import type { InteractionPlacement, NetworkRouteConfiguration, NetworkRouteConsistency } from "@opengeni/contracts";
type BrowserControllerAuthorityScope = {
    rootSecret: string;
    accountId: string;
    workspaceId: string;
    placement: InteractionPlacement;
    placementInstanceId: string;
};
type BrowserSessionAuthorityScope = BrowserControllerAuthorityScope & {
    browserSessionId: string;
    controllerGeneration: string;
    tokenGeneration: number;
};
type ComputerSessionAuthorityScope = BrowserControllerAuthorityScope & {
    computerSessionId: string;
    controllerGeneration: string;
    tokenGeneration: number;
};
/** Stable placement-admin authority. This token is installed owner-only inside
 * the exact placement and is never persisted or returned by the public API. */
export declare function deriveBrowserControllerAdminToken(scope: BrowserControllerAuthorityScope): string;
/** Deterministic controller credentials. The durable generations are the only
 * stored authority; plaintext tokens can be reconstructed only by API replicas
 * holding the deployment HMAC root. */
export declare function deriveBrowserSessionControllerTokens(scope: BrowserSessionAuthorityScope): {
    controlToken: string;
    viewToken: string;
};
/** Secret-safe durable identity for one exact route launch. The digest binds
 * the route snapshot and proxy credential without making a password-verifier
 * hash available to database readers. */
export declare function deriveBrowserNetworkRouteAuthorityDigest(scope: {
    rootSecret: string;
    accountId: string;
    workspaceId: string;
    browserSessionId: string;
    routeId: string;
    routeVersion: number;
    credentialVersion: number | null;
    configuration: NetworkRouteConfiguration;
    consistency: NetworkRouteConsistency;
    proxyCredential: {
        username: string;
        password: string;
    } | null;
}): string;
export declare function deriveBrowserViewGrantToken(scope: BrowserSessionAuthorityScope & {
    grantId: string;
    expiresAt: string;
}): string;
/** ComputerSession credentials share the placement controller root while using
 * resource-specific domains. Browser and computer authority cannot collide. */
export declare function deriveComputerSessionControllerTokens(scope: ComputerSessionAuthorityScope): {
    controlToken: string;
    viewToken: string;
};
export declare function deriveComputerViewGrantToken(scope: ComputerSessionAuthorityScope & {
    grantId: string;
    expiresAt: string;
}): string;
export {};