import { type KeyObject } from "node:crypto";
import { z } from "zod";
import { CodexShortLivedDeliveryClientKeySchema } from "./protocol.js";
declare const EnrollmentJournalSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<3>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
    kind: z.ZodLiteral<"ENROLLMENT">;
    providerAccountId: z.ZodString;
    envelope: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        keyId: z.ZodString;
        ephemeralPublicKey: z.ZodString;
        salt: z.ZodString;
        nonce: z.ZodString;
        ciphertext: z.ZodString;
        authenticationTag: z.ZodString;
    }, z.core.$strict>;
}, z.core.$strict>;
declare const DeliveryJournalSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<3>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
    kind: z.ZodLiteral<"DELIVERY">;
    enrollmentId: z.ZodString;
    assignmentId: z.ZodString;
    managedAccountId: z.ZodString;
    providerAccountId: z.ZodString;
    lineageId: z.ZodString;
    generationVersion: z.ZodNumber;
    clientKey: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        publicKey: z.ZodString;
    }, z.core.$strict>;
    privateKeyPkcs8: z.ZodString;
    ackIdempotencyKey: z.ZodString;
}, z.core.$strict>;
declare const ReportJournalSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<3>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
    kind: z.ZodLiteral<"REPORT">;
    lineageId: z.ZodString;
    expectedGenerationVersion: z.ZodNumber;
    rotationMode: z.ZodEnum<{
        RETAINED: "RETAINED";
        ROTATED: "ROTATED";
    }>;
    envelope: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        keyId: z.ZodString;
        ephemeralPublicKey: z.ZodString;
        salt: z.ZodString;
        nonce: z.ZodString;
        ciphertext: z.ZodString;
        authenticationTag: z.ZodString;
    }, z.core.$strict>;
    accessTokenHealth: z.ZodEnum<{
        EXPIRED: "EXPIRED";
        HEALTHY: "HEALTHY";
        REJECTED: "REJECTED";
        UNKNOWN: "UNKNOWN";
    }>;
    refreshTokenHealth: z.ZodEnum<{
        HEALTHY: "HEALTHY";
        REJECTED: "REJECTED";
        UNKNOWN: "UNKNOWN";
    }>;
    observedAt: z.ZodString;
    credentialExpiresAt: z.ZodString;
    accessTokenDigest: z.ZodString;
    refreshTokenDigest: z.ZodString;
    idTokenDigest: z.ZodString;
}, z.core.$strict>;
declare const OperationJournalSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
    schemaVersion: z.ZodLiteral<3>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
    kind: z.ZodLiteral<"ENROLLMENT">;
    providerAccountId: z.ZodString;
    envelope: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        keyId: z.ZodString;
        ephemeralPublicKey: z.ZodString;
        salt: z.ZodString;
        nonce: z.ZodString;
        ciphertext: z.ZodString;
        authenticationTag: z.ZodString;
    }, z.core.$strict>;
}, z.core.$strict>, z.ZodObject<{
    schemaVersion: z.ZodLiteral<3>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
    kind: z.ZodLiteral<"DELIVERY">;
    enrollmentId: z.ZodString;
    assignmentId: z.ZodString;
    managedAccountId: z.ZodString;
    providerAccountId: z.ZodString;
    lineageId: z.ZodString;
    generationVersion: z.ZodNumber;
    clientKey: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        publicKey: z.ZodString;
    }, z.core.$strict>;
    privateKeyPkcs8: z.ZodString;
    ackIdempotencyKey: z.ZodString;
}, z.core.$strict>], "kind">;
export type ManagedCodexV3OperationJournal = z.infer<typeof OperationJournalSchema>;
export type ManagedCodexV3EnrollmentJournal = z.infer<typeof EnrollmentJournalSchema>;
export type ManagedCodexV3DeliveryJournal = z.infer<typeof DeliveryJournalSchema>;
export type ManagedCodexV3ReportJournal = z.infer<typeof ReportJournalSchema>;
export declare function readManagedCodexV3OperationJournal(env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3OperationJournal | undefined>;
export declare function readManagedCodexV3ReportJournal(env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3ReportJournal | undefined>;
export declare function writeManagedCodexV3OperationJournal(value: ManagedCodexV3OperationJournal, env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3OperationJournal>;
export declare function writeManagedCodexV3ReportJournal(value: ManagedCodexV3ReportJournal, env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3ReportJournal>;
export declare function writeManagedCodexV4DeliveryJournal(input: {
    tenantId: string;
    subject: string;
    assignmentId: string;
    managedAccountId: string;
    providerAccountId: string;
    lineageId: string;
    generationVersion: number;
    clientRequestId: string;
    idempotencyKey: string;
    ackIdempotencyKey: string;
    clientKey: z.infer<typeof CodexShortLivedDeliveryClientKeySchema>;
    privateKey: KeyObject;
    now: number;
    env?: NodeJS.ProcessEnv;
}): Promise<ManagedCodexV3DeliveryJournal>;
export declare function replaceManagedCodexV3OperationWithDelivery(input: {
    previous: ManagedCodexV3EnrollmentJournal;
    delivery: Omit<ManagedCodexV3DeliveryJournal, "schemaVersion" | "kind" | "createdAt" | "updatedAt" | "privateKeyPkcs8">;
    privateKey: KeyObject;
    now: number;
    env?: NodeJS.ProcessEnv;
}): Promise<ManagedCodexV3DeliveryJournal>;
export declare function replaceExpiredManagedCodexV3Delivery(input: {
    previous: ManagedCodexV3DeliveryJournal;
    replacement: Pick<ManagedCodexV3DeliveryJournal, "clientRequestId" | "idempotencyKey" | "clientKey" | "ackIdempotencyKey">;
    privateKey: KeyObject;
    now: number;
    env?: NodeJS.ProcessEnv;
}): Promise<ManagedCodexV3DeliveryJournal>;
export declare function openManagedCodexV3DeliveryJournalKey(journal: ManagedCodexV3DeliveryJournal): KeyObject;
export declare function clearManagedCodexV3OperationJournal(expected: {
    kind: ManagedCodexV3OperationJournal["kind"];
    clientRequestId: string;
    idempotencyKey: string;
}, env?: NodeJS.ProcessEnv): Promise<void>;
export declare function clearManagedCodexV3ReportJournal(expected: Pick<ManagedCodexV3ReportJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
export declare function quarantineManagedCodexV3ReportJournal(expected: ManagedCodexV3ReportJournal, reason: "invalid_encrypted_envelope" | "local_lineage_replaced", quarantinedAt: string, env?: NodeJS.ProcessEnv): Promise<string>;
export {};