@claudexor/schema 1.0.0 → 2.0.0

package/dist/auth.d.ts

@@ -0,0 +1,1423 @@
+import { z } from "zod";
+/** What credential behavior the caller asked Claudexor to enforce. */
+export declare const AuthRequest: z.ZodEnum<["subscription", "api_key", "auto"]>;
+export type AuthRequest = z.infer<typeof AuthRequest>;
+/** The concrete credential transport selected for one real harness execution. */
+export declare const CredentialRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+export type CredentialRoute = z.infer<typeof CredentialRoute>;
+export declare const AuthAvailability: z.ZodEnum<["available", "unavailable", "unknown"]>;
+export type AuthAvailability = z.infer<typeof AuthAvailability>;
+export declare const AuthVerification: z.ZodEnum<["passed", "failed", "not_run"]>;
+export type AuthVerification = z.infer<typeof AuthVerification>;
+export declare const AuthSourceKind: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+export type AuthSourceKind = z.infer<typeof AuthSourceKind>;
+export declare const AuthSourceReadiness: z.ZodObject<{
+    source: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+    availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
+    verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+    detail: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    availability: "unknown" | "available" | "unavailable";
+    verification: "passed" | "failed" | "not_run";
+    detail?: string | undefined;
+}, {
+    source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    availability: "unknown" | "available" | "unavailable";
+    verification: "passed" | "failed" | "not_run";
+    detail?: string | undefined;
+}>;
+export type AuthSourceReadiness = z.infer<typeof AuthSourceReadiness>;
+/**
+ * Exact point-in-time readiness request for one harness credential source.
+ * The harness id is carried by the route/service input, so the body cannot
+ * disagree with the selected adapter. A refresh always bypasses readiness
+ * caches; there is intentionally no staged `fresh` knob.
+ */
+export declare const ControlAuthReadinessRefreshRequest: z.ZodObject<{
+    authRequest: z.ZodEnum<["subscription", "api_key", "auto"]>;
+    source: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+}, "strict", z.ZodTypeAny, {
+    source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    authRequest: "auto" | "subscription" | "api_key";
+}, {
+    source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    authRequest: "auto" | "subscription" | "api_key";
+}>;
+export type ControlAuthReadinessRefreshRequest = z.infer<typeof ControlAuthReadinessRefreshRequest>;
+/**
+ * Source-scoped readiness must remain separate from the aggregate harness
+ * catalog: it proves only the requested source and must not overwrite other
+ * sources, intents, model truth, or aggregate health.
+ */
+export declare const ControlAuthReadinessRefreshResponse: z.ZodEffects<z.ZodObject<{
+    harnessId: z.ZodString;
+    authRequest: z.ZodEnum<["subscription", "api_key", "auto"]>;
+    requestedSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+    observedAt: z.ZodString;
+    readiness: z.ZodObject<{
+        source: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+        availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
+        verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+        detail: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        detail?: string | undefined;
+    }, {
+        source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        detail?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    authRequest: "auto" | "subscription" | "api_key";
+    harnessId: string;
+    requestedSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    observedAt: string;
+    readiness: {
+        source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        detail?: string | undefined;
+    };
+}, {
+    authRequest: "auto" | "subscription" | "api_key";
+    harnessId: string;
+    requestedSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    observedAt: string;
+    readiness: {
+        source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        detail?: string | undefined;
+    };
+}>, {
+    authRequest: "auto" | "subscription" | "api_key";
+    harnessId: string;
+    requestedSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    observedAt: string;
+    readiness: {
+        source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        detail?: string | undefined;
+    };
+}, {
+    authRequest: "auto" | "subscription" | "api_key";
+    harnessId: string;
+    requestedSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    observedAt: string;
+    readiness: {
+        source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        detail?: string | undefined;
+    };
+}>;
+export type ControlAuthReadinessRefreshResponse = z.infer<typeof ControlAuthReadinessRefreshResponse>;
+/** Billing truth is deliberately independent from credential transport. */
+export declare const BillingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+export type BillingKnowledge = z.infer<typeof BillingKnowledge>;
+export declare const CostKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+export type CostKnowledge = z.infer<typeof CostKnowledge>;
+export declare const AuthCapabilitySelectionReason: z.ZodEnum<["exact_requested_route", "adapter_unavailable", "request_mismatch", "route_missing", "route_mismatch", "source_missing", "source_mismatch", "harness_error", "adapter_error", "missing_completion", "response_mismatch", "scratch_mutated", "protocol_violation", "adapter_identity_mismatch", "cancelled"]>;
+export type AuthCapabilitySelectionReason = z.infer<typeof AuthCapabilitySelectionReason>;
+/** Persisted and shown before a setup flow is allowed to spend a real model turn. */
+export declare const AuthSmokeDisclosure: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    protocolVersion: z.ZodLiteral<1>;
+    harness: z.ZodString;
+    requested: z.ZodEnum<["subscription", "api_key", "auto"]>;
+    requiredRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+    requiredSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+    networkScope: z.ZodLiteral<"selected_harness_only">;
+    billingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+    incrementalCostKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+    mayConsumeQuota: z.ZodBoolean;
+    generatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: 1;
+    protocolVersion: 1;
+    harness: string;
+    requested: "auto" | "subscription" | "api_key";
+    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    networkScope: "selected_harness_only";
+    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+    mayConsumeQuota: boolean;
+    generatedAt: string;
+}, {
+    schemaVersion: 1;
+    protocolVersion: 1;
+    harness: string;
+    requested: "auto" | "subscription" | "api_key";
+    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    networkScope: "selected_harness_only";
+    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+    mayConsumeQuota: boolean;
+    generatedAt: string;
+}>, {
+    schemaVersion: 1;
+    protocolVersion: 1;
+    harness: string;
+    requested: "auto" | "subscription" | "api_key";
+    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    networkScope: "selected_harness_only";
+    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+    mayConsumeQuota: boolean;
+    generatedAt: string;
+}, {
+    schemaVersion: 1;
+    protocolVersion: 1;
+    harness: string;
+    requested: "auto" | "subscription" | "api_key";
+    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    networkScope: "selected_harness_only";
+    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+    mayConsumeQuota: boolean;
+    generatedAt: string;
+}>;
+export type AuthSmokeDisclosure = z.infer<typeof AuthSmokeDisclosure>;
+/**
+ * Immutable, redacted proof that the selected adapter completed a real
+ * same-harness round trip on the exact requested credential route. Model text
+ * is never stored: responseDigest binds the receipt to the nonce response.
+ */
+export declare const AuthCapabilityStreamEvidence: z.ZodObject<{
+    startedEvents: z.ZodNumber;
+    completedEvents: z.ZodNumber;
+    errorEvents: z.ZodNumber;
+    unexpectedToolEvents: z.ZodNumber;
+    interactionEvents: z.ZodNumber;
+    sessionMismatchEvents: z.ZodNumber;
+    eventsAfterCompleted: z.ZodNumber;
+    aborted: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    aborted: boolean;
+    startedEvents: number;
+    completedEvents: number;
+    errorEvents: number;
+    unexpectedToolEvents: number;
+    interactionEvents: number;
+    sessionMismatchEvents: number;
+    eventsAfterCompleted: number;
+}, {
+    aborted: boolean;
+    startedEvents: number;
+    completedEvents: number;
+    errorEvents: number;
+    unexpectedToolEvents: number;
+    interactionEvents: number;
+    sessionMismatchEvents: number;
+    eventsAfterCompleted: number;
+}>;
+export type AuthCapabilityStreamEvidence = z.infer<typeof AuthCapabilityStreamEvidence>;
+export declare const AuthCapabilityReceipt: z.ZodEffects<z.ZodObject<{
+    receiptId: z.ZodString;
+    attemptId: z.ZodString;
+    harness: z.ZodString;
+    requested: z.ZodEnum<["subscription", "api_key", "auto"]>;
+    requiredRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+    requiredSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+    effective: z.ZodNullable<z.ZodEnum<["vendor_native", "managed_api_key", "local"]>>;
+    effectiveSource: z.ZodNullable<z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>>;
+    selectionReason: z.ZodEnum<["exact_requested_route", "adapter_unavailable", "request_mismatch", "route_missing", "route_mismatch", "source_missing", "source_mismatch", "harness_error", "adapter_error", "missing_completion", "response_mismatch", "scratch_mutated", "protocol_violation", "adapter_identity_mismatch", "cancelled"]>;
+    availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
+    verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+    billingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+    costKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+    costUsd: z.ZodOptional<z.ZodNumber>;
+    startedAt: z.ZodString;
+    completedAt: z.ZodString;
+    challengeDigest: z.ZodString;
+    requestDigest: z.ZodString;
+    responseDigest: z.ZodString;
+    streamDigest: z.ZodString;
+    scratchBeforeDigest: z.ZodString;
+    scratchAfterDigest: z.ZodString;
+    stream: z.ZodObject<{
+        startedEvents: z.ZodNumber;
+        completedEvents: z.ZodNumber;
+        errorEvents: z.ZodNumber;
+        unexpectedToolEvents: z.ZodNumber;
+        interactionEvents: z.ZodNumber;
+        sessionMismatchEvents: z.ZodNumber;
+        eventsAfterCompleted: z.ZodNumber;
+        aborted: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        aborted: boolean;
+        startedEvents: number;
+        completedEvents: number;
+        errorEvents: number;
+        unexpectedToolEvents: number;
+        interactionEvents: number;
+        sessionMismatchEvents: number;
+        eventsAfterCompleted: number;
+    }, {
+        aborted: boolean;
+        startedEvents: number;
+        completedEvents: number;
+        errorEvents: number;
+        unexpectedToolEvents: number;
+        interactionEvents: number;
+        sessionMismatchEvents: number;
+        eventsAfterCompleted: number;
+    }>;
+    evidenceRefs: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    availability: "unknown" | "available" | "unavailable";
+    verification: "passed" | "failed" | "not_run";
+    harness: string;
+    requested: "auto" | "subscription" | "api_key";
+    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+    receiptId: string;
+    attemptId: string;
+    effective: "local" | "vendor_native" | "managed_api_key" | null;
+    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+    costKnowledge: "exact" | "unknown" | "estimated";
+    startedAt: string;
+    completedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    responseDigest: string;
+    streamDigest: string;
+    scratchBeforeDigest: string;
+    scratchAfterDigest: string;
+    stream: {
+        aborted: boolean;
+        startedEvents: number;
+        completedEvents: number;
+        errorEvents: number;
+        unexpectedToolEvents: number;
+        interactionEvents: number;
+        sessionMismatchEvents: number;
+        eventsAfterCompleted: number;
+    };
+    evidenceRefs: string[];
+    costUsd?: number | undefined;
+}, {
+    availability: "unknown" | "available" | "unavailable";
+    verification: "passed" | "failed" | "not_run";
+    harness: string;
+    requested: "auto" | "subscription" | "api_key";
+    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+    receiptId: string;
+    attemptId: string;
+    effective: "local" | "vendor_native" | "managed_api_key" | null;
+    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+    costKnowledge: "exact" | "unknown" | "estimated";
+    startedAt: string;
+    completedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    responseDigest: string;
+    streamDigest: string;
+    scratchBeforeDigest: string;
+    scratchAfterDigest: string;
+    stream: {
+        aborted: boolean;
+        startedEvents: number;
+        completedEvents: number;
+        errorEvents: number;
+        unexpectedToolEvents: number;
+        interactionEvents: number;
+        sessionMismatchEvents: number;
+        eventsAfterCompleted: number;
+    };
+    evidenceRefs: string[];
+    costUsd?: number | undefined;
+}>, {
+    availability: "unknown" | "available" | "unavailable";
+    verification: "passed" | "failed" | "not_run";
+    harness: string;
+    requested: "auto" | "subscription" | "api_key";
+    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+    receiptId: string;
+    attemptId: string;
+    effective: "local" | "vendor_native" | "managed_api_key" | null;
+    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+    costKnowledge: "exact" | "unknown" | "estimated";
+    startedAt: string;
+    completedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    responseDigest: string;
+    streamDigest: string;
+    scratchBeforeDigest: string;
+    scratchAfterDigest: string;
+    stream: {
+        aborted: boolean;
+        startedEvents: number;
+        completedEvents: number;
+        errorEvents: number;
+        unexpectedToolEvents: number;
+        interactionEvents: number;
+        sessionMismatchEvents: number;
+        eventsAfterCompleted: number;
+    };
+    evidenceRefs: string[];
+    costUsd?: number | undefined;
+}, {
+    availability: "unknown" | "available" | "unavailable";
+    verification: "passed" | "failed" | "not_run";
+    harness: string;
+    requested: "auto" | "subscription" | "api_key";
+    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+    receiptId: string;
+    attemptId: string;
+    effective: "local" | "vendor_native" | "managed_api_key" | null;
+    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+    costKnowledge: "exact" | "unknown" | "estimated";
+    startedAt: string;
+    completedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    responseDigest: string;
+    streamDigest: string;
+    scratchBeforeDigest: string;
+    scratchAfterDigest: string;
+    stream: {
+        aborted: boolean;
+        startedEvents: number;
+        completedEvents: number;
+        errorEvents: number;
+        unexpectedToolEvents: number;
+        interactionEvents: number;
+        sessionMismatchEvents: number;
+        eventsAfterCompleted: number;
+    };
+    evidenceRefs: string[];
+    costUsd?: number | undefined;
+}>;
+export type AuthCapabilityReceipt = z.infer<typeof AuthCapabilityReceipt>;
+export declare const AuthCapabilityBinding: z.ZodObject<{
+    attemptId: z.ZodString;
+    challengeDigest: z.ZodString;
+    requestDigest: z.ZodString;
+    disclosure: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        protocolVersion: z.ZodLiteral<1>;
+        harness: z.ZodString;
+        requested: z.ZodEnum<["subscription", "api_key", "auto"]>;
+        requiredRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+        requiredSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+        networkScope: z.ZodLiteral<"selected_harness_only">;
+        billingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+        incrementalCostKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+        mayConsumeQuota: z.ZodBoolean;
+        generatedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    attemptId: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+}, {
+    attemptId: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+}>;
+export type AuthCapabilityBinding = z.infer<typeof AuthCapabilityBinding>;
+export declare const AuthCapabilityLifecycle: z.ZodEffects<z.ZodDiscriminatedUnion<"state", [z.ZodObject<{
+    state: z.ZodLiteral<"disclosed">;
+    attemptId: z.ZodString;
+    challengeDigest: z.ZodString;
+    requestDigest: z.ZodString;
+    disclosure: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        protocolVersion: z.ZodLiteral<1>;
+        harness: z.ZodString;
+        requested: z.ZodEnum<["subscription", "api_key", "auto"]>;
+        requiredRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+        requiredSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+        networkScope: z.ZodLiteral<"selected_harness_only">;
+        billingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+        incrementalCostKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+        mayConsumeQuota: z.ZodBoolean;
+        generatedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    attemptId: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "disclosed";
+}, {
+    attemptId: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "disclosed";
+}>, z.ZodObject<{
+    state: z.ZodLiteral<"running">;
+    startedAt: z.ZodString;
+    attemptId: z.ZodString;
+    challengeDigest: z.ZodString;
+    requestDigest: z.ZodString;
+    disclosure: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        protocolVersion: z.ZodLiteral<1>;
+        harness: z.ZodString;
+        requested: z.ZodEnum<["subscription", "api_key", "auto"]>;
+        requiredRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+        requiredSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+        networkScope: z.ZodLiteral<"selected_harness_only">;
+        billingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+        incrementalCostKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+        mayConsumeQuota: z.ZodBoolean;
+        generatedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    attemptId: string;
+    startedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "running";
+}, {
+    attemptId: string;
+    startedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "running";
+}>, z.ZodObject<{
+    state: z.ZodLiteral<"completed">;
+    startedAt: z.ZodString;
+    completedAt: z.ZodString;
+    receipt: z.ZodEffects<z.ZodObject<{
+        receiptId: z.ZodString;
+        attemptId: z.ZodString;
+        harness: z.ZodString;
+        requested: z.ZodEnum<["subscription", "api_key", "auto"]>;
+        requiredRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+        requiredSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+        effective: z.ZodNullable<z.ZodEnum<["vendor_native", "managed_api_key", "local"]>>;
+        effectiveSource: z.ZodNullable<z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>>;
+        selectionReason: z.ZodEnum<["exact_requested_route", "adapter_unavailable", "request_mismatch", "route_missing", "route_mismatch", "source_missing", "source_mismatch", "harness_error", "adapter_error", "missing_completion", "response_mismatch", "scratch_mutated", "protocol_violation", "adapter_identity_mismatch", "cancelled"]>;
+        availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
+        verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+        billingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+        costKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+        costUsd: z.ZodOptional<z.ZodNumber>;
+        startedAt: z.ZodString;
+        completedAt: z.ZodString;
+        challengeDigest: z.ZodString;
+        requestDigest: z.ZodString;
+        responseDigest: z.ZodString;
+        streamDigest: z.ZodString;
+        scratchBeforeDigest: z.ZodString;
+        scratchAfterDigest: z.ZodString;
+        stream: z.ZodObject<{
+            startedEvents: z.ZodNumber;
+            completedEvents: z.ZodNumber;
+            errorEvents: z.ZodNumber;
+            unexpectedToolEvents: z.ZodNumber;
+            interactionEvents: z.ZodNumber;
+            sessionMismatchEvents: z.ZodNumber;
+            eventsAfterCompleted: z.ZodNumber;
+            aborted: z.ZodBoolean;
+        }, "strict", z.ZodTypeAny, {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        }, {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        }>;
+        evidenceRefs: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        receiptId: string;
+        attemptId: string;
+        effective: "local" | "vendor_native" | "managed_api_key" | null;
+        effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+        selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+        costKnowledge: "exact" | "unknown" | "estimated";
+        startedAt: string;
+        completedAt: string;
+        challengeDigest: string;
+        requestDigest: string;
+        responseDigest: string;
+        streamDigest: string;
+        scratchBeforeDigest: string;
+        scratchAfterDigest: string;
+        stream: {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        };
+        evidenceRefs: string[];
+        costUsd?: number | undefined;
+    }, {
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        receiptId: string;
+        attemptId: string;
+        effective: "local" | "vendor_native" | "managed_api_key" | null;
+        effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+        selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+        costKnowledge: "exact" | "unknown" | "estimated";
+        startedAt: string;
+        completedAt: string;
+        challengeDigest: string;
+        requestDigest: string;
+        responseDigest: string;
+        streamDigest: string;
+        scratchBeforeDigest: string;
+        scratchAfterDigest: string;
+        stream: {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        };
+        evidenceRefs: string[];
+        costUsd?: number | undefined;
+    }>, {
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        receiptId: string;
+        attemptId: string;
+        effective: "local" | "vendor_native" | "managed_api_key" | null;
+        effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+        selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+        costKnowledge: "exact" | "unknown" | "estimated";
+        startedAt: string;
+        completedAt: string;
+        challengeDigest: string;
+        requestDigest: string;
+        responseDigest: string;
+        streamDigest: string;
+        scratchBeforeDigest: string;
+        scratchAfterDigest: string;
+        stream: {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        };
+        evidenceRefs: string[];
+        costUsd?: number | undefined;
+    }, {
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        receiptId: string;
+        attemptId: string;
+        effective: "local" | "vendor_native" | "managed_api_key" | null;
+        effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+        selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+        costKnowledge: "exact" | "unknown" | "estimated";
+        startedAt: string;
+        completedAt: string;
+        challengeDigest: string;
+        requestDigest: string;
+        responseDigest: string;
+        streamDigest: string;
+        scratchBeforeDigest: string;
+        scratchAfterDigest: string;
+        stream: {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        };
+        evidenceRefs: string[];
+        costUsd?: number | undefined;
+    }>;
+    attemptId: z.ZodString;
+    challengeDigest: z.ZodString;
+    requestDigest: z.ZodString;
+    disclosure: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        protocolVersion: z.ZodLiteral<1>;
+        harness: z.ZodString;
+        requested: z.ZodEnum<["subscription", "api_key", "auto"]>;
+        requiredRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+        requiredSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+        networkScope: z.ZodLiteral<"selected_harness_only">;
+        billingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+        incrementalCostKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+        mayConsumeQuota: z.ZodBoolean;
+        generatedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    attemptId: string;
+    startedAt: string;
+    completedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "completed";
+    receipt: {
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        receiptId: string;
+        attemptId: string;
+        effective: "local" | "vendor_native" | "managed_api_key" | null;
+        effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+        selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+        costKnowledge: "exact" | "unknown" | "estimated";
+        startedAt: string;
+        completedAt: string;
+        challengeDigest: string;
+        requestDigest: string;
+        responseDigest: string;
+        streamDigest: string;
+        scratchBeforeDigest: string;
+        scratchAfterDigest: string;
+        stream: {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        };
+        evidenceRefs: string[];
+        costUsd?: number | undefined;
+    };
+}, {
+    attemptId: string;
+    startedAt: string;
+    completedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "completed";
+    receipt: {
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        receiptId: string;
+        attemptId: string;
+        effective: "local" | "vendor_native" | "managed_api_key" | null;
+        effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+        selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+        costKnowledge: "exact" | "unknown" | "estimated";
+        startedAt: string;
+        completedAt: string;
+        challengeDigest: string;
+        requestDigest: string;
+        responseDigest: string;
+        streamDigest: string;
+        scratchBeforeDigest: string;
+        scratchAfterDigest: string;
+        stream: {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        };
+        evidenceRefs: string[];
+        costUsd?: number | undefined;
+    };
+}>, z.ZodObject<{
+    state: z.ZodLiteral<"interrupted_unknown">;
+    startedAt: z.ZodString;
+    interruptedAt: z.ZodString;
+    attemptId: z.ZodString;
+    challengeDigest: z.ZodString;
+    requestDigest: z.ZodString;
+    disclosure: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        protocolVersion: z.ZodLiteral<1>;
+        harness: z.ZodString;
+        requested: z.ZodEnum<["subscription", "api_key", "auto"]>;
+        requiredRoute: z.ZodEnum<["vendor_native", "managed_api_key", "local"]>;
+        requiredSource: z.ZodEnum<["native_session", "oauth_token_env", "api_key_env", "api_key_flag", "provider_auth_file", "none"]>;
+        networkScope: z.ZodLiteral<"selected_harness_only">;
+        billingKnowledge: z.ZodEnum<["proven_zero", "subscription_entitlement", "metered", "unknown"]>;
+        incrementalCostKnowledge: z.ZodEnum<["exact", "estimated", "unknown"]>;
+        mayConsumeQuota: z.ZodBoolean;
+        generatedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }, {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    attemptId: string;
+    startedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "interrupted_unknown";
+    interruptedAt: string;
+}, {
+    attemptId: string;
+    startedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "interrupted_unknown";
+    interruptedAt: string;
+}>]>, {
+    attemptId: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "disclosed";
+} | {
+    attemptId: string;
+    startedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "running";
+} | {
+    attemptId: string;
+    startedAt: string;
+    completedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "completed";
+    receipt: {
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        receiptId: string;
+        attemptId: string;
+        effective: "local" | "vendor_native" | "managed_api_key" | null;
+        effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+        selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+        costKnowledge: "exact" | "unknown" | "estimated";
+        startedAt: string;
+        completedAt: string;
+        challengeDigest: string;
+        requestDigest: string;
+        responseDigest: string;
+        streamDigest: string;
+        scratchBeforeDigest: string;
+        scratchAfterDigest: string;
+        stream: {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        };
+        evidenceRefs: string[];
+        costUsd?: number | undefined;
+    };
+} | {
+    attemptId: string;
+    startedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "interrupted_unknown";
+    interruptedAt: string;
+}, {
+    attemptId: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "disclosed";
+} | {
+    attemptId: string;
+    startedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "running";
+} | {
+    attemptId: string;
+    startedAt: string;
+    completedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "completed";
+    receipt: {
+        availability: "unknown" | "available" | "unavailable";
+        verification: "passed" | "failed" | "not_run";
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        receiptId: string;
+        attemptId: string;
+        effective: "local" | "vendor_native" | "managed_api_key" | null;
+        effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+        selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+        costKnowledge: "exact" | "unknown" | "estimated";
+        startedAt: string;
+        completedAt: string;
+        challengeDigest: string;
+        requestDigest: string;
+        responseDigest: string;
+        streamDigest: string;
+        scratchBeforeDigest: string;
+        scratchAfterDigest: string;
+        stream: {
+            aborted: boolean;
+            startedEvents: number;
+            completedEvents: number;
+            errorEvents: number;
+            unexpectedToolEvents: number;
+            interactionEvents: number;
+            sessionMismatchEvents: number;
+            eventsAfterCompleted: number;
+        };
+        evidenceRefs: string[];
+        costUsd?: number | undefined;
+    };
+} | {
+    attemptId: string;
+    startedAt: string;
+    challengeDigest: string;
+    requestDigest: string;
+    disclosure: {
+        schemaVersion: 1;
+        protocolVersion: 1;
+        harness: string;
+        requested: "auto" | "subscription" | "api_key";
+        requiredRoute: "local" | "vendor_native" | "managed_api_key";
+        requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        networkScope: "selected_harness_only";
+        billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+        incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+        mayConsumeQuota: boolean;
+        generatedAt: string;
+    };
+    state: "interrupted_unknown";
+    interruptedAt: string;
+}>;
+export type AuthCapabilityLifecycle = z.infer<typeof AuthCapabilityLifecycle>;
+//# sourceMappingURL=auth.d.ts.map