export interface OAuthAccount {
    providerId: string;
    kind: 'oauth';
    accessToken: string;
    refreshToken?: string;
    tokenExpiresAt?: number;
    userName?: string;
    baseUrl?: string;
}
export interface ApiKeyAccount {
    providerId: string;
    kind: 'apikey';
    apiKey: string;
    baseUrl?: string;
    deployment?: string;
    apiVersion?: string;
}
export type Account = OAuthAccount | ApiKeyAccount;
export interface SecretEntry {
    name: string;
    value: string;
    domains: string[];
}
export interface ConeConfig {
    model: string;
    effortLevel?: 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
    accounts: Account[];
    secrets: SecretEntry[];
}
export interface ConeConfigDelta {
    model?: string;
    effortLevel?: 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | null;
    upsert?: {
        accounts?: Account[];
        secrets?: SecretEntry[];
    };
    delete?: {
        providerIds?: string[];
        secretNames?: string[];
    };
}
export interface ConeConfigIndex {
    model: string;
    effortLevel?: 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
    accountProviderIds: string[];
    accountMeta: Array<{
        providerId: string;
        kind: Account['kind'];
        tokenExpiresAt?: number;
    }>;
    secretNames: string[];
}
/** Max serialized bundle size (bytes) accepted as a preboot env payload. */
export declare const MAX_CONE_CONFIG_BYTES: number;
export declare function validateConeConfig(input: unknown): ConeConfig;
/**
 * Validate an untrusted resume delta (the worker receives it as `unknown`).
 * Nested accounts/secrets go through the same validators as a full bundle, so a
 * malformed or newline-injecting entry is rejected at the boundary with a clear
 * message rather than blowing up later inside mergeConeConfig.
 */
export declare function validateConeConfigDelta(input: unknown): ConeConfigDelta;
export declare function mergeConeConfig(base: ConeConfig, delta: ConeConfigDelta): ConeConfig;
/**
 * Serialize flat secrets to the `NAME=value` / `NAME_DOMAINS=a,b` line format
 * that node-server's EnvSecretStore reads. Values are written verbatim (no
 * escaping — matching the existing parser), so secret names must be env-var
 * identifiers and values/domains must be single-line (no newlines, and values
 * must not break `NAME=value` parsing). Callers sanitize/validate inputs.
 */
export declare function serializeSecretsEnv(secrets: SecretEntry[]): string;
export declare function bundleToFiles(cfg: ConeConfig): {
    coneConfigJson: string;
    secretsEnv: string;
};
export declare function bundleIndex(cfg: ConeConfig): ConeConfigIndex;
/** Portable base64 of a UTF-8 string (worker/browser/node all have btoa+TextEncoder). */
export declare function encodeBundleEnv(json: string): string;
export declare function decodeBundleEnv(b64: string): string;
/**
 * Best-effort expiry (epoch ms) of an Adobe IMS access token, for stamping
 * onto a synthesized Adobe `OAuthAccount.tokenExpiresAt`.
 *
 * Why it matters: a window-less kernel-worker cone must not treat a still-valid
 * token as expired. The webapp's `getValidAccessToken` (providers/adobe.ts)
 * returns the token only while `tokenExpiresAt` is in the future; otherwise it
 * attempts a silent renewal that ALWAYS returns null in a worker (no `window`)
 * and then throws "Adobe session expired". Without an expiry the account
 * defaults to `tokenExpiresAt ?? 0`, so the very first turn fails. Every site
 * that synthesizes an Adobe oauth account from a bare IMS bearer — node-server's
 * legacy-token branch and the worker's back-compat + resume paths — must stamp
 * this or reintroduce that failure mode.
 *
 * IMS access tokens are JWTs whose payload carries `created_at` + `expires_in`
 * (both epoch ms). Returns `created_at + expires_in`, or `undefined` for opaque
 * / unparseable tokens (callers then leave `tokenExpiresAt` unset — prior
 * behavior). Side-effect- and dependency-free (`atob`, not `node:Buffer`) so it
 * is safe to call from the CF Worker and the browser as well as node-server.
 */
export declare function imsTokenExpiry(token: string): number | undefined;
//# sourceMappingURL=index.d.ts.map