@opengeni/contracts 0.50.0 → 1.0.0

package/dist/external-identities.d.ts

@@ -0,0 +1,784 @@
+import { z } from "zod";
+export declare const ExternalIdentityReference: z.ZodObject<{
+    externalId: z.ZodString;
+    source: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export type ExternalIdentityReference = z.infer<typeof ExternalIdentityReference>;
+export declare const AddExternalWorkspaceMemberRequest: z.ZodObject<{
+    identity: z.ZodObject<{
+        externalId: z.ZodString;
+        source: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+    operationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type AddExternalWorkspaceMemberRequest = z.infer<typeof AddExternalWorkspaceMemberRequest>;
+/** Content-free service lookup, including identities which can no longer act. */
+export declare const ExternalIdentityLookup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    found: z.ZodLiteral<false>;
+}, z.core.$strict>, z.ZodObject<{
+    found: z.ZodLiteral<true>;
+    subjectId: z.ZodString;
+    organizationMembershipId: z.ZodString;
+    identityStatus: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+        revoked: "revoked";
+    }>;
+    identityAuthorizationRevision: z.ZodNumber;
+    membershipStatus: z.ZodEnum<{
+        active: "active";
+        provisioning: "provisioning";
+        revoked: "revoked";
+        suspended: "suspended";
+    }>;
+    membershipAuthorizationRevision: z.ZodNumber;
+}, z.core.$strict>], "found">;
+export type ExternalIdentityLookup = z.infer<typeof ExternalIdentityLookup>;
+/** Terminal withdrawal of this external member's workspace access, also fencing
+ * an exact earlier onboarding operation whether or not it has reached the API. */
+export declare const CancelExternalWorkspaceMemberGrantRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    cancelGrantOperationId: z.ZodString;
+}, z.core.$strict>;
+export type CancelExternalWorkspaceMemberGrantRequest = z.infer<typeof CancelExternalWorkspaceMemberGrantRequest>;
+export declare const CancelExternalWorkspaceMemberGrantResponse: z.ZodObject<{
+    removed: z.ZodBoolean;
+    replay: z.ZodBoolean;
+    fencedGrantOperationId: z.ZodString;
+}, z.core.$strict>;
+export type CancelExternalWorkspaceMemberGrantResponse = z.infer<typeof CancelExternalWorkspaceMemberGrantResponse>;
+/** Replace an existing external member's permissions in one shared workspace.
+ * Keyed and idempotent like a grant; narrowing forces live authority to
+ * re-check but never cancels or tears down work. */
+export declare const UpdateExternalWorkspaceMemberRequest: z.ZodObject<{
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type UpdateExternalWorkspaceMemberRequest = z.infer<typeof UpdateExternalWorkspaceMemberRequest>;
+export declare const UpdateExternalWorkspaceMemberResponse: z.ZodObject<{
+    subjectId: z.ZodString;
+    organizationMembershipId: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+    narrowed: z.ZodBoolean;
+    replay: z.ZodBoolean;
+}, z.core.$strict>;
+export type UpdateExternalWorkspaceMemberResponse = z.infer<typeof UpdateExternalWorkspaceMemberResponse>;
+/** Uses the organization membership ID returned by lazy identity admission.
+ * Reactivation restores admission only, not revoked work or workspace grants. */
+export declare const UpdateExternalIdentityMembershipRequest: z.ZodObject<{
+    kind: z.ZodEnum<{
+        offboard: "offboard";
+        reactivate: "reactivate";
+        suspend: "suspend";
+    }>;
+    expectedAuthorizationRevision: z.ZodNumber;
+    operationId: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type UpdateExternalIdentityMembershipRequest = z.infer<typeof UpdateExternalIdentityMembershipRequest>;
+export declare const ExternalActorSelection: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"external">;
+    identity: z.ZodObject<{
+        externalId: z.ZodString;
+        source: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"linked_native">;
+    identity: z.ZodObject<{
+        externalId: z.ZodString;
+        source: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    linkId: z.ZodString;
+    expectedLinkRevision: z.ZodNumber;
+}, z.core.$strict>], "mode">;
+export type ExternalActorSelection = z.infer<typeof ExternalActorSelection>;
+export declare const ExternalIdentity: z.ZodObject<{
+    id: z.ZodString;
+    accountId: z.ZodString;
+    source: z.ZodString;
+    externalId: z.ZodString;
+    subjectId: z.ZodString;
+    organizationMembershipId: z.ZodString;
+    personalWorkspaceId: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+        revoked: "revoked";
+    }>;
+    authorizationRevision: z.ZodNumber;
+}, z.core.$strict>;
+export type ExternalIdentity = z.infer<typeof ExternalIdentity>;
+export declare const ExternalActorAttribution: z.ZodObject<{
+    accountId: z.ZodString;
+    authenticatingApiKeyId: z.ZodString;
+    externalIdentityId: z.ZodString;
+    externalSubjectId: z.ZodString;
+    externalAuthorizationRevision: z.ZodNumber;
+    effectiveSubjectId: z.ZodString;
+    actingMode: z.ZodEnum<{
+        external: "external";
+        linked_native: "linked_native";
+    }>;
+    linkId: z.ZodOptional<z.ZodString>;
+    linkRevision: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type ExternalActorAttribution = z.infer<typeof ExternalActorAttribution>;
+/** Server-signed/encrypted continuation data, never sufficient live authority. */
+export declare const ExternalActorContinuation: z.ZodObject<{
+    identity: z.ZodObject<{
+        externalId: z.ZodString;
+        source: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    actor: z.ZodObject<{
+        accountId: z.ZodString;
+        authenticatingApiKeyId: z.ZodString;
+        externalIdentityId: z.ZodString;
+        externalSubjectId: z.ZodString;
+        externalAuthorizationRevision: z.ZodNumber;
+        effectiveSubjectId: z.ZodString;
+        actingMode: z.ZodEnum<{
+            external: "external";
+            linked_native: "linked_native";
+        }>;
+        linkId: z.ZodOptional<z.ZodString>;
+        linkRevision: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ExternalActorContinuation = z.infer<typeof ExternalActorContinuation>;
+export declare const ExternalIdentityLink: z.ZodObject<{
+    id: z.ZodString;
+    accountId: z.ZodString;
+    externalIdentityId: z.ZodString;
+    externalIdentity: z.ZodOptional<z.ZodObject<{
+        externalId: z.ZodString;
+        source: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>>;
+    nativeSubjectId: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        pending: "pending";
+        revoked: "revoked";
+    }>;
+    revision: z.ZodNumber;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type ExternalIdentityLink = z.infer<typeof ExternalIdentityLink>;
+export declare const ExternalIdentityLinkPage: z.ZodObject<{
+    links: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        accountId: z.ZodString;
+        externalIdentityId: z.ZodString;
+        externalIdentity: z.ZodOptional<z.ZodObject<{
+            externalId: z.ZodString;
+            source: z.ZodDefault<z.ZodString>;
+        }, z.core.$strict>>;
+        nativeSubjectId: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            pending: "pending";
+            revoked: "revoked";
+        }>;
+        revision: z.ZodNumber;
+        permissions: z.ZodArray<z.ZodEnum<{
+            "account:admin": "account:admin";
+            "account:read": "account:read";
+            "api_keys:manage": "api_keys:manage";
+            "artifacts:publish": "artifacts:publish";
+            "artifacts:read": "artifacts:read";
+            "billing:manage": "billing:manage";
+            "billing:read": "billing:read";
+            "capabilities:manage": "capabilities:manage";
+            "codemode:call": "codemode:call";
+            "connections:read": "connections:read";
+            "connections:write": "connections:write";
+            "documents:manage": "documents:manage";
+            "documents:search": "documents:search";
+            "enrollments:manage": "enrollments:manage";
+            "enrollments:read": "enrollments:read";
+            "environments:manage": "environments:manage";
+            "environments:use": "environments:use";
+            "files:read": "files:read";
+            "files:upload": "files:upload";
+            "files:write": "files:write";
+            "github:manage": "github:manage";
+            "github:use": "github:use";
+            "goals:manage": "goals:manage";
+            "mcp_servers:attach": "mcp_servers:attach";
+            "members:manage": "members:manage";
+            "rigs:manage": "rigs:manage";
+            "rigs:use": "rigs:use";
+            "scheduled_tasks:manage": "scheduled_tasks:manage";
+            "scheduled_tasks:run": "scheduled_tasks:run";
+            "secrets:list": "secrets:list";
+            "secrets:read": "secrets:read";
+            "secrets:write": "secrets:write";
+            "sessions:control": "sessions:control";
+            "sessions:create": "sessions:create";
+            "sessions:read": "sessions:read";
+            "stream:acknowledge": "stream:acknowledge";
+            "stream:control": "stream:control";
+            "stream:view": "stream:view";
+            "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
+            "variable-sets:attach": "variable-sets:attach";
+            "variable-sets:list": "variable-sets:list";
+            "variable-sets:manage": "variable-sets:manage";
+            "variable-sets:read": "variable-sets:read";
+            "variable-sets:use": "variable-sets:use";
+            "variable-sets:write": "variable-sets:write";
+            "workspace:admin": "workspace:admin";
+            "workspace:create": "workspace:create";
+            "workspace:read": "workspace:read";
+        }>>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type ExternalIdentityLinkPage = z.infer<typeof ExternalIdentityLinkPage>;
+/** A native confirmation may narrow this request, never broaden it. The
+ * challenge is delivered once to the host and is not an authentication token. */
+export declare const BeginExternalIdentityLinkRequest: z.ZodObject<{
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strict>;
+export type BeginExternalIdentityLinkRequest = z.input<typeof BeginExternalIdentityLinkRequest>;
+export declare const ConfirmExternalIdentityLinkRequest: z.ZodObject<{
+    challenge: z.ZodString;
+    expectedRevision: z.ZodNumber;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+}, z.core.$strict>;
+export type ConfirmExternalIdentityLinkRequest = z.infer<typeof ConfirmExternalIdentityLinkRequest>;
+export declare const BeginExternalIdentityLinkResponse: z.ZodObject<{
+    link: z.ZodObject<{
+        id: z.ZodString;
+        accountId: z.ZodString;
+        externalIdentityId: z.ZodString;
+        externalIdentity: z.ZodOptional<z.ZodObject<{
+            externalId: z.ZodString;
+            source: z.ZodDefault<z.ZodString>;
+        }, z.core.$strict>>;
+        nativeSubjectId: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            pending: "pending";
+            revoked: "revoked";
+        }>;
+        revision: z.ZodNumber;
+        permissions: z.ZodArray<z.ZodEnum<{
+            "account:admin": "account:admin";
+            "account:read": "account:read";
+            "api_keys:manage": "api_keys:manage";
+            "artifacts:publish": "artifacts:publish";
+            "artifacts:read": "artifacts:read";
+            "billing:manage": "billing:manage";
+            "billing:read": "billing:read";
+            "capabilities:manage": "capabilities:manage";
+            "codemode:call": "codemode:call";
+            "connections:read": "connections:read";
+            "connections:write": "connections:write";
+            "documents:manage": "documents:manage";
+            "documents:search": "documents:search";
+            "enrollments:manage": "enrollments:manage";
+            "enrollments:read": "enrollments:read";
+            "environments:manage": "environments:manage";
+            "environments:use": "environments:use";
+            "files:read": "files:read";
+            "files:upload": "files:upload";
+            "files:write": "files:write";
+            "github:manage": "github:manage";
+            "github:use": "github:use";
+            "goals:manage": "goals:manage";
+            "mcp_servers:attach": "mcp_servers:attach";
+            "members:manage": "members:manage";
+            "rigs:manage": "rigs:manage";
+            "rigs:use": "rigs:use";
+            "scheduled_tasks:manage": "scheduled_tasks:manage";
+            "scheduled_tasks:run": "scheduled_tasks:run";
+            "secrets:list": "secrets:list";
+            "secrets:read": "secrets:read";
+            "secrets:write": "secrets:write";
+            "sessions:control": "sessions:control";
+            "sessions:create": "sessions:create";
+            "sessions:read": "sessions:read";
+            "stream:acknowledge": "stream:acknowledge";
+            "stream:control": "stream:control";
+            "stream:view": "stream:view";
+            "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
+            "variable-sets:attach": "variable-sets:attach";
+            "variable-sets:list": "variable-sets:list";
+            "variable-sets:manage": "variable-sets:manage";
+            "variable-sets:read": "variable-sets:read";
+            "variable-sets:use": "variable-sets:use";
+            "variable-sets:write": "variable-sets:write";
+            "workspace:admin": "workspace:admin";
+            "workspace:create": "workspace:create";
+            "workspace:read": "workspace:read";
+        }>>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    challenge: z.ZodString;
+    confirmBefore: z.ZodString;
+}, z.core.$strict>;
+export type BeginExternalIdentityLinkResponse = z.infer<typeof BeginExternalIdentityLinkResponse>;
+export declare const ExternalIdentityLinkPreview: z.ZodObject<{
+    link: z.ZodObject<{
+        id: z.ZodString;
+        accountId: z.ZodString;
+        externalIdentityId: z.ZodString;
+        externalIdentity: z.ZodOptional<z.ZodObject<{
+            externalId: z.ZodString;
+            source: z.ZodDefault<z.ZodString>;
+        }, z.core.$strict>>;
+        nativeSubjectId: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            pending: "pending";
+            revoked: "revoked";
+        }>;
+        revision: z.ZodNumber;
+        permissions: z.ZodArray<z.ZodEnum<{
+            "account:admin": "account:admin";
+            "account:read": "account:read";
+            "api_keys:manage": "api_keys:manage";
+            "artifacts:publish": "artifacts:publish";
+            "artifacts:read": "artifacts:read";
+            "billing:manage": "billing:manage";
+            "billing:read": "billing:read";
+            "capabilities:manage": "capabilities:manage";
+            "codemode:call": "codemode:call";
+            "connections:read": "connections:read";
+            "connections:write": "connections:write";
+            "documents:manage": "documents:manage";
+            "documents:search": "documents:search";
+            "enrollments:manage": "enrollments:manage";
+            "enrollments:read": "enrollments:read";
+            "environments:manage": "environments:manage";
+            "environments:use": "environments:use";
+            "files:read": "files:read";
+            "files:upload": "files:upload";
+            "files:write": "files:write";
+            "github:manage": "github:manage";
+            "github:use": "github:use";
+            "goals:manage": "goals:manage";
+            "mcp_servers:attach": "mcp_servers:attach";
+            "members:manage": "members:manage";
+            "rigs:manage": "rigs:manage";
+            "rigs:use": "rigs:use";
+            "scheduled_tasks:manage": "scheduled_tasks:manage";
+            "scheduled_tasks:run": "scheduled_tasks:run";
+            "secrets:list": "secrets:list";
+            "secrets:read": "secrets:read";
+            "secrets:write": "secrets:write";
+            "sessions:control": "sessions:control";
+            "sessions:create": "sessions:create";
+            "sessions:read": "sessions:read";
+            "stream:acknowledge": "stream:acknowledge";
+            "stream:control": "stream:control";
+            "stream:view": "stream:view";
+            "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
+            "variable-sets:attach": "variable-sets:attach";
+            "variable-sets:list": "variable-sets:list";
+            "variable-sets:manage": "variable-sets:manage";
+            "variable-sets:read": "variable-sets:read";
+            "variable-sets:use": "variable-sets:use";
+            "variable-sets:write": "variable-sets:write";
+            "workspace:admin": "workspace:admin";
+            "workspace:create": "workspace:create";
+            "workspace:read": "workspace:read";
+        }>>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    externalIdentity: z.ZodObject<{
+        externalId: z.ZodString;
+        source: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    nativeSubjectId: z.ZodString;
+    organizationId: z.ZodString;
+}, z.core.$strict>;
+export type ExternalIdentityLinkPreview = z.infer<typeof ExternalIdentityLinkPreview>;
+/** Immutable accepted-work restriction, not a browser credential. Original key
+ * identity remains audit-only; durable use validates the live link and members. */
+export declare const ExternalLinkWorkSnapshot: z.ZodObject<{
+    identity: z.ZodObject<{
+        externalId: z.ZodString;
+        source: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    actor: z.ZodObject<{
+        accountId: z.ZodString;
+        authenticatingApiKeyId: z.ZodString;
+        externalIdentityId: z.ZodString;
+        externalSubjectId: z.ZodString;
+        externalAuthorizationRevision: z.ZodNumber;
+        effectiveSubjectId: z.ZodString;
+        actingMode: z.ZodEnum<{
+            external: "external";
+            linked_native: "linked_native";
+        }>;
+        linkId: z.ZodOptional<z.ZodString>;
+        linkRevision: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+    permissionMode: z.ZodOptional<z.ZodEnum<{
+        explicit: "explicit";
+        legacy: "legacy";
+    }>>;
+}, z.core.$strict>;
+export type ExternalLinkWorkSnapshot = z.infer<typeof ExternalLinkWorkSnapshot>;