import * as plugins from './plugins.js';
import type { IActiveSecretRecipientMetadata, IIdentityCredential, ISecretVersionReference } from './data/index.js';
import type { ISecretEnvelopeAdmissionBindingV1 } from './runtime.js';
import type { IObjectStorageRetentionIntentV1, IObjectStorageRetentionEvidenceExpectationV1, IObjectStorageRetentionEvidenceV1 } from './platform/objectstorageretention.js';
export type TCorestoreCredentialCapability = 'database' | 'objectstorage';
export declare const corestoreProviderConfigIds: Readonly<{
    readonly database: "cloudly-corestore-database";
    readonly objectstorage: "cloudly-corestore-objectstorage";
}>;
export declare const corestoreControlUrl: "http://corestore:3000";
export declare const corestoreCredentialManagementScope: "platform:cloudly-corestore";
export declare const corestoreControlCredentialKey: "CORESTORE_API_TOKEN";
export declare const corestoreCredentialEnvironment: "production";
export declare const corestoreCredentialRuntimeLimits: Readonly<{
    maximumIdentifierLength: 200;
    maximumPublicationGrants: 256;
    maximumGrantLifetimeMs: number;
    maximumCredentialStringBytes: number;
    maximumSealedMaterialBytes: number;
    minimumControlTokenBytes: 32;
    maximumControlTokenBytes: 4096;
    maximumSealedControlCredentialBytes: number;
}>;
export declare const getCorestoreProviderConfigId: (capabilityArg: TCorestoreCredentialCapability) => (typeof corestoreProviderConfigIds)[TCorestoreCredentialCapability];
export interface ICorestoreControlCredentialPlaintextV1 {
    schemaVersion: 1;
    key: typeof corestoreControlCredentialKey;
    environment: typeof corestoreCredentialEnvironment;
    value: string;
}
export interface ICorestoreControlCredentialMaterialV1 {
    schemaVersion: 1;
    requestId: string;
    clusterId: string;
    capability: TCorestoreCredentialCapability;
    providerConfigId: typeof corestoreProviderConfigIds[TCorestoreCredentialCapability];
    controlUrl: typeof corestoreControlUrl;
    managementScope: typeof corestoreCredentialManagementScope;
    key: typeof corestoreControlCredentialKey;
    environment: typeof corestoreCredentialEnvironment;
    recipientKeyId: string;
    recipientGeneration: number;
    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
}
export interface IReq_GetCorestoreControlCredentialMaterial extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetCorestoreControlCredentialMaterial> {
    method: 'getCorestoreControlCredentialMaterial';
    request: {
        identity: IIdentityCredential;
        requestId: string;
        capability: TCorestoreCredentialCapability;
        expectedRecipientKeyId: string;
        expectedRecipientGeneration: number;
    };
    response: {
        material: ICorestoreControlCredentialMaterialV1;
    };
}
export interface ICorestoreControlCredentialMaterialExpectationV1 {
    requestId: string;
    clusterId: string;
    capability: TCorestoreCredentialCapability;
    expectedRecipientKeyId: string;
    expectedRecipientGeneration: number;
}
export interface ICorestoreControlCredentialMaterialContextInputV1 {
    requestId: string;
    clusterId: string;
    capability: TCorestoreCredentialCapability;
    recipientKeyId: string;
    recipientGeneration: number;
}
export declare const isCorestoreControlToken: (valueArg: unknown) => valueArg is string;
export declare const createCorestoreControlCredentialPlaintextBytes: (tokenBytesArg: Uint8Array) => Uint8Array | undefined;
export declare const validateGetCorestoreControlCredentialMaterialRequest: (requestArg: unknown, activeRecipientArg: IActiveSecretRecipientMetadata) => string[];
export declare const createCorestoreControlCredentialMaterialEnvelopeContext: (materialArg: ICorestoreControlCredentialMaterialContextInputV1) => Uint8Array;
export declare const validateCorestoreControlCredentialPlaintext: (plaintextArg: unknown) => string[];
export declare const validateCorestoreControlCredentialMaterial: (materialArg: unknown, expectedArg: ICorestoreControlCredentialMaterialExpectationV1) => Promise<string[]>;
export interface ICorestoreCredentialPublicationGrantV1 {
    schemaVersion: 1;
    operationId: string;
    serviceId: string;
    bindingId: string;
    capability: TCorestoreCredentialCapability;
    reconciliationGeneration: number;
    expectedTargetSecretsRevision: number;
    bindingRequestDigest: string;
    issuedAt: number;
    expiresAt: number;
}
interface ICorestoreCredentialBindingRequestBaseV1 {
    schemaVersion: 1;
    serviceId: string;
    bindingId: string;
    providerConfigId: typeof corestoreProviderConfigIds[TCorestoreCredentialCapability];
    managementScope: typeof corestoreCredentialManagementScope;
    environment: typeof corestoreCredentialEnvironment;
}
export type TCorestoreCredentialBindingRequestV1 = ICorestoreCredentialBindingRequestBaseV1 & {
    capability: 'database';
} | ICorestoreCredentialBindingRequestBaseV1 & {
    capability: 'objectstorage';
    objectstorageRetention?: IObjectStorageRetentionIntentV1;
};
interface ICorestoreCredentialBindingRequestBaseV2 {
    schemaVersion: 2;
    serviceId: string;
    bindingId: string;
    providerConfigId: typeof corestoreProviderConfigIds[TCorestoreCredentialCapability];
    managementScope: typeof corestoreCredentialManagementScope;
    environment: typeof corestoreCredentialEnvironment;
}
export type TCorestoreCredentialBindingRequestV2 = ICorestoreCredentialBindingRequestBaseV2 & {
    capability: 'database';
} | ICorestoreCredentialBindingRequestBaseV2 & {
    capability: 'objectstorage';
    bucketName: string;
    objectstorageRetention?: IObjectStorageRetentionIntentV1;
};
export declare const validateCorestoreCredentialBindingRequest: (requestArg: unknown) => string[];
export declare const createCorestoreCredentialBindingRequestDigestInput: (requestArg: TCorestoreCredentialBindingRequestV1) => string;
export declare const computeCorestoreCredentialBindingRequestSha256: (requestArg: TCorestoreCredentialBindingRequestV1) => Promise<string>;
export declare const validateCorestoreCredentialBindingRequestV2: (requestArg: unknown) => string[];
export declare const createCorestoreCredentialBindingRequestDigestInputV2: (requestArg: TCorestoreCredentialBindingRequestV2) => string;
export declare const computeCorestoreCredentialBindingRequestSha256V2: (requestArg: TCorestoreCredentialBindingRequestV2) => Promise<string>;
export declare const validateCorestoreCredentialPublicationGrant: (grantArg: unknown, trustedNowArg?: number) => string[];
export declare const corestoreCredentialPublicationGrantsEqual: (leftArg: unknown, rightArg: unknown) => boolean;
export declare const validateCorestoreCredentialPublicationGrants: (grantsArg: unknown, trustedNowArg?: number) => string[];
export declare const corestoreDatabaseCredentialKeys: readonly ["MONGODB_URI", "MONGODB_URL", "MONGO_URL", "MONGODB_HOST", "MONGODB_PORT", "MONGODB_DATABASE", "MONGO_DBNAME", "MONGODB_USERNAME", "MONGO_DBUSER", "MONGODB_PASSWORD", "MONGO_DBPASS"];
export declare const corestoreObjectStorageCredentialPlaintextKeys: readonly ["accessKeyId", "secretAccessKey"];
export declare const corestoreObjectStorageCredentialSecretKeys: readonly ["S3_ACCESS_KEY", "S3_ACCESS_KEY_ID", "S3_SECRET_KEY", "S3_SECRET_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
export type TCorestoreDatabaseCredentialKey = typeof corestoreDatabaseCredentialKeys[number];
export type TCorestoreObjectStorageCredentialPlaintextKey = typeof corestoreObjectStorageCredentialPlaintextKeys[number];
export type TCorestoreObjectStorageCredentialSecretKey = typeof corestoreObjectStorageCredentialSecretKeys[number];
export type TCorestoreCredentialPlaintextKey = TCorestoreDatabaseCredentialKey | TCorestoreObjectStorageCredentialPlaintextKey;
export type TCorestoreCredentialSecretKey = TCorestoreDatabaseCredentialKey | TCorestoreObjectStorageCredentialSecretKey;
export type TCorestoreDatabaseCredentialValuesV1 = {
    [TKey in TCorestoreDatabaseCredentialKey]: string;
};
export interface ICorestoreDatabaseCredentialPlaintextMaterialV1 {
    schemaVersion: 1;
    capability: 'database';
    values: TCorestoreDatabaseCredentialValuesV1;
}
export interface ICorestoreObjectStorageCredentialPlaintextMaterialV1 {
    schemaVersion: 1;
    capability: 'objectstorage';
    values: {
        accessKeyId: string;
        secretAccessKey: string;
    };
    retention?: IObjectStorageRetentionEvidenceV1;
}
export type TCorestoreCredentialPlaintextMaterialV1 = ICorestoreDatabaseCredentialPlaintextMaterialV1 | ICorestoreObjectStorageCredentialPlaintextMaterialV1;
export declare const validateCorestoreDatabaseCredentialMaterial: (materialArg: unknown) => string[];
export declare const validateCorestoreObjectStorageCredentialMaterial: (materialArg: unknown, retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectationV1) => Promise<string[]>;
export declare const validateCorestoreCredentialPlaintextMaterial: (materialArg: unknown, retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectationV1) => Promise<string[]>;
export interface ICorestoreCredentialSecretValueV1 {
    key: TCorestoreCredentialSecretKey;
    value: string;
}
export declare const createCorestoreCredentialSecretValues: (materialArg: TCorestoreCredentialPlaintextMaterialV1, retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectationV1) => Promise<ICorestoreCredentialSecretValueV1[]>;
export interface IPublishCorestoreCredentialMaterialRequestV1 {
    identity: IIdentityCredential;
    mutationId: string;
    grant: ICorestoreCredentialPublicationGrantV1;
    expectedIngressRecipientKeyId: string;
    expectedIngressRecipientGeneration: number;
    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
}
export interface ICorestoreCredentialSecretVersionReferenceV1 extends ISecretVersionReference {
    key: TCorestoreCredentialSecretKey;
}
export interface ICorestoreCredentialPublicationCoverageV1 {
    keys: TCorestoreCredentialSecretKey[];
    versionReferences: ICorestoreCredentialSecretVersionReferenceV1[];
}
export interface ICorestoreCredentialPublicationReceiptV1 {
    schemaVersion: 1;
    mutationId: string;
    organizationId: string;
    clusterId: string;
    serviceId: string;
    bindingId: string;
    capability: TCorestoreCredentialCapability;
    grant: ICorestoreCredentialPublicationGrantV1;
    coverage: ICorestoreCredentialPublicationCoverageV1;
    expectedTargetSecretsRevision: number;
    targetSecretsRevision: number;
    ingressAdmissionBinding: ISecretEnvelopeAdmissionBindingV1;
    acceptedAt: number;
    replayed: boolean;
}
export interface IReq_PublishCorestoreCredentialMaterial extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PublishCorestoreCredentialMaterial> {
    method: 'publishCorestoreCredentialMaterial';
    request: IPublishCorestoreCredentialMaterialRequestV1;
    response: {
        receipt: ICorestoreCredentialPublicationReceiptV1;
    };
}
export declare const createPublishCorestoreCredentialMaterialEnvelopeContext: (requestArg: Omit<IPublishCorestoreCredentialMaterialRequestV1, "identity" | "envelope">) => Uint8Array;
export declare const validatePublishCorestoreCredentialMaterialRequest: (requestArg: unknown, expectedGrantArg: ICorestoreCredentialPublicationGrantV1, activeRecipientArg: IActiveSecretRecipientMetadata, trustedNowArg: number) => Promise<string[]>;
export interface ICorestoreCredentialPublicationReceiptExpectationV1 {
    request: IPublishCorestoreCredentialMaterialRequestV1;
    organizationId: string;
    clusterId: string;
}
export declare const validateCorestoreCredentialPublicationReceipt: (receiptArg: unknown, expectedArg: ICorestoreCredentialPublicationReceiptExpectationV1) => Promise<string[]>;
export declare const corestoreCredentialPublicationErrorMetadata: Readonly<{
    readonly INVALID_IDENTITY: Readonly<{
        retryable: false;
    }>;
    readonly INVALID_REQUEST: Readonly<{
        retryable: false;
    }>;
    readonly GRANT_EXPIRED: Readonly<{
        retryable: false;
    }>;
    readonly GRANT_SCOPE_MISMATCH: Readonly<{
        retryable: false;
    }>;
    readonly GRANT_REVISION_MISMATCH: Readonly<{
        retryable: true;
    }>;
    readonly INGRESS_RECIPIENT_MISMATCH: Readonly<{
        retryable: true;
    }>;
    readonly ENVELOPE_INVALID: Readonly<{
        retryable: false;
    }>;
    readonly MATERIAL_INVALID: Readonly<{
        retryable: false;
    }>;
    readonly SECRETS_REVISION_CONFLICT: Readonly<{
        retryable: true;
    }>;
    readonly REPLAY_CONFLICT: Readonly<{
        retryable: false;
    }>;
    readonly INTERNAL_ERROR: Readonly<{
        retryable: true;
    }>;
}>;
export type TCorestoreCredentialPublicationErrorCode = keyof typeof corestoreCredentialPublicationErrorMetadata;
export interface ICorestoreCredentialPublicationErrorMetadataV1 {
    schemaVersion: 1;
    code: TCorestoreCredentialPublicationErrorCode;
    retryable: boolean;
}
export declare const getCorestoreCredentialPublicationErrorMetadata: (codeArg: TCorestoreCredentialPublicationErrorCode) => ICorestoreCredentialPublicationErrorMetadataV1;
export declare const corestoreDatabaseBackupRuntimeLimits: Readonly<{
    maximumControlBytes: number;
    maximumClosureBytes: number;
    maximumVerifiedPlaintextBytes: number;
    maximumSnapshotPayloadBytes: number;
    maximumSnapshotOriginalBytes: number;
    maximumClosureObjects: 4096;
    maximumClosureChunks: 1000000;
    maximumServiceNameBytes: 1024;
}>;
export interface ICorestoreDatabaseAllocationReference {
    purpose: 'scratch-rehearsal';
    rehearsalId: string;
    allocationId: string;
    generation: number;
    bindingSha256: string;
    receiptSha256: string;
}
export interface ICorestoreDatabaseBackupSnapshotTags {
    corestore: 'resource';
    serviceId: string;
    serviceName: string;
    capability: 'database';
    resourceName: string;
    snapshotName: string;
    backupId: string;
}
export interface ICorestoreDatabaseBackupSnapshot {
    capability: 'database';
    resourceName: string;
    snapshotId: string;
    snapshotName: string;
    originalSize: number;
    storedSize: number;
    createdAt: number;
    tags: ICorestoreDatabaseBackupSnapshotTags;
    databaseName: string;
    databaseAllocation?: ICorestoreDatabaseAllocationReference;
}
export interface ICorestoreDatabaseBackupClosureReceipt {
    formatVersion: 1;
    snapshotIds: [string];
    objectCount: number;
    packCount: number;
    chunkCount: number;
    payloadBytes: number;
    archiveBytes: number;
    sha256: string;
}
export interface ICorestoreDatabaseBackupReceipt {
    schemaVersion: 1;
    format: 'corestore.database.backup.v1';
    backupId: string;
    sourceServiceId: string;
    createdAt: number;
    snapshot: ICorestoreDatabaseBackupSnapshot;
    closure: ICorestoreDatabaseBackupClosureReceipt;
}
export interface ICorestoreDatabaseBackupRestoreRequest {
    schemaVersion: 1;
    targetServiceId: string;
    receipt: ICorestoreDatabaseBackupReceipt;
    expectedDatabaseAllocation?: ICorestoreDatabaseAllocationReference;
    /** Caller-owned idempotency identity. A new value forces a new fenced restore attempt. */
    restoreAttemptId?: string;
}
export interface ICorestoreDatabaseBackupRestoreResponse {
    schemaVersion: 1;
    ok: true;
    backupId: string;
    sourceServiceId: string;
    targetServiceId: string;
    snapshotId: string;
    restoreId: string;
    requestSha256: string;
    replayed: boolean;
}
export declare const normalizeCorestoreDatabaseAllocationReference: (valueArg: unknown) => Readonly<ICorestoreDatabaseAllocationReference>;
export declare const normalizeCorestoreDatabaseBackupReceipt: (valueArg: unknown) => Readonly<ICorestoreDatabaseBackupReceipt>;
export declare const normalizeCorestoreDatabaseBackupRestoreRequest: (valueArg: unknown) => Readonly<ICorestoreDatabaseBackupRestoreRequest>;
export declare const normalizeCorestoreDatabaseBackupRestoreResponse: (valueArg: unknown) => Readonly<ICorestoreDatabaseBackupRestoreResponse>;
export declare const encodeCorestoreDatabaseAllocationReference: (valueArg: unknown) => Uint8Array;
export declare const encodeCorestoreDatabaseBackupReceipt: (valueArg: unknown) => Uint8Array;
export declare const encodeCorestoreDatabaseBackupRestoreRequest: (valueArg: unknown) => Uint8Array;
export declare const encodeCorestoreDatabaseBackupRestoreResponse: (valueArg: unknown) => Uint8Array;
export declare const computeCorestoreDatabaseAllocationReferenceSha256: (valueArg: unknown) => Promise<string>;
export declare const computeCorestoreDatabaseBackupReceiptSha256: (valueArg: unknown) => Promise<string>;
export declare const computeCorestoreDatabaseBackupRestoreRequestSha256: (valueArg: unknown) => Promise<string>;
export declare const computeCorestoreDatabaseBackupRestoreResponseSha256: (valueArg: unknown) => Promise<string>;
export {};