import * as plugins from './plugins.js';
import type { IActiveSecretRecipientMetadata, IClusterRuntimeTargetSetReadyV1, IClusterRuntimeTargetV1, IClusterSecretDeploymentState, ICoreflowRuntimeCapabilities, IIdentityCredential, IResolvedSecretManifest, IResolvedSecretManifestReference, TSha256Digest, TSecretRecipientMetadata } from './data/index.js';
import { validateSecretRecipientMetadata } from './data/secret.js';
import type { IWorkloadInitActiveApprovalAuthorityV1, IWorkloadInitApprovalAuthorityReferenceV1 } from './runtime.workloadinit.js';
export * from './runtime.workloadinit.js';
export * from './runtime.corestore.js';
export * from './runtime.cloudlylegacydeploymentsettlement.js';
export interface ISealedResolvedSecretMaterialEntry {
    secretVersionId: string;
    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
}
/** Runtime-only material. No plaintext value is represented in this DTO. */
export interface ISealedResolvedSecretMaterial {
    schemaVersion: 1;
    /** Full schema-v2 value-free manifest used for digest and rollout verification. */
    manifest: IResolvedSecretManifest;
    /** Sorted exact coverage of the manifest's pinned versions. */
    entries: ISealedResolvedSecretMaterialEntry[];
}
export interface ISecretMaterialRequestFence {
    serviceId: string;
    imageRolloutId: string;
    imageRolloutGeneration: number;
    requestedImageDigest: TSha256Digest;
    secretRolloutId: string;
    secretRolloutGeneration: number;
    manifestId: string;
    manifestDigest: TSha256Digest;
    expectedRecipientKeyId: string;
}
/** Request fence plus trusted local scope derived from the verified cluster identity. */
export interface ISecretMaterialExpectation extends ISecretMaterialRequestFence {
    organizationId: string;
    clusterId: string;
}
/**
 * Parses every envelope with SmartCrypto, verifies its bound context digest,
 * and checks sorted exact version coverage. It never receives a private key
 * and never decrypts material.
 */
export declare const verifySealedResolvedSecretMaterial: (materialArg: unknown, expectedArg: ISecretMaterialExpectation) => Promise<boolean>;
/** Organization and cluster are derived exclusively from the verified cluster JWT. */
export interface IReq_GetResolvedSecretMaterial extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetResolvedSecretMaterial> {
    method: 'getResolvedSecretMaterial';
    request: ISecretMaterialRequestFence & {
        identity: IIdentityCredential;
    };
    response: {
        material: ISealedResolvedSecretMaterial;
    };
}
export interface ISecretRecipientEnrollmentChallengeV1 {
    schemaVersion: 1;
    enrollmentId: string;
    clusterId: string;
    recipientKeyId: string;
    publicKey: string;
    generation: number;
    expiresAt: number;
    /** Sealed random 32-byte challenge; plaintext is never persisted or returned. */
    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
}
/**
 * Cluster scope is derived from the JWT. The server persists only a one-time
 * challenge hash plus expiry and consumes it with generation CAS; reuse,
 * expiry, mismatch, and replay are rejected. Private keys and challenge
 * plaintext have no persistence DTO.
 */
export interface IReq_BeginSecretRecipientEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_BeginSecretRecipientEnrollment> {
    method: 'beginSecretRecipientEnrollment';
    request: {
        identity: IIdentityCredential;
        proposedRecipientKeyId: string;
        proposedPublicKey: string;
        expectedGeneration: number;
    };
    response: {
        challenge: ISecretRecipientEnrollmentChallengeV1;
    };
}
export interface IReq_CompleteSecretRecipientEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CompleteSecretRecipientEnrollment> {
    method: 'completeSecretRecipientEnrollment';
    request: {
        identity: IIdentityCredential;
        enrollmentId: string;
        expectedGeneration: number;
        /** Canonical unpadded base64url response containing exactly 32 bytes. */
        response: string;
    };
    response: {
        recipient: TSecretRecipientMetadata;
    };
}
export declare const validateBeginSecretRecipientEnrollmentRequest: (requestArg: unknown) => string[];
export declare const validateSecretRecipientEnrollmentChallenge: (challengeArg: unknown) => Promise<string[]>;
export declare const validateCompleteSecretRecipientEnrollmentRequest: (requestArg: unknown) => string[];
export { validateSecretRecipientMetadata };
/**
 * Reproducible binding persisted inside a trusted Cloudly mutation receipt.
 * This value alone does not prove that Cloudly admitted the envelope.
 */
export interface ISecretEnvelopeAdmissionBindingV1 {
    schemaVersion: 1;
    recipientKeyId: string;
    recipientGeneration: number;
    envelopeDigest: TSha256Digest;
    requestContextDigest: TSha256Digest;
}
export declare const createSecretEnvelopeDigestInput: (envelopeArg: unknown) => string;
export declare const computeSecretEnvelopeDigest: (envelopeArg: unknown) => Promise<TSha256Digest>;
export declare const computeSecretRequestContextDigest: (contextArg: Uint8Array) => Promise<TSha256Digest>;
export declare const validateSecretEnvelopeAdmissionBinding: (bindingArg: unknown) => string[];
export declare const createSecretEnvelopeAdmissionBinding: (recipientArg: IActiveSecretRecipientMetadata, envelopeArg: unknown, requestContextArg: Uint8Array) => Promise<ISecretEnvelopeAdmissionBindingV1>;
export declare const verifySecretEnvelopeAdmissionBinding: (bindingArg: unknown, envelopeArg: unknown, requestContextArg: Uint8Array) => Promise<boolean>;
export type TSecretRecipientEnrollmentStateV1 = {
    schemaVersion: 1;
    generation: 0;
    recipients: [];
} | {
    schemaVersion: 1;
    generation: number;
    recipients: TSecretRecipientMetadata[];
};
/** Cluster scope is derived exclusively from the verified cluster JWT. */
export interface IReq_GetSecretRecipientEnrollmentState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretRecipientEnrollmentState> {
    method: 'getSecretRecipientEnrollmentState';
    request: {
        identity: IIdentityCredential;
    };
    response: TSecretRecipientEnrollmentStateV1;
}
export declare const validateGetSecretRecipientEnrollmentStateRequest: (requestArg: unknown) => string[];
export declare const validateSecretRecipientEnrollmentState: (stateArg: unknown) => string[];
export interface ICoreflowSecretRuntimeNodeTargetV2 extends IClusterRuntimeTargetV1 {
}
export interface ICoreflowSecretRuntimeNodeEvidenceV2 extends ICoreflowSecretRuntimeNodeTargetV2 {
    workloadInitPlatformManifestDigest: TSha256Digest;
    workloadInitExecutableDigest: TSha256Digest;
}
export interface ICoreflowSecretRuntimeRegistrationExpectationV2 {
    expectationVersion: 2;
    expectationDigest: TSha256Digest;
    reporterSessionId: string;
    targetAuthority: IClusterRuntimeTargetSetReadyV1;
    workloadInitAuthority: IWorkloadInitActiveApprovalAuthorityV1;
    activeRecipient: IActiveSecretRecipientMetadata;
}
/** Dedicated TypedSocket tag carrying ICoreflowSecretRuntimeRegistrationV2. */
export declare const coreflowSecretRuntimeRegistrationTagId: "coreflowSecretRuntimeRegistration";
export type TCoreflowSecretRuntimeRegistrationExpectationResponseV2 = {
    status: 'available';
    expectation: ICoreflowSecretRuntimeRegistrationExpectationV2;
} | {
    status: 'unavailable';
    reason: 'recipient-unavailable' | 'workloadinit-unconfigured' | 'workloadinit-revoked' | 'targets-unavailable';
};
/** Cluster scope is derived exclusively from the verified cluster JWT. */
export interface IReq_GetCoreflowSecretRuntimeRegistrationExpectation extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetCoreflowSecretRuntimeRegistrationExpectation> {
    method: 'getCoreflowSecretRuntimeRegistrationExpectation';
    request: {
        identity: IIdentityCredential;
    };
    response: TCoreflowSecretRuntimeRegistrationExpectationResponseV2;
}
export declare const validateGetCoreflowSecretRuntimeRegistrationExpectationRequest: (requestArg: unknown) => string[];
export interface ICoreflowSecretRuntimeRegistrationV2 {
    registrationVersion: 2;
    expectationDigest: TSha256Digest;
    reporterSessionId: string;
    registeredAt: number;
    targetGeneration: number;
    targetSetDigest: TSha256Digest;
    targets: ICoreflowSecretRuntimeNodeTargetV2[];
    nodeEvidence: ICoreflowSecretRuntimeNodeEvidenceV2[];
    capabilities: ICoreflowRuntimeCapabilities;
    activeRecipient: IActiveSecretRecipientMetadata;
    workloadInitAuthority: IWorkloadInitApprovalAuthorityReferenceV1;
    workloadInitImageIndexDigest: TSha256Digest;
}
export declare const createCoreflowSecretRuntimeRegistrationExpectationDigestInput: (expectationArg: ICoreflowSecretRuntimeRegistrationExpectationV2) => string;
export declare const computeCoreflowSecretRuntimeRegistrationExpectationDigest: (expectationArg: ICoreflowSecretRuntimeRegistrationExpectationV2) => Promise<TSha256Digest>;
/**
 * Validates only a Cloudly-created expectation. It does not establish the
 * private DSSE trust decision or Spark manager consensus that produced it.
 */
export declare const validateCoreflowSecretRuntimeRegistrationExpectation: (expectationArg: unknown, trustedNowArg: number) => Promise<string[]>;
/**
 * Consumers discard this registration on transport disconnect, tag
 * removal/replacement, reporter-session change, or any expectation change.
 */
export declare const validateCoreflowSecretRuntimeRegistration: (registrationArg: unknown, expectationArg: unknown, trustedNowArg: number) => Promise<string[]>;
interface ISecretDeploymentReportBaseV1 {
    schemaVersion: 1;
    reporterSessionId: string;
    reportSequence: number;
    serviceId: string;
    expectedPlanRevision: number;
    desiredManifest: IResolvedSecretManifestReference;
    reportedAt: number;
    reportDigest: TSha256Digest;
}
export interface ISecretDeploymentApplyingReportV1 extends ISecretDeploymentReportBaseV1 {
    status: 'applying';
}
export interface ISecretDeploymentAppliedReportV1 extends ISecretDeploymentReportBaseV1 {
    status: 'applied';
    appliedManifest: IResolvedSecretManifestReference;
}
export interface ISecretDeploymentDriftedReportV1 extends ISecretDeploymentReportBaseV1 {
    status: 'drifted';
    observedManifest?: IResolvedSecretManifestReference;
    failureCode: string;
}
export interface ISecretDeploymentFailedReportV1 extends ISecretDeploymentReportBaseV1 {
    status: 'failed';
    failureCode: string;
}
export type TSecretDeploymentReportV1 = ISecretDeploymentApplyingReportV1 | ISecretDeploymentAppliedReportV1 | ISecretDeploymentDriftedReportV1 | ISecretDeploymentFailedReportV1;
export type TSecretDeploymentReportWithoutDigestV1 = Omit<ISecretDeploymentApplyingReportV1, 'reportDigest'> | Omit<ISecretDeploymentAppliedReportV1, 'reportDigest'> | Omit<ISecretDeploymentDriftedReportV1, 'reportDigest'> | Omit<ISecretDeploymentFailedReportV1, 'reportDigest'>;
export interface ISecretDeploymentReportResponseV1 {
    schemaVersion: 1;
    acceptedSequence: number;
    planRevision: number;
    clusterState: IClusterSecretDeploymentState;
}
export interface IReq_ReportSecretDeploymentState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ReportSecretDeploymentState> {
    method: 'reportSecretDeploymentState';
    request: TSecretDeploymentReportV1 & {
        identity: IIdentityCredential;
    };
    response: ISecretDeploymentReportResponseV1;
}
export declare const createSecretDeploymentReportDigestInput: (reportArg: TSecretDeploymentReportWithoutDigestV1 | TSecretDeploymentReportV1) => string;
export declare const computeSecretDeploymentReportDigest: (reportArg: TSecretDeploymentReportWithoutDigestV1 | TSecretDeploymentReportV1) => Promise<TSha256Digest>;
export declare const verifySecretDeploymentReportDigest: (reportArg: unknown) => Promise<boolean>;
/**
 * The expected cluster and reporter session come from the consumer's verified
 * live connection authority and are deliberately not accepted from the wire.
 */
export declare const validateSecretDeploymentReportRequest: (requestArg: unknown, expectedClusterIdArg: string, expectedReporterSessionIdArg: string) => Promise<string[]>;