import { type KeyObject } from "node:crypto";
import { z } from "zod";
import { CodexV5CreateDeviceSessionResponseSchema } from "./protocol.js";
export declare const CodexV5SessionStateSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<1>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    assignmentId: z.ZodString;
    managedAccountId: z.ZodString;
    providerAccountId: z.ZodString;
    lineageId: z.ZodString;
    installationId: z.ZodString;
    sessionId: z.ZodString;
    authorityEpoch: z.ZodNumber;
    generationVersion: z.ZodNumber;
    leaseExpiresAt: z.ZodString;
    releaseIdempotencyKey: z.ZodString;
    status: z.ZodEnum<{
        ACTIVE: "ACTIVE";
        RECOVERY_REQUIRED: "RECOVERY_REQUIRED";
    }>;
    updatedAt: z.ZodString;
}, z.core.$strict>;
export declare const CodexV5AcquireJournalSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<1>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    assignmentId: z.ZodString;
    expectedManagedAccountId: z.ZodString;
    expectedProviderAccountId: z.ZodString;
    expectedLineageId: z.ZodString;
    installationId: z.ZodString;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    ackIdempotencyKey: z.ZodString;
    releaseIdempotencyKey: z.ZodString;
    clientKey: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        publicKey: z.ZodString;
    }, z.core.$strict>;
    privateKeyPkcs8: z.ZodString;
    response: z.ZodNullable<z.ZodObject<{
        schemaVersion: z.ZodLiteral<5>;
        session: z.ZodObject<{
            id: z.ZodString;
            clientRequestId: z.ZodString;
            installationId: z.ZodString;
            assignmentId: z.ZodString;
            managedAccountId: z.ZodString;
            providerAccountId: z.ZodString;
            lineageId: z.ZodString;
            generationVersion: z.ZodNumber;
            issuedAt: z.ZodString;
            leaseExpiresAt: z.ZodString;
            status: z.ZodEnum<{
                ACTIVE: "ACTIVE";
                AWAITING_ACK: "AWAITING_ACK";
            }>;
            authorityEpoch: z.ZodNumber;
            envelope: z.ZodObject<{
                version: z.ZodLiteral<1>;
                algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
                ephemeralPublicKey: z.ZodString;
                salt: z.ZodString;
                nonce: z.ZodString;
                ciphertext: z.ZodString;
                authenticationTag: z.ZodString;
            }, z.core.$strict>;
        }, z.core.$strict>;
        replayed: z.ZodBoolean;
    }, z.core.$strict>>;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
}, z.core.$strict>;
export declare const CodexV5ReportJournalSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<1>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    lineageId: z.ZodString;
    installationId: z.ZodString;
    sessionId: z.ZodString;
    authorityEpoch: z.ZodNumber;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    expectedGenerationVersion: z.ZodNumber;
    rotationMode: z.ZodEnum<{
        RETAINED: "RETAINED";
        ROTATED: "ROTATED";
    }>;
    envelope: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        keyId: z.ZodString;
        ephemeralPublicKey: z.ZodString;
        salt: z.ZodString;
        nonce: z.ZodString;
        ciphertext: z.ZodString;
        authenticationTag: z.ZodString;
    }, z.core.$strict>;
    accessTokenHealth: z.ZodEnum<{
        EXPIRED: "EXPIRED";
        HEALTHY: "HEALTHY";
        REJECTED: "REJECTED";
        UNKNOWN: "UNKNOWN";
    }>;
    refreshTokenHealth: z.ZodEnum<{
        HEALTHY: "HEALTHY";
        REJECTED: "REJECTED";
        UNKNOWN: "UNKNOWN";
    }>;
    observedAt: z.ZodString;
    credentialExpiresAt: z.ZodString;
    accessTokenDigest: z.ZodString;
    refreshTokenDigest: z.ZodString;
    idTokenDigest: z.ZodString;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
}, z.core.$strict>;
export type CodexV5SessionState = z.infer<typeof CodexV5SessionStateSchema>;
export type CodexV5AcquireJournal = z.infer<typeof CodexV5AcquireJournalSchema>;
export type CodexV5ReportJournal = z.infer<typeof CodexV5ReportJournalSchema>;
export declare function getOrCreateCodexInstallationId(env?: NodeJS.ProcessEnv, now?: number, newId?: () => string): Promise<string>;
export declare function readCodexV5SessionState(env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    assignmentId: string;
    managedAccountId: string;
    providerAccountId: string;
    lineageId: string;
    installationId: string;
    sessionId: string;
    authorityEpoch: number;
    generationVersion: number;
    leaseExpiresAt: string;
    releaseIdempotencyKey: string;
    status: "ACTIVE" | "RECOVERY_REQUIRED";
    updatedAt: string;
} | undefined>;
export declare function writeCodexV5SessionState(value: CodexV5SessionState, env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    assignmentId: string;
    managedAccountId: string;
    providerAccountId: string;
    lineageId: string;
    installationId: string;
    sessionId: string;
    authorityEpoch: number;
    generationVersion: number;
    leaseExpiresAt: string;
    releaseIdempotencyKey: string;
    status: "ACTIVE" | "RECOVERY_REQUIRED";
    updatedAt: string;
}>;
export declare function clearCodexV5SessionState(expectedSessionId: string, env?: NodeJS.ProcessEnv): Promise<void>;
export declare function readCodexV5AcquireJournal(env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    assignmentId: string;
    expectedManagedAccountId: string;
    expectedProviderAccountId: string;
    expectedLineageId: string;
    installationId: string;
    clientRequestId: string;
    idempotencyKey: string;
    ackIdempotencyKey: string;
    releaseIdempotencyKey: string;
    clientKey: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        publicKey: string;
    };
    privateKeyPkcs8: string;
    response: {
        schemaVersion: 5;
        session: {
            id: string;
            clientRequestId: string;
            installationId: string;
            assignmentId: string;
            managedAccountId: string;
            providerAccountId: string;
            lineageId: string;
            generationVersion: number;
            issuedAt: string;
            leaseExpiresAt: string;
            status: "ACTIVE" | "AWAITING_ACK";
            authorityEpoch: number;
            envelope: {
                version: 1;
                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
                ephemeralPublicKey: string;
                salt: string;
                nonce: string;
                ciphertext: string;
                authenticationTag: string;
            };
        };
        replayed: boolean;
    } | null;
    createdAt: string;
    updatedAt: string;
} | undefined>;
export declare function writeCodexV5AcquireJournal(value: CodexV5AcquireJournal, env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    assignmentId: string;
    expectedManagedAccountId: string;
    expectedProviderAccountId: string;
    expectedLineageId: string;
    installationId: string;
    clientRequestId: string;
    idempotencyKey: string;
    ackIdempotencyKey: string;
    releaseIdempotencyKey: string;
    clientKey: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        publicKey: string;
    };
    privateKeyPkcs8: string;
    response: {
        schemaVersion: 5;
        session: {
            id: string;
            clientRequestId: string;
            installationId: string;
            assignmentId: string;
            managedAccountId: string;
            providerAccountId: string;
            lineageId: string;
            generationVersion: number;
            issuedAt: string;
            leaseExpiresAt: string;
            status: "ACTIVE" | "AWAITING_ACK";
            authorityEpoch: number;
            envelope: {
                version: 1;
                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
                ephemeralPublicKey: string;
                salt: string;
                nonce: string;
                ciphertext: string;
                authenticationTag: string;
            };
        };
        replayed: boolean;
    } | null;
    createdAt: string;
    updatedAt: string;
}>;
export declare function updateCodexV5AcquireJournalResponse(expected: CodexV5AcquireJournal, response: z.infer<typeof CodexV5CreateDeviceSessionResponseSchema>, now: number, env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    assignmentId: string;
    expectedManagedAccountId: string;
    expectedProviderAccountId: string;
    expectedLineageId: string;
    installationId: string;
    clientRequestId: string;
    idempotencyKey: string;
    ackIdempotencyKey: string;
    releaseIdempotencyKey: string;
    clientKey: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        publicKey: string;
    };
    privateKeyPkcs8: string;
    response: {
        schemaVersion: 5;
        session: {
            id: string;
            clientRequestId: string;
            installationId: string;
            assignmentId: string;
            managedAccountId: string;
            providerAccountId: string;
            lineageId: string;
            generationVersion: number;
            issuedAt: string;
            leaseExpiresAt: string;
            status: "ACTIVE" | "AWAITING_ACK";
            authorityEpoch: number;
            envelope: {
                version: 1;
                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
                ephemeralPublicKey: string;
                salt: string;
                nonce: string;
                ciphertext: string;
                authenticationTag: string;
            };
        };
        replayed: boolean;
    } | null;
    createdAt: string;
    updatedAt: string;
}>;
export declare function clearCodexV5AcquireJournal(expected: Pick<CodexV5AcquireJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
export declare function openCodexV5AcquireJournalKey(journal: CodexV5AcquireJournal): KeyObject;
export declare function readCodexV5ReportJournal(env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    lineageId: string;
    installationId: string;
    sessionId: string;
    authorityEpoch: number;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "RETAINED" | "ROTATED";
    envelope: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        keyId: string;
        ephemeralPublicKey: string;
        salt: string;
        nonce: string;
        ciphertext: string;
        authenticationTag: string;
    };
    accessTokenHealth: "EXPIRED" | "HEALTHY" | "REJECTED" | "UNKNOWN";
    refreshTokenHealth: "HEALTHY" | "REJECTED" | "UNKNOWN";
    observedAt: string;
    credentialExpiresAt: string;
    accessTokenDigest: string;
    refreshTokenDigest: string;
    idTokenDigest: string;
    createdAt: string;
    updatedAt: string;
} | undefined>;
export declare function writeCodexV5ReportJournal(value: CodexV5ReportJournal, env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    lineageId: string;
    installationId: string;
    sessionId: string;
    authorityEpoch: number;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "RETAINED" | "ROTATED";
    envelope: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        keyId: string;
        ephemeralPublicKey: string;
        salt: string;
        nonce: string;
        ciphertext: string;
        authenticationTag: string;
    };
    accessTokenHealth: "EXPIRED" | "HEALTHY" | "REJECTED" | "UNKNOWN";
    refreshTokenHealth: "HEALTHY" | "REJECTED" | "UNKNOWN";
    observedAt: string;
    credentialExpiresAt: string;
    accessTokenDigest: string;
    refreshTokenDigest: string;
    idTokenDigest: string;
    createdAt: string;
    updatedAt: string;
}>;
export declare function clearCodexV5ReportJournal(expected: Pick<CodexV5ReportJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
export declare function exportCodexV5PrivateKey(privateKey: KeyObject): string;