/**
 * Client-side domain gate: a safety net configured on `createGatedClient`
 * via `deniedDomains` / `allowedDomains` that stops domain-touching
 * MUTATIONS (POST/PUT/PATCH/DELETE) before any request reaches the API.
 * Reads are never gated.
 *
 * Entries are exact domain names ("example.ro") or wildcards
 * ("*.example.ro", matching any name under example.ro and the bare suffix
 * itself). Matching is case-insensitive and ignores trailing dots. Deny wins
 * over allow; when `allowedDomains` is set, anything not on it is denied.
 *
 * Because many registration endpoints address domains by registration id,
 * the gate fetches the account's registrations once at creation and keeps
 * an id → domain cache. Ids unknown to the cache (registered after the
 * client was created) are resolved with a single GET
 * /domains/registrations/{id} and cached; ids that still cannot be resolved
 * pass under a pure deny-list but FAIL CLOSED under an allow-list.
 * `refreshGate` re-fetches the whole cache.
 */
import type { Client } from './client.js';
export type GateRules = Readonly<{
    /** Names/patterns this client must never mutate, even though the account could. */
    deniedDomains?: readonly string[];
    /** When set, ONLY these names/patterns may be mutated; an empty list denies everything. */
    allowedDomains?: readonly string[];
}>;
export type Gate = Readonly<{
    rules: GateRules;
    /** registration id → normalized domain name */
    registrations: Map<string, string>;
}>;
/** What a gated operation is about to touch. */
export type GateTarget = Readonly<{
    domain: string | null | undefined;
} | {
    registrationId: string | null | undefined;
}>;
/** Lower-case, trimmed, no trailing dots; undefined for blank input. */
export declare const normalizeDomain: (domain: string | null | undefined) => string | undefined;
/**
 * Return a copy of CLIENT with a domain gate attached. Eagerly builds the
 * registration id → domain cache, which requires an authenticated client.
 */
export declare const attachGate: (client: Client, rules: GateRules) => Promise<Client>;
/**
 * Re-fetch the registration cache of CLIENT's gate (for long-lived clients
 * that registered domains after creation). Returns the refreshed map, or
 * undefined when the client has no gate.
 */
export declare const refreshGate: (client: Client) => Promise<ReadonlyMap<string, string> | undefined>;
/**
 * Assert that the mutation OP (e.g. "POST /domains/registrations") may touch
 * TARGET, throwing a domainDenied error otherwise. A no-op for clients
 * without a gate. Registration ids are resolved through the gate's cache,
 * with a miss falling back to a single-registration fetch.
 */
export declare const checkGate: (client: Client, op: string, target: GateTarget) => Promise<void>;