import * as plugins from '../plugins.js';
import type { IGatewayCapabilities, IGatewayClient, IGatewayClientCredential, IGatewayClientProvisioningSpec, IGatewayClientContext, IGatewayClientOwnership, IGatewayClientRoute, IGatewayDnsRecord, IGatewayDomain, IGatewayIdentity, IGatewayRouteConfig, IGatewayRouteSyncResult, TGatewayRouteDnsMode, TGatewayClientProvisioningAction } from '../data/gateway.js';
import type { IMailOverviewDomain, IMailOverviewEmail } from './mail.js';
/**
 * Gateway client contracts: the machine-facing API a gateway (dcrouter)
 * serves to gateway clients (Onebox, Cloudly/Coreflow).
 *
 * Wire note: these methods are already deployed; auth fields stay top-level
 * (identity?/apiToken?) for wire compatibility, unlike the nested auth
 * envelope used by the newer mail contracts. The method strings
 * 'exportCertificate' and 'importCertificate' likewise keep their deployed
 * names and deliberately lack a gateway prefix.
 */
export interface IReq_GetGatewayCapabilities extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayCapabilities> {
    method: 'getGatewayCapabilities';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
    };
    response: {
        capabilities: IGatewayCapabilities;
    };
}
export interface IReq_GetGatewayClientContext extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayClientContext> {
    method: 'getGatewayClientContext';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
    };
    response: {
        context: IGatewayClientContext;
        capabilities: IGatewayCapabilities;
    };
}
/**
 * Admin-only gateway-client upsert and candidate credential issue.
 * Provisioning never revokes prior client-bound credentials. The returned
 * candidate must prove possession through finalizeGatewayClientCredential
 * before the gateway activates it and revokes superseded siblings.
 */
export interface IReq_ProvisionGatewayClientCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ProvisionGatewayClientCredential> {
    method: 'provisionGatewayClientCredential';
    request: {
        /** Admin authentication is intentionally kept at the deployed top level. */
        identity?: IGatewayIdentity;
        apiToken?: string;
        provisioning: IGatewayClientProvisioningSpec;
        credentialName?: string;
        expiresInDays?: number | null;
    };
    response: {
        success: true;
        action: TGatewayClientProvisioningAction;
        gatewayClient: IGatewayClient;
        /** One-time, unfinalized credential material returned after durable creation. */
        credential: IGatewayClientCredential;
        message?: string;
    } | {
        success: false;
        message: string;
    };
}
/**
 * Candidate-authenticated completion of a gateway-client credential handover.
 * The gateway resolves client ownership from the candidate token itself; the
 * caller cannot select a gateway client or finalize another credential.
 */
export interface IReq_FinalizeGatewayClientCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_FinalizeGatewayClientCredential> {
    method: 'finalizeGatewayClientCredential';
    request: {
        /** The one-time candidate token value returned by provisioning. */
        apiToken: string;
        /** Must identify the same candidate credential as apiToken. */
        tokenId: string;
        /** Admin/operator identities cannot finalize a candidate by substitution. */
        identity?: never;
    };
    response: {
        success: true;
        gatewayClientId: string;
        tokenId: string;
        revokedCredentialCount: number;
        finalizedAt: number;
        message?: string;
    } | {
        success: false;
        message: string;
    };
}
/** Gateway-client-scoped read-only email-domain and recent-email overview. */
export interface IReq_GetGatewayClientMailOverview extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayClientMailOverview> {
    method: 'getGatewayClientMailOverview';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
        limit?: number;
    };
    response: {
        domains: IMailOverviewDomain[];
        emails: IMailOverviewEmail[];
    };
}
/** Cheap gateway-client-owned count of distinct configured mail domains. */
export interface IReq_GetGatewayClientMailDomainCount extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayClientMailDomainCount> {
    method: 'getGatewayClientMailDomainCount';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
    };
    response: {
        count: number;
    };
}
export interface IReq_GetGatewayClientDomains extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayClientDomains> {
    method: 'getGatewayClientDomains';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
        gatewayClientId?: string;
    };
    response: {
        domains: IGatewayDomain[];
    };
}
export interface IReq_GetGatewayClientDnsRecords extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayClientDnsRecords> {
    method: 'getGatewayClientDnsRecords';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
        gatewayClientId?: string;
    };
    response: {
        records: IGatewayDnsRecord[];
    };
}
export interface IReq_GetGatewayClientRoutes extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayClientRoutes> {
    method: 'getGatewayClientRoutes';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
        gatewayClientId?: string;
    };
    response: {
        routes: IGatewayClientRoute[];
    };
}
export interface IReq_SyncGatewayClientRoute extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SyncGatewayClientRoute> {
    method: 'syncGatewayClientRoute';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
        ownership: IGatewayClientOwnership;
        route?: IGatewayRouteConfig;
        enabled?: boolean;
        delete?: boolean;
        /**
         * Omission means 'skip' for backward wire compatibility. Reconciliation
         * claims or replaces exact-host manual A, AAAA, and CNAME records even
         * when their current value already satisfies the desired address.
         */
        dnsMode?: TGatewayRouteDnsMode;
        /**
         * Provider-specific desired proxy state for the managed address record.
         * Omission preserves existing route intent and defaults new legacy routes to direct DNS.
         */
        dnsProxied?: boolean;
        /**
         * Gateway source profile to bind the route to (by ref or name).
         * Defaults to the gateway's public profile when omitted.
         */
        sourceProfileRef?: string;
    };
    response: IGatewayRouteSyncResult;
}
export interface IReq_ReprovisionCertificateDomain extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ReprovisionCertificateDomain> {
    method: 'reprovisionCertificateDomain';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
        domain: string;
        forceRenew?: boolean;
    };
    response: {
        success: boolean;
        message?: string;
    };
}
export interface IReq_ExportCertificate extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ExportCertificate> {
    method: 'exportCertificate';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
        domain: string;
    };
    response: {
        success: boolean;
        cert?: plugins.tsclass.network.ICert;
        message?: string;
    };
}
export interface IReq_ImportCertificate extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ImportCertificate> {
    method: 'importCertificate';
    request: {
        identity?: IGatewayIdentity;
        apiToken?: string;
        cert: plugins.tsclass.network.ICert;
    };
    response: {
        success: boolean;
        message?: string;
    };
}