/**
 * DNS authority — which zones dcrouter may answer for authoritatively.
 *
 * dcrouter used to derive this from exactly one place: the `dnsScopes` bootstrap
 * option, read once at startup from the OCI container config and never
 * reconciled against anything. That produced two independent representations of
 * the same fact — *declared* authority in bootstrap config and *real* delegation
 * in public DNS — with nothing comparing them. In production one zone was
 * declared while four others were live and delegated to our nameservers, so the
 * server answered `A` with the `aa` bit for those four while REFUSING every
 * other qtype for the same name, which public recursives turn into SERVFAIL.
 *
 * The fix is not to make the declared list editable. A list an operator can
 * simply append to is self-assertion, which is precisely the failure mode that
 * let routes claim domains nobody verified we own. Instead a zone earns
 * authority by *proof*: its public delegation must name our nameservers. That
 * proof is unforgeable by an ops-API caller — you cannot point `example.com`'s
 * NS records at our nameservers unless you actually control the domain — and it
 * is the missing comparison between the two representations.
 *
 * `dnsScopes` is gone entirely. There is exactly one representation of DNS
 * authority now, it lives in the database, and it is the one that carries its
 * own evidence.
 */
/**
 * How a zone entered the authority set.
 *
 * There is only one way in: an observed public delegation to our nameservers,
 * persisted with the evidence that justified it. Deployment configuration is
 * deliberately not an origin — a second origin would be a second representation
 * of the same fact, and two representations drift.
 */
export type TDnsAuthorityZoneOrigin = 'verified';
/** One zone in the authority set. */
export interface IDnsAuthorityZone {
    zone: string;
    origin: TDnsAuthorityZoneOrigin;
    /** When the delegation proof was observed. */
    verifiedAt?: number;
    /** Nameservers observed at verification time — the evidence for the proof. */
    observedNameservers?: string[];
    /** Operator who performed the verification. */
    verifiedBy?: string;
}
/**
 * Whether the stored authority set could be read at all.
 *
 * 'unavailable' is deliberately distinct from an empty `zones` array. An empty
 * set is a *known* fact that means "claim nothing"; an unreadable document is
 * an *unknown*, and silently rendering an unknown as an empty set is what would
 * turn a database blip into every zone dropping off the air.
 */
export type TDnsAuthorityState = 'loaded' | 'unavailable';
export interface IDnsAuthoritySettings {
    /** The authority set. Delegation-verified zones, and nothing else. */
    zones: IDnsAuthorityZone[];
    /** Whether the stored set was readable when it was last loaded. */
    state: TDnsAuthorityState;
    /** Nameservers a delegation must name for a zone to be verifiable. */
    expectedNameservers: string[];
    updatedAt: number;
    updatedBy: string;
}
/**
 * Outcome of a delegation probe.
 *
 * 'undeterminable' is deliberately distinct from 'not-delegated': a resolver
 * timeout is not evidence that a zone is not ours. Conflating them would let a
 * transient network fault revoke authority, turning a blip into an outage.
 */
export type TDnsDelegationVerdict = 'delegated' | 'not-delegated' | 'undeterminable';
export interface IDnsDelegationProbe {
    zone: string;
    verdict: TDnsDelegationVerdict;
    /** NS records observed for the zone, lowercased and trailing-dot stripped. */
    observedNameservers: string[];
    expectedNameservers: string[];
    detail: string;
}
/** A disagreement between claimed authority and what is actually true. */
export type TDnsAuthorityDriftKind = 
/** A dcrouter-hosted zone is delegated to us but is not in the authority set. */
'delegated-but-unclaimed'
/** A verified zone's delegation no longer names our nameservers. */
 | 'claimed-but-not-delegated'
/**
 * A verified zone with no dcrouter-hosted domain behind it. Authority without
 * a `DomainDoc` serves no records and no generated apex NS, so the zone is
 * claimed and empty — a lame delegation we are responsible for.
 */
 | 'verified-but-unhosted';
export interface IDnsAuthorityDrift {
    zone: string;
    kind: TDnsAuthorityDriftKind;
    observedNameservers: string[];
    expectedNameservers: string[];
    detail: string;
}