import { z } from "zod";
export declare const ManagedCodexV3StateSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<3>;
    tenantId: z.ZodString;
    enrollmentId: z.ZodString;
    assignmentId: z.ZodString;
    managedAccountId: z.ZodString;
    providerAccountId: z.ZodString;
    lineageId: z.ZodString;
    generationVersion: z.ZodNumber;
    authorityMode: z.ZodEnum<{
        CLIENT_MANAGED: "CLIENT_MANAGED";
        DELIVERY_PENDING: "DELIVERY_PENDING";
    }>;
    authorityEpoch: z.ZodNullable<z.ZodNumber>;
    deliveryId: z.ZodString;
    ackIdempotencyKey: z.ZodString;
    credentialExpiresAt: z.ZodString;
    ackExpiresAt: z.ZodString;
    ackedAt: z.ZodNullable<z.ZodString>;
    phase: z.ZodEnum<{
        INSTALLED: "INSTALLED";
        INSTALLED_PENDING_ACK: "INSTALLED_PENDING_ACK";
        INSTALLING: "INSTALLING";
    }>;
    accessTokenDigest: z.ZodString;
    refreshTokenDigest: z.ZodString;
    idTokenDigest: z.ZodString;
    updatedAt: z.ZodString;
    lastReportedAt: z.ZodNullable<z.ZodString>;
    lastAccessObservationAttemptAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    lastAccessObservationAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    previous: z.ZodNullable<z.ZodObject<{
        assignmentId: z.ZodString;
        lineageId: z.ZodString;
        generationVersion: z.ZodNumber;
        authorityEpoch: z.ZodNullable<z.ZodNumber>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type ManagedCodexV3State = z.infer<typeof ManagedCodexV3StateSchema>;
export declare function managedCodexV3StateNeedsV6RecoveryVerification(state: ManagedCodexV3State): boolean;
export interface ManagedCodexV3CredentialInput {
    tenantId: string;
    enrollmentId: string;
    assignmentId: string;
    managedAccountId: string;
    providerAccountId: string;
    lineageId: string;
    generationVersion: number;
    deliveryId: string;
    ackIdempotencyKey: string;
    refreshToken: string;
    accessToken: string;
    idToken: string;
    credentialExpiresAt: string;
    ackExpiresAt: string;
    lastRefresh?: string;
}
export interface RecoverManagedCodexV3StateForV6Input {
    tenantId: string;
    enrollmentId: string;
    assignmentId: string;
    managedAccountId: string;
    providerAccountId: string;
    lineageId: string;
    generationVersion: number;
    credentialExpiresAt: string;
}
export interface ManagedCodexV3CredentialObservation {
    state: ManagedCodexV3State;
    rotationMode: "ROTATED" | "RETAINED";
    accessTokenHealth: "HEALTHY" | "EXPIRED" | "UNKNOWN";
    refreshTokenHealth: "HEALTHY" | "UNKNOWN";
    observedAt: string;
    credentialExpiresAt: string;
    authAccountId: string;
    credentials: {
        refreshToken: string;
        accessToken: string;
        idToken: string;
        providerAccountId: string;
    };
}
export declare function readManagedCodexV3State(env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3State | undefined>;
/**
 * Schema v6 is authoritative for request/device access. An unreadable legacy
 * state file cannot safely describe a local binding, but it must not prevent
 * the client from reconciling that binding with the server. Retire only that
 * derived state; the official Codex auth file remains untouched. A READY v6
 * delivery or exact active-binding recovery can recreate valid local state.
 */
export declare function retireInvalidManagedCodexV3StateForV6(env?: NodeJS.ProcessEnv): Promise<boolean>;
export declare function managedCodexV3StateExists(env?: NodeJS.ProcessEnv): Promise<boolean>;
/**
 * Rebuilds only Numa's derived state for an already-active v6 binding. The
 * caller must first verify that the persisted v6 binding is the exact binding
 * returned by the server. The official auth.json is never modified, and its
 * provider account plus access-token expiry must match the server generation.
 */
export declare function recoverManagedCodexV3StateForV6(raw: RecoverManagedCodexV3StateForV6Input, now?: number, env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3State | undefined>;
export declare function installManagedCodexV3Credentials(raw: ManagedCodexV3CredentialInput, now?: number, env?: NodeJS.ProcessEnv, hooks?: {
    afterInstallingState?: () => Promise<void>;
    afterAuthWrite?: () => Promise<void>;
    allowExpiredCredential?: boolean;
    allowSameGenerationRedelivery?: boolean;
    requireEmptyAuthForNewDelivery?: boolean;
}): Promise<{
    action: "INSTALLED" | "REPLACED" | "UNCHANGED" | "RECOVERED";
    authPath: string;
    statePath: string;
    state: ManagedCodexV3State;
}>;
export declare function markManagedCodexV3DeliveryAcknowledged(input: {
    deliveryId: string;
    generationVersion: number;
    authorityEpoch: number;
    ackedAt: string;
}, env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3State>;
export declare function withManagedCodexV3CredentialObservation<T>(env: NodeJS.ProcessEnv, now: number, consume: (observation: ManagedCodexV3CredentialObservation) => Promise<T>, options?: {
    allowV6RecoveryPending?: boolean;
    requireCurrentGeneration?: boolean;
    requireCanonicalProviderAccount?: boolean;
}): Promise<T | undefined>;
/** Refresh an acknowledged generation in place, retaining report evidence until the server commits it. */
export declare function refreshExpiredManagedCodexV3Credentials(input: {
    env: NodeJS.ProcessEnv;
    tenantId: string;
    assignmentId: string;
    lineageId: string;
    providerAccountId: string;
    now: number;
    refresh: (credentials: ManagedCodexV3CredentialObservation["credentials"]) => Promise<{
        accessToken: string;
        refreshToken: string;
        idToken: string;
    }>;
}): Promise<{
    refreshed: boolean;
    credentialExpiresAt: string;
}>;
export interface ManagedCodexV4AccessObservation {
    state: ManagedCodexV3State;
    observedAt: string;
    accessTokenState: "VALID" | "EXPIRING" | "EXPIRED" | "INVALID";
    accessTokenExpiresAt: string | null;
}
export type CodexAccessObservationSkipReason = "account_mismatch" | "local_unavailable" | "request_bound_device";
export declare function withManagedCodexV4AccessObservation<T>(env: NodeJS.ProcessEnv, now: number, consume: (observation: ManagedCodexV4AccessObservation) => Promise<T>, options?: {
    successIntervalMs?: number;
    retryIntervalMs?: number;
    onSkipped?: (reason: CodexAccessObservationSkipReason) => void;
}): Promise<T | undefined>;
export declare function commitManagedCodexV3GenerationReport(input: {
    lineageId: string;
    previousGenerationVersion: number;
    generationVersion: number;
    authorityEpoch: number;
    credentialExpiresAt: string;
    observedAt: string;
    tokenDigests: {
        accessTokenDigest: string;
        refreshTokenDigest: string;
        idTokenDigest: string;
    };
    allowNewerLocalCredentials?: boolean;
    requireCanonicalProviderAccount?: boolean;
}, env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3State>;
export declare function codexV3CredentialDigests(credentials: {
    accessToken: string;
    refreshToken: string;
    idToken: string;
}): {
    accessTokenDigest: string;
    refreshTokenDigest: string;
    idTokenDigest: string;
};