export declare function defaultRpxDir(): string;
export declare function getDnsStatePath(rpxDir?: string): string;
export declare function loadDnsState(rpxDir?: string): Promise<DnsState | null>;
export declare function saveDnsState(rpxDir: string, state: DnsState): Promise<void>;
export declare function clearDnsState(rpxDir: string): Promise<void>;
/**
 * Normalize a dev hostname. Returns null for localhost / IPs — those use /etc/hosts only.
 */
export declare function normalizeDevDomain(raw: string): string | null;
/**
 * macOS resolver basename for a dev domain.
 *
 * `/etc/resolver/<name>` captures that name **and every subdomain of it**, and a
 * captured name resolves only through rpx's DNS server. When that server is not
 * answering, every captured name stops resolving on the machine entirely.
 *
 * So the basename is the exact hostname for a real, publicly registered domain.
 * Collapsing `dashboard.stacksjs.com` to `stacksjs.com` claimed the apex and
 * with it every sibling - `mail.stacksjs.com`, `www.`, all of them - and when
 * rpx stopped answering, a mail client pointed at the real, running mail server
 * simply timed out, because the name no longer resolved. `dig` and `host` kept
 * working, which is what made it look like a server problem: they query DNS
 * directly and never consult `/etc/resolver`.
 *
 * Under a dev-only TLD the collapse is kept, because that is what makes one
 * `/etc/resolver/postline.test` serve `api.postline.test` too, and nothing real
 * can be shadowed there.
 *
 * This is the same reasoning that already forbids whole-TLD files like
 * `/etc/resolver/com`, applied one label further down.
 */
export declare function resolverBasenameForDomain(raw: string): string | null;
export declare function resolverBasenamesForDomains(domains: string[]): string[];
export declare function devDomainsFromHosts(hosts: string[]): string[];
export declare const DNS_STATE_VERSION: 1;
export declare const RPX_DNS_STATE_FILE: 'dns-state.json';
/** Single-label /etc/resolver files created by older rpx versions (whole-TLD hijack). */
export declare const LEGACY_TLD_RESOLVER_LABELS: readonly ['com', 'test', 'dev', 'app', 'page', 'local', 'localhost', 'example', 'invalid'];
/**
 * Top-level domains that exist only for development.
 *
 * Nothing real resolves under these, so collapsing to the registrable base is
 * free: taking all of `postline.test` cannot shadow a name anyone else needs.
 * A public TLD is the opposite case - see `resolverBasenameForDomain`.
 */
export declare const DEV_ONLY_TLDS: Set<string>;
export declare interface DnsState {
  version: typeof DNS_STATE_VERSION
  resolvers: string[]
  domains: string[]
  ownerPid: number | null
  updatedAt: string
}