@cat-factory/contracts 0.292.2 → 0.294.0

package/dist/public-provisioning.d.ts

@@ -0,0 +1,698 @@
+import * as v from 'valibot';
+/**
+ * Create a repository from scratch (or from a reference architecture) and adapt it with an agent.
+ *
+ * The one act of board setup with no public counterpart at all: `POST /api/v1/services` can back a
+ * service with a repository that already EXISTS, and nothing on this surface could make one, so a
+ * deployment automating itself had to open a browser exactly once, at the very first step.
+ *
+ * Mirrors the internal bootstrap body's own rule rather than relaxing it: a run needs either a
+ * reference architecture to clone or a brief to scaffold from, and a request carrying neither
+ * describes no work.
+ */
+export declare const publicBootstrapRepoSchema: v.SchemaWithPipe<readonly [v.ObjectSchema<{
+    /** Name for the new repository, under the owner the workspace's VCS connection names. */
+    readonly repoName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "Only letters, digits, '.', '_' and '-' are allowed">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 100, undefined>]>;
+    /** The repository's role on the board. Omitted ⇒ `service`. */
+    readonly type: v.OptionalSchema<v.PicklistSchema<["service", "frontend", "library", "document"], undefined>, undefined>;
+    readonly description: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+    /** Whether the new repository is private. Omitted ⇒ private, which is the safe default. */
+    readonly private: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /**
+     * The brief for the bootstrapper agent. With a reference architecture these are appended to
+     * its stored defaults; with none they are the whole brief.
+     */
+    readonly instructions: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 8000, undefined>]>, undefined>;
+    /** A reference architecture to clone from; omit to scaffold from `instructions` alone. */
+    readonly referenceArchitectureId: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+}, undefined>, v.CheckAction<{
+    repoName: string;
+    type?: "document" | "frontend" | "library" | "service" | undefined;
+    description?: string | undefined;
+    private?: boolean | undefined;
+    instructions?: string | undefined;
+    referenceArchitectureId?: string | undefined;
+}, "Provide a reference architecture or freeform instructions to bootstrap from.">]>;
+export type PublicBootstrapRepoInput = v.InferOutput<typeof publicBootstrapRepoSchema>;
+/**
+ * One bootstrap run, as this surface reports it.
+ *
+ * `serviceId` is the board service frame the run materialises, named as this surface names a
+ * service everywhere else rather than as the `blockId` the engine calls it: a caller joins it
+ * straight onto `POST /api/v1/services/:serviceId` and `/api/v1/services/:serviceId/tasks`.
+ *
+ * `failureKind` is projected beside `error` because the two answer different questions: the string
+ * says what went wrong, the kind says whether a retry could plausibly help (a `preflight` refusal
+ * cannot be retried into success, an `evicted` container can).
+ *
+ * `failureDetail` and `failureHint` ride beside it because both are diagnostic PROSE the platform
+ * wrote for this moment, not engine internals: the hint is literally "where to look next". Omitting
+ * them would leave a headless caller re-deriving a worse version of a sentence the deployment
+ * already produced, which is the same reason the deployment's own config problems are relayed
+ * verbatim rather than paraphrased. What stays off is the structured remainder whose shape is
+ * genuinely internal (`reason`, kind-scoped and open-ended; `stepIndex`, documented as absent on a
+ * bootstrap; `occurredAt` and `lastSubtasks`, already answerable from the fields above).
+ *
+ * `failureKind` carries the FULL agent-failure vocabulary rather than the narrower list a bootstrap run is
+ * documented to produce, and deliberately so. The stored value is the shared `agentFailure`, so the
+ * narrow list is a claim about which members are REACHED, not a constraint on what a row can hold.
+ * Projecting through the narrow one would leave this mapper with a value outside its own type on
+ * exactly the path whose job is to name what went wrong, and the only ways out of that are to drop
+ * the kind (reporting a failure as having no classification) or to guess it onto a member nothing
+ * knows was meant. Reporting the recorded value is the honest third option, and a new internal kind
+ * reaches this surface as an additive enum member, which the SDKs tolerate by design.
+ */
+export declare const publicBootstrapJobSchema: v.ObjectSchema<{
+    readonly jobId: v.StringSchema<undefined>;
+    readonly status: v.PicklistSchema<["pending", "running", "succeeded", "failed"], undefined>;
+    readonly repoName: v.StringSchema<undefined>;
+    /** The owner the repository was created under, resolved at run time; null until known. */
+    readonly repoOwner: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    /** Web URL of the created repository; null until it succeeds. */
+    readonly repoUrl: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    /** The board service frame this run materialises; null when none was created. */
+    readonly serviceId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    /** Live subtask counts from the agent's todo list; null until it first reports. */
+    readonly progress: v.NullableSchema<v.ObjectSchema<{
+        readonly completed: v.NumberSchema<undefined>;
+        readonly inProgress: v.NumberSchema<undefined>;
+        readonly total: v.NumberSchema<undefined>;
+        readonly items: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            readonly label: v.StringSchema<undefined>;
+            readonly status: v.PicklistSchema<["pending", "in_progress", "completed"], undefined>;
+        }, undefined>, undefined>, undefined>;
+    }, undefined>, undefined>;
+    /** One-line failure reason when `status` is `failed`; null otherwise. */
+    readonly error: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    /** How the run faulted, when it did: the part that says whether a retry is worth it. */
+    readonly failureKind: v.NullableSchema<v.PicklistSchema<["preflight", "dispatch", "environment", "evicted", "timeout", "agent", "job_failed", "rejected", "companion_rejected", "stalled", "cancelled", "unknown"], undefined>, undefined>;
+    /** Extended detail behind `error` when the platform captured any (a harness reason, an HTTP body). */
+    readonly failureDetail: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    /** The platform's own "where to look next", relayed verbatim; null when it had none to offer. */
+    readonly failureHint: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly createdAt: v.NumberSchema<undefined>;
+    readonly updatedAt: v.NumberSchema<undefined>;
+}, undefined>;
+export type PublicBootstrapJob = v.InferOutput<typeof publicBootstrapJobSchema>;
+/**
+ * How the manifests at `path` are rendered. `raw` (the default) treats the path as a manifest file
+ * or a flat directory of valid YAML; `kustomize` treats it as an overlay directory, which only the
+ * container-backed deploy adapter can build.
+ *
+ * A projection of the internal renderer picklist rather than the picklist itself, for the reason
+ * the header states: these two Kubernetes shapes are the largest STRUCTURAL surfaces this file
+ * publishes, and a renderer the internal adapter grows is a public member only once someone adds it
+ * here.
+ */
+export declare const publicKubernetesRendererSchema: v.PicklistSchema<["raw", "kustomize"], undefined>;
+export type PublicKubernetesRenderer = v.InferOutput<typeof publicKubernetesRendererSchema>;
+/**
+ * Where a service's per-PR manifests are read from. `colocated` reads them from the service's own
+ * repository at the pull request's head; `separate` reads them from another repository, which is
+ * where a platform team's manifests usually live.
+ */
+export declare const publicKubernetesManifestSourceSchema: v.VariantSchema<"type", [v.ObjectSchema<{
+    readonly type: v.LiteralSchema<"colocated", undefined>;
+    /** File or directory path within the pull request's repository. */
+    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    /** Omitted ⇒ `raw`. */
+    readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly type: v.LiteralSchema<"separate", undefined>;
+    /** `owner/repo` of the manifests repository. */
+    readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+    /** Branch, tag or sha to read at; omitted ⇒ that repository's default branch. */
+    readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    /** File or directory path within the manifests repository. */
+    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    /** Omitted ⇒ `raw`. */
+    readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+}, undefined>], undefined>;
+export type PublicKubernetesManifestSource = v.InferOutput<typeof publicKubernetesManifestSourceSchema>;
+/**
+ * How the environment's URL is derived once the manifests are applied: from a host template the
+ * platform renders itself, or by reading the address back off one of four applied objects.
+ */
+export declare const publicKubernetesUrlSourceSchema: v.VariantSchema<"source", [v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+    /** Host template, e.g. `{{branch}}.preview.example.com`, rendered with the provision vars. */
+    readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    /**
+     * Host port the ingress controller answers on, when it is not the scheme's default. Kept out
+     * of `hostTemplate` because the rendered template is also the Ingress `host` the manifests
+     * declare, and a Kubernetes `host` may not carry a port.
+     */
+    readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+    /** Ingress to read `.status.loadBalancer` from; omitted ⇒ the only Ingress applied. */
+    readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+    /** Service to read `.status.loadBalancer` from. */
+    readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+    readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+    /** Gateway-API `Gateway` to read `.status.addresses[]` from; omitted ⇒ the only one applied. */
+    readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+    /** `HTTPRoute` whose `parentRefs` resolve the address; omitted ⇒ the only one applied. */
+    readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+}, undefined>], undefined>;
+export type PublicKubernetesUrlSource = v.InferOutput<typeof publicKubernetesUrlSourceSchema>;
+/**
+ * A Kubernetes cluster the platform provisions per-run environments against.
+ *
+ * Narrower than the internal engine config on purpose. Left off are the fields that only mean
+ * something to a specific execution shape the caller is not choosing here (`rolloutTimeoutSeconds`,
+ * belonging to the container deploy adapter; `helmReleases`, a cluster-singleton concern an
+ * operator owns). They can be ADDED later as optional fields, which is the additive direction this
+ * surface allows; they could never be removed once shipped, which is why they are not here now.
+ */
+export declare const publicKubernetesConnectionSchema: v.ObjectSchema<{
+    /** Human label for the connection, shown wherever the platform names the engine. */
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /** kube-apiserver root URL, e.g. `https://cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    /** PEM CA bundle verifying the apiserver certificate. Omit only for a publicly-trusted CA. */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /**
+     * Skip apiserver TLS verification. Throwaway clusters only, and stated as its own field rather
+     * than inferred from an absent CA, so turning verification off is always something a caller
+     * asked for in writing.
+     */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /** Namespace template for the per-run environment, e.g. `env-{{pullNumber}}`. */
+    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    /** How the environment URL is derived once the manifests are applied. */
+    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+        /** Host template, e.g. `{{branch}}.preview.example.com`, rendered with the provision vars. */
+        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        /**
+         * Host port the ingress controller answers on, when it is not the scheme's default. Kept out
+         * of `hostTemplate` because the rendered template is also the Ingress `host` the manifests
+         * declare, and a Kubernetes `host` may not carry a port.
+         */
+        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+        /** Ingress to read `.status.loadBalancer` from; omitted ⇒ the only Ingress applied. */
+        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+        /** Service to read `.status.loadBalancer` from. */
+        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+        /** Gateway-API `Gateway` to read `.status.addresses[]` from; omitted ⇒ the only one applied. */
+        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+        /** `HTTPRoute` whose `parentRefs` resolve the address; omitted ⇒ the only one applied. */
+        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /** Image reference exposed to the manifests as `{{image}}`. */
+    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Backstop TTL (ms) after which an environment is swept and torn down. */
+    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /** Extra labels stamped on the namespace and every applied resource. */
+    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Extra annotations stamped on the namespace. */
+    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+}, undefined>;
+export type PublicKubernetesConnection = v.InferOutput<typeof publicKubernetesConnectionSchema>;
+/**
+ * The engine a workspace provisions environments through, discriminated by `engine`.
+ *
+ * A one-member variant rather than a bare object, which is the whole point: `kubernetes` is the
+ * engine that is automatable today, and a second member is an additive enum value the SDKs already
+ * tolerate by design. A bare object would have to be RESHAPED to gain a sibling, and reshaping is
+ * the thing this surface may not do.
+ *
+ * The internal engine vocabulary splits Kubernetes in two (`local-k3s` and `remote-kubernetes`,
+ * which differ in how the deployment reaches the cluster, not in what a caller supplies). That
+ * split is not a public fact, and it is not a public DECISION either: one backend serves both
+ * names, both lower to the same provision type and the same config, so a connection made here is
+ * registered under the one name the controller states (`remote-kubernetes`) and nothing a run does
+ * can observe the difference. A caller describes its cluster; which internal name that is stored
+ * under is the platform's business.
+ */
+export declare const publicEnvironmentConnectionSchema: v.VariantSchema<"engine", [v.ObjectSchema<{
+    readonly engine: v.LiteralSchema<"kubernetes", undefined>;
+    readonly kubernetes: v.ObjectSchema<{
+        /** Human label for the connection, shown wherever the platform names the engine. */
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+        /** kube-apiserver root URL, e.g. `https://cluster.example:6443`. */
+        readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        /** PEM CA bundle verifying the apiserver certificate. Omit only for a publicly-trusted CA. */
+        readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /**
+         * Skip apiserver TLS verification. Throwaway clusters only, and stated as its own field rather
+         * than inferred from an absent CA, so turning verification off is always something a caller
+         * asked for in writing.
+         */
+        readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+        /** Namespace template for the per-run environment, e.g. `env-{{pullNumber}}`. */
+        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+        /** How the environment URL is derived once the manifests are applied. */
+        readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+            /** Host template, e.g. `{{branch}}.preview.example.com`, rendered with the provision vars. */
+            readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /**
+             * Host port the ingress controller answers on, when it is not the scheme's default. Kept out
+             * of `hostTemplate` because the rendered template is also the Ingress `host` the manifests
+             * declare, and a Kubernetes `host` may not carry a port.
+             */
+            readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+            /** Ingress to read `.status.loadBalancer` from; omitted ⇒ the only Ingress applied. */
+            readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+            /** Service to read `.status.loadBalancer` from. */
+            readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+            readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+            /** Gateway-API `Gateway` to read `.status.addresses[]` from; omitted ⇒ the only one applied. */
+            readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+            /** `HTTPRoute` whose `parentRefs` resolve the address; omitted ⇒ the only one applied. */
+            readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>], undefined>;
+        /** Image reference exposed to the manifests as `{{image}}`. */
+        readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Backstop TTL (ms) after which an environment is swept and torn down. */
+        readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+        /** Extra labels stamped on the namespace and every applied resource. */
+        readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        /** Extra annotations stamped on the namespace. */
+        readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    }, undefined>;
+}, undefined>], undefined>;
+export type PublicEnvironmentConnection = v.InferOutput<typeof publicEnvironmentConnectionSchema>;
+/** Probe a candidate connection. Persists nothing, which is the reason it is its own call. */
+export declare const testPublicEnvironmentConnectionSchema: v.ObjectSchema<{
+    readonly connection: v.VariantSchema<"engine", [v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection, shown wherever the platform names the engine. */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /** PEM CA bundle verifying the apiserver certificate. Omit only for a publicly-trusted CA. */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /**
+             * Skip apiserver TLS verification. Throwaway clusters only, and stated as its own field rather
+             * than inferred from an absent CA, so turning verification off is always something a caller
+             * asked for in writing.
+             */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /** Namespace template for the per-run environment, e.g. `env-{{pullNumber}}`. */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** How the environment URL is derived once the manifests are applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`, rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                /**
+                 * Host port the ingress controller answers on, when it is not the scheme's default. Kept out
+                 * of `hostTemplate` because the rendered template is also the Ingress `host` the manifests
+                 * declare, and a Kubernetes `host` may not carry a port.
+                 */
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress to read `.status.loadBalancer` from; omitted ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service to read `.status.loadBalancer` from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; omitted ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve the address; omitted ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Image reference exposed to the manifests as `{{image}}`. */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Backstop TTL (ms) after which an environment is swept and torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace and every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>;
+    /** Secret bundle the engine authenticates with, e.g. `{ apiToken: '...' }`. */
+    readonly secrets: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+}, undefined>;
+export type TestPublicEnvironmentConnectionInput = v.InferOutput<typeof testPublicEnvironmentConnectionSchema>;
+/** The verdict of a probe. `ok: false` is an ANSWER, so it is a 200 rather than an error. */
+export declare const publicEnvironmentConnectionTestSchema: v.ObjectSchema<{
+    readonly ok: v.BooleanSchema<undefined>;
+    /** What the probe read back, whether it succeeded or not; null when it had nothing to add. */
+    readonly message: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type PublicEnvironmentConnectionTest = v.InferOutput<typeof publicEnvironmentConnectionTestSchema>;
+/**
+ * Bind a provision type to an engine connection. Idempotent: re-connecting REPLACES, so a caller
+ * re-running its own setup converges instead of accumulating handlers or having to delete first.
+ */
+export declare const connectPublicEnvironmentSchema: v.ObjectSchema<{
+    readonly connection: v.VariantSchema<"engine", [v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection, shown wherever the platform names the engine. */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.UrlAction<string, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /** PEM CA bundle verifying the apiserver certificate. Omit only for a publicly-trusted CA. */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /**
+             * Skip apiserver TLS verification. Throwaway clusters only, and stated as its own field rather
+             * than inferred from an absent CA, so turning verification off is always something a caller
+             * asked for in writing.
+             */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /** Namespace template for the per-run environment, e.g. `env-{{pullNumber}}`. */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** How the environment URL is derived once the manifests are applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`, rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                /**
+                 * Host port the ingress controller answers on, when it is not the scheme's default. Kept out
+                 * of `hostTemplate` because the rendered template is also the Ingress `host` the manifests
+                 * declare, and a Kubernetes `host` may not carry a port.
+                 */
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress to read `.status.loadBalancer` from; omitted ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service to read `.status.loadBalancer` from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; omitted ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve the address; omitted ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Image reference exposed to the manifests as `{{image}}`. */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Backstop TTL (ms) after which an environment is swept and torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace and every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>], undefined>;
+    readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type ConnectPublicEnvironmentInput = v.InferOutput<typeof connectPublicEnvironmentSchema>;
+/**
+ * A registered connection, as this surface reports it back.
+ *
+ * `secretKeys` and not the secrets: a caller confirming its own setup needs to know WHICH keys
+ * landed, and nothing on a read surface should be able to return a credential value. That holds
+ * even though the caller supplied it moments earlier, because the read is repeatable by anyone
+ * holding the key afterwards.
+ */
+export declare const publicEnvironmentConnectionViewSchema: v.ObjectSchema<{
+    /** The provision type this connection serves. */
+    readonly provisionType: v.StringSchema<undefined>;
+    readonly engine: v.LiteralSchema<"kubernetes", undefined>;
+    readonly label: v.StringSchema<undefined>;
+    readonly apiServerUrl: v.StringSchema<undefined>;
+    /** The secret-bundle keys this connection holds, never their values. */
+    readonly secretKeys: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type PublicEnvironmentConnectionView = v.InferOutput<typeof publicEnvironmentConnectionViewSchema>;
+/**
+ * Where ONE service's per-run manifests live: the half the engine connection does not carry.
+ *
+ * The platform keeps these two apart deliberately (one cluster, many services, each with its own
+ * manifests), and this surface keeps the same seam rather than collapsing them into one call, so a
+ * caller adding a second service to an existing cluster changes one thing.
+ */
+export declare const publicServiceProvisioningSchema: v.VariantSchema<"type", [v.ObjectSchema<{
+    readonly type: v.LiteralSchema<"kubernetes", undefined>;
+    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"colocated", undefined>;
+        /** File or directory path within the pull request's repository. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        /** Omitted ⇒ `raw`. */
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"separate", undefined>;
+        /** `owner/repo` of the manifests repository. */
+        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+        /** Branch, tag or sha to read at; omitted ⇒ that repository's default branch. */
+        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        /** File or directory path within the manifests repository. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        /** Omitted ⇒ `raw`. */
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>], undefined>;
+}, undefined>], undefined>;
+export type PublicServiceProvisioning = v.InferOutput<typeof publicServiceProvisioningSchema>;
+/**
+ * Patch a service. Only the supplied fields change, and an omitted `provisioning` LEAVES the stored
+ * one alone rather than clearing it: a caller renaming a service must not silently un-deploy it.
+ *
+ * At least one field is REQUIRED, on the same reading as the bootstrap body above: a patch naming
+ * nothing describes no edit, and admitting it would spend a write, a re-read and a board-wide
+ * event broadcast on a request whose only possible outcome is the state it started in. The generated
+ * clients default the body, so an empty one is a call a caller makes by accident rather than on
+ * purpose.
+ */
+export declare const updatePublicServiceSchema: v.SchemaWithPipe<readonly [v.ObjectSchema<{
+    readonly title: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    readonly description: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+    readonly provisioning: v.OptionalSchema<v.VariantSchema<"type", [v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"kubernetes", undefined>;
+        readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"colocated", undefined>;
+            /** File or directory path within the pull request's repository. */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /** Omitted ⇒ `raw`. */
+            readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"separate", undefined>;
+            /** `owner/repo` of the manifests repository. */
+            readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+            /** Branch, tag or sha to read at; omitted ⇒ that repository's default branch. */
+            readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            /** File or directory path within the manifests repository. */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            /** Omitted ⇒ `raw`. */
+            readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+        }, undefined>], undefined>;
+    }, undefined>], undefined>, undefined>;
+}, undefined>, v.CheckAction<{
+    title?: string | undefined;
+    description?: string | undefined;
+    provisioning?: {
+        type: "kubernetes";
+        manifestSource: {
+            type: "colocated";
+            path: string;
+            renderer?: "kustomize" | "raw" | undefined;
+        } | {
+            type: "separate";
+            repo: string;
+            ref?: string | undefined;
+            path: string;
+            renderer?: "kustomize" | "raw" | undefined;
+        };
+    } | undefined;
+}, "Supply at least one of title, description or provisioning.">]>;
+export type UpdatePublicServiceInput = v.InferOutput<typeof updatePublicServiceSchema>;
+/**
+ * One model in the workspace's catalog, reduced to the question a caller actually has: can a run
+ * dispatch to this, and if not, is that because nobody configured it or because a policy refuses it?
+ *
+ * Those two are separated because they need OPPOSITE fixes, and conflating them is the specific
+ * failure this projection exists to prevent: telling an operator to add a provider key when every
+ * model is already configured and blocked by their account's model-family policy sends them to
+ * change a setting that is already correct.
+ */
+export declare const publicWiredModelSchema: v.ObjectSchema<{
+    readonly modelId: v.StringSchema<undefined>;
+    readonly label: v.StringSchema<undefined>;
+    /** Provider label for the flavour actually in use, e.g. `Cloudflare`, `Bedrock`. */
+    readonly provider: v.StringSchema<undefined>;
+    /** Whether a run can dispatch to it right now. */
+    readonly available: v.BooleanSchema<undefined>;
+    /** Whether it is unavailable specifically because an account model policy refuses its family. */
+    readonly policyBlocked: v.BooleanSchema<undefined>;
+}, undefined>;
+export type PublicWiredModel = v.InferOutput<typeof publicWiredModelSchema>;
+/**
+ * The catalog, plus the one thing the catalog itself cannot say.
+ *
+ * `excludesUserScopedModels` reports that this deployment serves per-user locally-run model
+ * endpoints, which a key-authenticated read does not see: they are one developer's own machine, and
+ * an API key has no developer, so folding them in would attribute someone else's endpoints to the
+ * caller. Without this flag their absence is byte-for-byte "this deployment has nothing wired", and
+ * those two need OPPOSITE remedies: the first is a run that must be started by a signed-in user,
+ * the second is a provider key. That is the same conflation `policyBlocked` exists to prevent, one
+ * level up: a third state, stated rather than collapsed into a false.
+ */
+export declare const publicWiredModelListSchema: v.ObjectSchema<{
+    readonly models: v.ArraySchema<v.ObjectSchema<{
+        readonly modelId: v.StringSchema<undefined>;
+        readonly label: v.StringSchema<undefined>;
+        /** Provider label for the flavour actually in use, e.g. `Cloudflare`, `Bedrock`. */
+        readonly provider: v.StringSchema<undefined>;
+        /** Whether a run can dispatch to it right now. */
+        readonly available: v.BooleanSchema<undefined>;
+        /** Whether it is unavailable specifically because an account model policy refuses its family. */
+        readonly policyBlocked: v.BooleanSchema<undefined>;
+    }, undefined>, undefined>;
+    /** Whether per-user locally-run endpoints exist here that this read cannot enumerate. */
+    readonly excludesUserScopedModels: v.BooleanSchema<undefined>;
+}, undefined>;
+export type PublicWiredModelList = v.InferOutput<typeof publicWiredModelListSchema>;
+/**
+ * The workspace's VCS connection, reduced to what it may DO.
+ *
+ * The two permission flags are the whole reason this is on the surface. Both are refused by the
+ * provider at PUSH time rather than at connect time, so a caller that cannot read them discovers a
+ * missing `workflows: write` as a repository that bootstrapped and then failed to gain its CI
+ * workflow, which reads like a broken bootstrap rather than a missing permission.
+ */
+export declare const publicVcsConnectionSchema: v.ObjectSchema<{
+    readonly provider: v.PicklistSchema<["github", "gitlab"], undefined>;
+    /** The account (user or organisation) the workspace is connected to. */
+    readonly accountLogin: v.StringSchema<undefined>;
+    /** How the workspace authenticates: an app installation, or a pasted token. */
+    readonly method: v.PicklistSchema<["app", "pat"], undefined>;
+    /** Whether the platform can create repositories under this account itself. */
+    readonly canCreateRepos: v.BooleanSchema<undefined>;
+    /** Whether the connection may write `.github/workflows/*`, which a CI gate depends on. */
+    readonly canManageWorkflows: v.BooleanSchema<undefined>;
+}, undefined>;
+export type PublicVcsConnection = v.InferOutput<typeof publicVcsConnectionSchema>;
+/**
+ * `connection: null` is a real, reportable state (nothing connected), not an absence to 404 on: a
+ * caller setting a workspace up asks this question precisely when the answer may be "nothing yet".
+ */
+export declare const publicVcsConnectionViewSchema: v.ObjectSchema<{
+    readonly connection: v.NullableSchema<v.ObjectSchema<{
+        readonly provider: v.PicklistSchema<["github", "gitlab"], undefined>;
+        /** The account (user or organisation) the workspace is connected to. */
+        readonly accountLogin: v.StringSchema<undefined>;
+        /** How the workspace authenticates: an app installation, or a pasted token. */
+        readonly method: v.PicklistSchema<["app", "pat"], undefined>;
+        /** Whether the platform can create repositories under this account itself. */
+        readonly canCreateRepos: v.BooleanSchema<undefined>;
+        /** Whether the connection may write `.github/workflows/*`, which a CI gate depends on. */
+        readonly canManageWorkflows: v.BooleanSchema<undefined>;
+    }, undefined>, undefined>;
+}, undefined>;
+export type PublicVcsConnectionView = v.InferOutput<typeof publicVcsConnectionViewSchema>;
+/**
+ * One merge preset, reduced to what decides whether a run can LAND without a person.
+ *
+ * `dryRunRoles` is projected even though a caller cannot resolve which role its own key runs
+ * under: a non-empty list is the difference between "this preset merges" and "this preset merges
+ * for everyone except the role you might be", and stating it lets a caller report the caveat
+ * rather than assert a verdict it has not earned.
+ *
+ * `submissionRestrictedRoles` is the SECOND such caveat and rides for the same reason. A preset
+ * carries two role-scoped bars on LANDING (ADR 0039's per-role change-class allowlist, enforced at
+ * both merge exits, and the dry-run list), and publishing one of them made the other read as
+ * absent: `autoMergeEnabled: true` with an empty `dryRunRoles` says "this preset merges" while a
+ * role allowlist holds every run outside its classes for a human. What is deliberately NOT here is
+ * the per-role narrowing of the score CEILINGS (`classRulesByRole`), on the same line this
+ * projection already draws for the ceilings themselves: it decides how much review landing takes,
+ * where these two decide whether landing happens at all.
+ */
+export declare const publicMergePresetSchema: v.ObjectSchema<{
+    readonly presetId: v.StringSchema<undefined>;
+    readonly name: v.StringSchema<undefined>;
+    /** Whether a task that pins no preset resolves this one. */
+    readonly isDefault: v.BooleanSchema<undefined>;
+    /** The master switch: false holds every pull request for a person. */
+    readonly autoMergeEnabled: v.BooleanSchema<undefined>;
+    /** How many times the `ci-fixer` may try to turn CI green before giving up. */
+    readonly ciMaxAttempts: v.NumberSchema<undefined>;
+    /** Workspace roles whose runs this preset forces into dry-run mode. */
+    readonly dryRunRoles: v.ArraySchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>;
+    /**
+     * Workspace roles whose runs may land only the change classes an allowlist names, so a run
+     * outside them is held for a person however good its scores are. A role absent from this list is
+     * unrestricted; the classes themselves are internal vocabulary and stay off this surface.
+     */
+    readonly submissionRestrictedRoles: v.ArraySchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>;
+}, undefined>;
+export type PublicMergePreset = v.InferOutput<typeof publicMergePresetSchema>;
+export declare const publicMergePresetListSchema: v.ObjectSchema<{
+    readonly presets: v.ArraySchema<v.ObjectSchema<{
+        readonly presetId: v.StringSchema<undefined>;
+        readonly name: v.StringSchema<undefined>;
+        /** Whether a task that pins no preset resolves this one. */
+        readonly isDefault: v.BooleanSchema<undefined>;
+        /** The master switch: false holds every pull request for a person. */
+        readonly autoMergeEnabled: v.BooleanSchema<undefined>;
+        /** How many times the `ci-fixer` may try to turn CI green before giving up. */
+        readonly ciMaxAttempts: v.NumberSchema<undefined>;
+        /** Workspace roles whose runs this preset forces into dry-run mode. */
+        readonly dryRunRoles: v.ArraySchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>;
+        /**
+         * Workspace roles whose runs may land only the change classes an allowlist names, so a run
+         * outside them is held for a person however good its scores are. A role absent from this list is
+         * unrestricted; the classes themselves are internal vocabulary and stay off this surface.
+         */
+        readonly submissionRestrictedRoles: v.ArraySchema<v.PicklistSchema<readonly ["admin", "member", "viewer"], undefined>, undefined>;
+    }, undefined>, undefined>;
+}, undefined>;
+export type PublicMergePresetList = v.InferOutput<typeof publicMergePresetListSchema>;
+//# sourceMappingURL=public-provisioning.d.ts.map