@cat-factory/contracts 0.54.0 → 0.55.0

package/dist/environments.d.ts

@@ -241,15 +241,15 @@ export declare const environmentManifestSchema: v.ObjectSchema<{
     /** Fallback TTL (ms) when the response carries no explicit expiry. */
     readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
     /**
-     * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
-     * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
-     * ignores it entirely; a native adapter (injected via `buildNodeContainer({
-     * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
-     * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
-     * adapters — the deployment-wide provider singleton has no other way to receive
-     * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
-     * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
-     * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
+     * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+     * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+     * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+     * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+     * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+     * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+     * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+     * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+     * (reuse the exported `UrlSafetyPolicy`).
      */
     readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
 }, undefined>;
@@ -354,13 +354,26 @@ export declare const kubernetesEnvironmentConfigSchema: v.ObjectSchema<{
     readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;
 export type KubernetesEnvironmentConfig = v.InferOutput<typeof kubernetesEnvironmentConfigSchema>;
+/** Built-in environment backend kinds the contract knows by name. */
+export declare const RESERVED_ENVIRONMENT_BACKEND_KINDS: readonly ['manifest', 'kubernetes'];
+/**
+ * The `kind` slug of a CUSTOM (third-party, programmatically-registered) environment
+ * backend: any lower-kebab slug that isn't a reserved built-in. A custom backend stores
+ * everything in the generic manifest — bespoke settings ride `providerConfig`, credentials
+ * the secret bundle — so its connect config is a manifest under this slug, and the
+ * registered `EnvironmentBackendProvider` (resolved by `kind`) owns the semantic
+ * validation. The reserved-kind guard is load-bearing: it stops a wrong-shaped built-in
+ * payload (e.g. `{ kind: 'kubernetes', manifest }`) from silently matching this generic
+ * member instead of failing.
+ */
+export declare const customEnvironmentBackendKindSchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
 /**
  * An ephemeral-environment backend config, discriminated by `kind`. The universal
- * abstraction over HOW a workspace's preview environments are provisioned: today
+ * abstraction over HOW a workspace's preview environments are provisioned: the built-ins
  * `manifest` (the generic BYO HTTP management API) and `kubernetes` (native per-PR
- * namespaces). Future kinds add a member here + a provider in
- * `@cat-factory/integrations` — no new table/service/controller. Mirrors
- * `runnerBackendConfigSchema`; the provider-registry seam keys on `kind`.
+ * namespaces), plus any CUSTOM kind a deployment registers programmatically via
+ * `registerEnvironmentBackend` (it rides the generic manifest member — NO new variant
+ * needed). Mirrors `runnerBackendConfigSchema`; the provider-registry seam keys on `kind`.
  */
 export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.ObjectSchema<{
     readonly kind: v.LiteralSchema<"manifest", undefined>;
@@ -480,15 +493,15 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
         /** Fallback TTL (ms) when the response carries no explicit expiry. */
         readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
         /**
-         * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
-         * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
-         * ignores it entirely; a native adapter (injected via `buildNodeContainer({
-         * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
-         * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
-         * adapters — the deployment-wide provider singleton has no other way to receive
-         * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
-         * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
-         * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
+         * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+         * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+         * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+         * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+         * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+         * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+         * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+         * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+         * (reuse the exported `UrlSafetyPolicy`).
          */
         readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
     }, undefined>;
@@ -553,6 +566,136 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
         /** Extra annotations stamped on the namespace. */
         readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
     }, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
+    readonly manifest: v.ObjectSchema<{
+        readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+        /** Management API root; provision/status/teardown paths are appended to it. */
+        readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+        readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"none", undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"api_key", undefined>;
+            readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly secretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+            /** Optional prefix prepended to the secret value, e.g. `Token `. */
+            readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"bearer", undefined>;
+            readonly secretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"basic", undefined>;
+            readonly usernameSecretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+            readonly passwordSecretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+            readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly clientIdSecretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+            readonly clientSecretSecretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+            readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"custom_headers", undefined>;
+            readonly headers: v.ArraySchema<v.ObjectSchema<{
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>], undefined>;
+        readonly provision: v.ObjectSchema<{
+            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly key: v.StringSchema<undefined>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+        }, undefined>;
+        /** Optional: polled to observe async provisioning progress. */
+        readonly status: v.OptionalSchema<v.ObjectSchema<{
+            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly key: v.StringSchema<undefined>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+        }, undefined>, undefined>;
+        /** Optional: called to destroy the environment (manual or on TTL expiry). */
+        readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+            readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+            readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly key: v.StringSchema<undefined>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly value: v.StringSchema<undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+        }, undefined>, undefined>;
+        readonly response: v.ObjectSchema<{
+            readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly from: v.StringSchema<undefined>;
+                readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly access: v.OptionalSchema<v.ObjectSchema<{
+                readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+        /** Fallback TTL (ms) when the response carries no explicit expiry. */
+        readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+        /**
+         * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+         * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+         * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+         * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+         * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+         * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+         * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+         * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+         * (reuse the exported `UrlSafetyPolicy`).
+         */
+        readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+    }, undefined>;
 }, undefined>], undefined>;
 export type EnvironmentBackendConfig = v.InferOutput<typeof environmentBackendConfigSchema>;
 export type EnvironmentBackendKind = EnvironmentBackendConfig['kind'];
@@ -723,15 +866,15 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
             /** Fallback TTL (ms) when the response carries no explicit expiry. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
             /**
-             * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
-             * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
-             * ignores it entirely; a native adapter (injected via `buildNodeContainer({
-             * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
-             * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
-             * adapters — the deployment-wide provider singleton has no other way to receive
-             * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
-             * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
-             * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+             * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
              */
             readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
         }, undefined>;
@@ -796,6 +939,136 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
             /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+             * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
     }, undefined>], undefined>, undefined>;
 }, undefined>;
 export type EnvironmentConnection = v.InferOutput<typeof environmentConnectionSchema>;
@@ -926,15 +1199,15 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
             /** Fallback TTL (ms) when the response carries no explicit expiry. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
             /**
-             * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
-             * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
-             * ignores it entirely; a native adapter (injected via `buildNodeContainer({
-             * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
-             * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
-             * adapters — the deployment-wide provider singleton has no other way to receive
-             * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
-             * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
-             * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+             * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
              */
             readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
         }, undefined>;
@@ -999,6 +1272,136 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
             /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+             * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
     }, undefined>], undefined>;
     readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
 }, undefined>;
@@ -1131,15 +1534,15 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
             /** Fallback TTL (ms) when the response carries no explicit expiry. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
             /**
-             * Opaque, provider-specific configuration for a *native* injected adapter (e.g. a
-             * Kargo project, link-selection key, status map). The generic HttpEnvironmentProvider
-             * ignores it entirely; a native adapter (injected via `buildNodeContainer({
-             * environmentProvider })` / `startLocal({ environmentProvider })`) reads + validates it
-             * off the per-call `manifest`. This is the per-WORKSPACE config carrier for native
-             * adapters — the deployment-wide provider singleton has no other way to receive
-             * per-workspace settings. NOT covered by the manifest URL/SSRF checks (which only guard
-             * `baseUrl`/`tokenUrl`); an adapter that puts a URL here must guard it itself (reuse the
-             * exported `UrlSafetyPolicy`). See `backend/docs/native-environment-adapter.md`.
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+             * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
              */
             readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
         }, undefined>;
@@ -1204,6 +1607,136 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
             /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered programmatically via `registerEnvironmentBackend`
+             * (see `backend/docs/native-environment-adapter.md`) — reads + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
     }, undefined>], undefined>, undefined>;
     readonly secrets: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;