import { type KeyObject } from "node:crypto";
import { type CodexV3CredentialEnvelope, type CodexV3CredentialIngress, type CodexV3FullCredentialDeliveryResponse, type CodexV3FullCredentialBundle, type CodexShortLivedDeliveryClientKey, type CodexTokenPoolV4AssignmentTarget, type CodexV5CreateDeviceSessionResponse, type CodexV5DeviceSessionBundle, type CodexV6FullCredentialDeliveryResponse, type CodexV6FullCredentialBundle } from "./protocol.js";
export interface CodexV3FullCredentialInput {
    refreshToken: string;
    accessToken: string;
    idToken: string;
    providerAccountId: string;
    expiresAt: string;
}
export interface CodexV3DeliveryKeyPair {
    clientKey: CodexShortLivedDeliveryClientKey;
    privateKey: KeyObject;
}
export declare function codexV3GenerationReportAad(input: {
    tenantId: string;
    subject: string;
    lineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "ROTATED" | "RETAINED";
    keyId: string;
}): Buffer;
export declare function codexV5GenerationReportAad(input: {
    tenantId: string;
    subject: string;
    lineageId: string;
    sessionId: string;
    installationId: string;
    authorityEpoch: number;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "ROTATED" | "RETAINED";
    keyId: string;
}): Buffer;
export declare function sealCodexV3GenerationReport(input: {
    tenantId: string;
    subject: string;
    lineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "ROTATED" | "RETAINED";
    ingress: CodexV3CredentialIngress;
    credentials: CodexV3FullCredentialInput;
}): CodexV3CredentialEnvelope;
export declare function sealCodexV5GenerationReport(input: {
    tenantId: string;
    subject: string;
    lineageId: string;
    sessionId: string;
    installationId: string;
    authorityEpoch: number;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "ROTATED" | "RETAINED";
    ingress: CodexV3CredentialIngress;
    credentials: CodexV3FullCredentialInput;
}): CodexV3CredentialEnvelope;
export declare function codexV6GenerationReportAad(input: {
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    installationId: string;
    credentialLineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "ROTATED" | "RETAINED";
    keyId: string;
}): Buffer;
export declare function sealCodexV6GenerationReport(input: {
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    installationId: string;
    credentialLineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "ROTATED" | "RETAINED";
    ingress: CodexV3CredentialIngress;
    credentials: CodexV3FullCredentialInput;
}): CodexV3CredentialEnvelope;
export declare function codexTokenPoolV4UploadAad(input: {
    tenantId: string;
    uploaderSubject: string;
    target: CodexTokenPoolV4AssignmentTarget;
    clientRequestId: string;
    idempotencyKey: string;
    keyId: string;
}): Buffer;
export declare function sealCodexTokenPoolV4Upload(input: {
    tenantId: string;
    uploaderSubject: string;
    target: CodexTokenPoolV4AssignmentTarget;
    clientRequestId: string;
    idempotencyKey: string;
    ingress: CodexV3CredentialIngress;
    credentials: CodexV3FullCredentialInput;
}): CodexV3CredentialEnvelope;
export declare function createCodexV3DeliveryKeyPair(): CodexV3DeliveryKeyPair;
export declare function codexV3FullDeliveryAad(input: {
    tenantId: string;
    delivery: CodexV3FullCredentialDeliveryResponse["delivery"];
}): Buffer;
export declare function openCodexV3FullCredentialDelivery(input: {
    tenantId: string;
    response: CodexV3FullCredentialDeliveryResponse;
    privateKey: KeyObject;
    now?: number;
}): CodexV3FullCredentialBundle;
export declare function codexV5DeviceSessionAad(input: {
    tenantId: string;
    subject: string;
    session: CodexV5CreateDeviceSessionResponse["session"];
}): Buffer;
export declare function openCodexV5DeviceSession(input: {
    tenantId: string;
    subject: string;
    response: CodexV5CreateDeviceSessionResponse;
    privateKey: KeyObject;
    now?: number;
}): CodexV5DeviceSessionBundle;
export declare function codexV6FullCredentialDeliveryAad(input: {
    tenantId: string;
    subject: string;
    delivery: Omit<CodexV6FullCredentialDeliveryResponse["delivery"], "envelope">;
}): Buffer;
export declare function openCodexV6FullCredentialDelivery(input: {
    tenantId: string;
    subject: string;
    response: CodexV6FullCredentialDeliveryResponse;
    privateKey: KeyObject;
    now?: number;
    allowExpiredCredential?: boolean;
}): CodexV6FullCredentialBundle;