutboundReady;
    private normalizeOwnership;
    private normalizeDomain;
    private normalizeLocalPart;
    private normalizeAddress;
    private normalizeMailboxAddress;
    private extractSingleHeaderFromAddress;
    private rejectSenderAuthorization;
    private normalizeMailResourceOwner;
    private normalizeMailAddressParts;
    private toLegacyInboundRoute;
    private normalizeInboundRoute;
    private toLegacyInboundRouteIfSmtpForward;
    private resolveNextInboundTarget;
    private normalizeInboundTarget;
    private getCanonicalInboundTarget;
    private getCachedEmailById;
    private buildMailDeliveryStatus;
    private mapDeliveryAttempts;
    private findQueueItemForCachedEmail;
    private getQueueItemCachedEmailId;
    private resolveCachedEmailOwner;
    private cachedEmailBelongsToIdentity;
    private getCachedEmailSessionUsername;
    private parseCachedEmailRouteData;
    private mapMailSpoolStatus;
    private toTimestamp;
    private authenticateMailCredential;
    private buildAuthenticatedSession;
    private buildOutboundRawMessage;
    private buildMimeBody;
    private buildTextHtmlPart;
    private buildBodyPart;
    private buildAttachmentPart;
    private getMessageRecipients;
    private toMailOutboundIdentity;
    private extractHeaders;
    private extractHeader;
    private sanitizeHeaderKey;
    private isProtectedOutboundHeader;
    private validateReplyTo;
    private sanitizeHeaderValue;
    private normalizeNewlines;
    private wrapBase64;
    private buildServiceMailAddressTag;
    private matchesOwnership;
    private matchesMailOwner;
    private buildExternalKey;
    private buildSmtpUsername;
    private buildMailOwnerKey;
    private buildRouteName;
    private buildOutboundRouteName;
    private hashExternalKey;
    private generateSmtpPassword;
    private isManagedSmtpUsername;
    private buildSmtpCredentials;
    private toMailCredentialPublic;
    private toMailCredentialSecret;
    private toMailOwner;
    private toMailInboundTarget;
    private toMailAddressBinding;
    private toWorkAppMailBinding;
    private toPublicIdentity;
}
export {};