import { z } from "zod";
import { CodexV6FullCredentialDeliveryResponseSchema } from "./protocol.js";
export declare const CodexV6BindingStateSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<1>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    requestId: z.ZodString;
    bindingId: z.ZodString;
    predecessorBindingId: z.ZodNullable<z.ZodString>;
    installationId: z.ZodString;
    managedAccountId: z.ZodString;
    providerAccountId: z.ZodString;
    poolEntryId: z.ZodString;
    credentialLineageId: z.ZodString;
    generationVersion: z.ZodNumber;
    accountExpiresAt: z.ZodNullable<z.ZodString>;
    localAssignmentId: z.ZodString;
    source: z.ZodEnum<{
        ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
        ADMIN_ADDED: "ADMIN_ADDED";
        LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
        REQUEST_INITIAL: "REQUEST_INITIAL";
    }>;
    status: z.ZodEnum<{
        ACTIVE: "ACTIVE";
        NEEDS_REAUTH: "NEEDS_REAUTH";
        READY: "READY";
        RETIREMENT_PENDING: "RETIREMENT_PENDING";
    }>;
    updatedAt: z.ZodString;
}, z.core.$strict>;
export declare const CodexV6DeliveryJournalSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<1>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    requestId: z.ZodString;
    bindingId: z.ZodString;
    installationId: z.ZodString;
    expectedManagedAccountId: z.ZodString;
    expectedProviderAccountId: z.ZodString;
    expectedPoolEntryId: z.ZodString;
    expectedCredentialLineageId: z.ZodString;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    ackIdempotencyKey: z.ZodString;
    clientKey: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        publicKey: z.ZodString;
    }, z.core.$strict>;
    privateKeyPkcs8: z.ZodString;
    response: z.ZodNullable<z.ZodObject<{
        schemaVersion: z.ZodLiteral<6>;
        delivery: z.ZodObject<{
            id: z.ZodString;
            clientRequestId: z.ZodString;
            requestId: z.ZodString;
            bindingId: z.ZodString;
            installationId: z.ZodString;
            managedAccountId: z.ZodString;
            providerAccountId: z.ZodString;
            credentialLineageId: z.ZodString;
            generationVersion: z.ZodNumber;
            issuedAt: z.ZodString;
            credentialExpiresAt: z.ZodString;
            ackExpiresAt: z.ZodString;
            ackedAt: z.ZodNullable<z.ZodString>;
            status: z.ZodLiteral<"AWAITING_ACK">;
            envelope: z.ZodObject<{
                version: z.ZodLiteral<1>;
                algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
                ephemeralPublicKey: z.ZodString;
                salt: z.ZodString;
                nonce: z.ZodString;
                ciphertext: z.ZodString;
                authenticationTag: z.ZodString;
            }, z.core.$strict>;
        }, z.core.$strict>;
        replayed: z.ZodBoolean;
    }, z.core.$strict>>;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
}, z.core.$strict>;
export declare const CodexV6ReportJournalSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<1>;
    tenantId: z.ZodString;
    subject: z.ZodString;
    requestId: z.ZodString;
    bindingId: z.ZodString;
    installationId: z.ZodString;
    credentialLineageId: z.ZodString;
    clientRequestId: z.ZodString;
    idempotencyKey: z.ZodString;
    expectedGenerationVersion: z.ZodNumber;
    rotationMode: z.ZodEnum<{
        RETAINED: "RETAINED";
        ROTATED: "ROTATED";
    }>;
    envelope: z.ZodObject<{
        version: z.ZodLiteral<1>;
        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
        keyId: z.ZodString;
        ephemeralPublicKey: z.ZodString;
        salt: z.ZodString;
        nonce: z.ZodString;
        ciphertext: z.ZodString;
        authenticationTag: z.ZodString;
    }, z.core.$strict>;
    accessTokenHealth: z.ZodEnum<{
        EXPIRED: "EXPIRED";
        HEALTHY: "HEALTHY";
        REJECTED: "REJECTED";
        UNKNOWN: "UNKNOWN";
    }>;
    refreshTokenHealth: z.ZodEnum<{
        HEALTHY: "HEALTHY";
        REJECTED: "REJECTED";
        UNKNOWN: "UNKNOWN";
    }>;
    observedAt: z.ZodString;
    credentialExpiresAt: z.ZodString;
    accessTokenDigest: z.ZodString;
    refreshTokenDigest: z.ZodString;
    idTokenDigest: z.ZodString;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
}, z.core.$strict>;
export type CodexV6BindingState = z.infer<typeof CodexV6BindingStateSchema>;
export type CodexV6DeliveryJournal = z.infer<typeof CodexV6DeliveryJournalSchema>;
export type CodexV6ReportJournal = z.infer<typeof CodexV6ReportJournalSchema>;
export declare function readCodexV6BindingState(env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    predecessorBindingId: string | null;
    installationId: string;
    managedAccountId: string;
    providerAccountId: string;
    poolEntryId: string;
    credentialLineageId: string;
    generationVersion: number;
    accountExpiresAt: string | null;
    localAssignmentId: string;
    source: "ACCOUNT_REPLACEMENT" | "ADMIN_ADDED" | "LEGACY_AUTO_MIGRATED" | "REQUEST_INITIAL";
    status: "ACTIVE" | "NEEDS_REAUTH" | "READY" | "RETIREMENT_PENDING";
    updatedAt: string;
} | undefined>;
export declare function writeCodexV6BindingState(value: CodexV6BindingState, env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    predecessorBindingId: string | null;
    installationId: string;
    managedAccountId: string;
    providerAccountId: string;
    poolEntryId: string;
    credentialLineageId: string;
    generationVersion: number;
    accountExpiresAt: string | null;
    localAssignmentId: string;
    source: "ACCOUNT_REPLACEMENT" | "ADMIN_ADDED" | "LEGACY_AUTO_MIGRATED" | "REQUEST_INITIAL";
    status: "ACTIVE" | "NEEDS_REAUTH" | "READY" | "RETIREMENT_PENDING";
    updatedAt: string;
}>;
export declare function clearCodexV6BindingState(expectedBindingId: string, env?: NodeJS.ProcessEnv): Promise<void>;
export declare function readCodexV6DeliveryJournal(env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    installationId: string;
    expectedManagedAccountId: string;
    expectedProviderAccountId: string;
    expectedPoolEntryId: string;
    expectedCredentialLineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    ackIdempotencyKey: string;
    clientKey: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        publicKey: string;
    };
    privateKeyPkcs8: string;
    response: {
        schemaVersion: 6;
        delivery: {
            id: string;
            clientRequestId: string;
            requestId: string;
            bindingId: string;
            installationId: string;
            managedAccountId: string;
            providerAccountId: string;
            credentialLineageId: string;
            generationVersion: number;
            issuedAt: string;
            credentialExpiresAt: string;
            ackExpiresAt: string;
            ackedAt: string | null;
            status: "AWAITING_ACK";
            envelope: {
                version: 1;
                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
                ephemeralPublicKey: string;
                salt: string;
                nonce: string;
                ciphertext: string;
                authenticationTag: string;
            };
        };
        replayed: boolean;
    } | null;
    createdAt: string;
    updatedAt: string;
} | undefined>;
export declare function writeCodexV6DeliveryJournal(value: CodexV6DeliveryJournal, env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    installationId: string;
    expectedManagedAccountId: string;
    expectedProviderAccountId: string;
    expectedPoolEntryId: string;
    expectedCredentialLineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    ackIdempotencyKey: string;
    clientKey: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        publicKey: string;
    };
    privateKeyPkcs8: string;
    response: {
        schemaVersion: 6;
        delivery: {
            id: string;
            clientRequestId: string;
            requestId: string;
            bindingId: string;
            installationId: string;
            managedAccountId: string;
            providerAccountId: string;
            credentialLineageId: string;
            generationVersion: number;
            issuedAt: string;
            credentialExpiresAt: string;
            ackExpiresAt: string;
            ackedAt: string | null;
            status: "AWAITING_ACK";
            envelope: {
                version: 1;
                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
                ephemeralPublicKey: string;
                salt: string;
                nonce: string;
                ciphertext: string;
                authenticationTag: string;
            };
        };
        replayed: boolean;
    } | null;
    createdAt: string;
    updatedAt: string;
}>;
export declare function updateCodexV6DeliveryJournalResponse(expected: CodexV6DeliveryJournal, response: z.infer<typeof CodexV6FullCredentialDeliveryResponseSchema>, now: number, env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    installationId: string;
    expectedManagedAccountId: string;
    expectedProviderAccountId: string;
    expectedPoolEntryId: string;
    expectedCredentialLineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    ackIdempotencyKey: string;
    clientKey: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        publicKey: string;
    };
    privateKeyPkcs8: string;
    response: {
        schemaVersion: 6;
        delivery: {
            id: string;
            clientRequestId: string;
            requestId: string;
            bindingId: string;
            installationId: string;
            managedAccountId: string;
            providerAccountId: string;
            credentialLineageId: string;
            generationVersion: number;
            issuedAt: string;
            credentialExpiresAt: string;
            ackExpiresAt: string;
            ackedAt: string | null;
            status: "AWAITING_ACK";
            envelope: {
                version: 1;
                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
                ephemeralPublicKey: string;
                salt: string;
                nonce: string;
                ciphertext: string;
                authenticationTag: string;
            };
        };
        replayed: boolean;
    } | null;
    createdAt: string;
    updatedAt: string;
}>;
export declare function clearCodexV6DeliveryJournal(expected: Pick<CodexV6DeliveryJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
export declare function openCodexV6DeliveryJournalKey(journal: CodexV6DeliveryJournal): KeyObject;
export declare function readCodexV6ReportJournal(env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    installationId: string;
    credentialLineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "RETAINED" | "ROTATED";
    envelope: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        keyId: string;
        ephemeralPublicKey: string;
        salt: string;
        nonce: string;
        ciphertext: string;
        authenticationTag: string;
    };
    accessTokenHealth: "EXPIRED" | "HEALTHY" | "REJECTED" | "UNKNOWN";
    refreshTokenHealth: "HEALTHY" | "REJECTED" | "UNKNOWN";
    observedAt: string;
    credentialExpiresAt: string;
    accessTokenDigest: string;
    refreshTokenDigest: string;
    idTokenDigest: string;
    createdAt: string;
    updatedAt: string;
} | undefined>;
export declare function writeCodexV6ReportJournal(value: CodexV6ReportJournal, env?: NodeJS.ProcessEnv): Promise<{
    schemaVersion: 1;
    tenantId: string;
    subject: string;
    requestId: string;
    bindingId: string;
    installationId: string;
    credentialLineageId: string;
    clientRequestId: string;
    idempotencyKey: string;
    expectedGenerationVersion: number;
    rotationMode: "RETAINED" | "ROTATED";
    envelope: {
        version: 1;
        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
        keyId: string;
        ephemeralPublicKey: string;
        salt: string;
        nonce: string;
        ciphertext: string;
        authenticationTag: string;
    };
    accessTokenHealth: "EXPIRED" | "HEALTHY" | "REJECTED" | "UNKNOWN";
    refreshTokenHealth: "HEALTHY" | "REJECTED" | "UNKNOWN";
    observedAt: string;
    credentialExpiresAt: string;
    accessTokenDigest: string;
    refreshTokenDigest: string;
    idTokenDigest: string;
    createdAt: string;
    updatedAt: string;
}>;
export declare function clearCodexV6ReportJournal(expected: Pick<CodexV6ReportJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
export declare function resetCodexV6LocalState(env?: NodeJS.ProcessEnv): Promise<{
    clearedBinding: boolean;
    clearedDelivery: boolean;
    clearedReport: boolean;
}>;
import { type KeyObject } from "node:crypto";