@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/vault-provider-wire.d.ts

@@ -0,0 +1,907 @@
+/**
+ * `opengeni.vault.v1`: the signed remote vault-provider protocol.
+ *
+ * Opengeni POSTs one JSON request per operation to a registered endpoint,
+ * signed over the exact body with the existing `OpenGeni-Signature` scheme
+ * (`signOpenGeniPayload`). The receiver verifies the signature, then maps the
+ * trusted native authority tuple to its own tenant and user and rechecks
+ * access on every operation: a valid MAC authenticates Opengeni, it is not an
+ * authorization decision. Responses are signed with a response-only derived
+ * key (`vaultProviderWireResponseKey`) so a response can never be replayed as
+ * a request.
+ *
+ * Every shape is strict and bounded. Item metadata may carry a username display
+ * hint, but never other field values.
+ * Mutations carry an idempotency key; Opengeni never retries a mutation
+ * automatically and reports an ambiguous outcome instead.
+ */
+import { z } from "zod";
+export declare const VAULT_PROVIDER_WIRE_VERSION: "opengeni.vault.v1";
+/** Response signature header. Requests use the shared `OpenGeni-Signature` header. */
+export declare const VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER = "OpenGeni-Vault-Response-Signature";
+/**
+ * The response signing key is derived from the connection secret with a fixed
+ * domain label, so request and response MACs are never interchangeable.
+ */
+export declare function vaultProviderWireResponseKey(signingSecret: string): string;
+export declare const VAULT_PROVIDER_WIRE_LIMITS: {
+    readonly maxRequestBytes: number;
+    readonly maxResponseBytes: number;
+    /** Sum of returned secret value bytes in one read. */
+    readonly maxReadValueBytes: number;
+    readonly pageSizeMax: 100;
+    readonly cursorMaxChars: 1024;
+    readonly snapshotMaxChars: 1024;
+    readonly externalIdMaxChars: 300;
+    readonly vaultNameMaxChars: 300;
+    readonly nativeIdMaxChars: 200;
+    readonly readFieldsMax: 50;
+    readonly idempotencyKeyMaxChars: 200;
+    readonly accountIdMaxChars: 300;
+    readonly accountNameMaxChars: 300;
+    readonly versionMaxChars: 300;
+    readonly cacheEpochMaxChars: 200;
+    /** Per request deadline enforced by Opengeni's transport. */
+    readonly defaultTimeoutMs: 15000;
+    readonly maxTimeoutMs: 60000;
+    /** Accepted request age; matches `OPENGENI_SIGNATURE_TOLERANCE_SECONDS`. */
+    readonly signatureToleranceSeconds: 300;
+};
+/** Mirrors `VAULT_PROVIDER_ERROR_CODES` in `@opengeni/vaults` (parity tested there). */
+export declare const VAULT_PROVIDER_WIRE_ERROR_CODES: readonly ["provider_auth_invalid", "provider_auth_expired", "provider_rate_limited", "provider_unavailable", "provider_conflict", "provider_not_found", "provider_permission_denied", "provider_locked", "provider_inventory_incomplete", "provider_outcome_unknown"];
+export type VaultProviderWireErrorCode = (typeof VAULT_PROVIDER_WIRE_ERROR_CODES)[number];
+export declare const VAULT_PROVIDER_WIRE_OPERATIONS: readonly ["describe", "refresh", "list_vaults", "list_items", "read_fields", "write_item", "archive_item"];
+export type VaultProviderWireOperationName = (typeof VAULT_PROVIDER_WIRE_OPERATIONS)[number];
+export type VaultProviderWireMutationName = "write_item" | "archive_item";
+export declare function isVaultProviderWireMutation(op: VaultProviderWireOperationName): op is VaultProviderWireMutationName;
+/** Remote providers that use this protocol. */
+export declare const VaultProviderWireProvider: z.ZodEnum<{
+    external: "external";
+}>;
+export type VaultProviderWireProvider = z.infer<typeof VaultProviderWireProvider>;
+export declare function vaultProviderWireUtf8Bytes(value: string): number;
+/** Case-insensitive name identity used for field-name uniqueness. */
+export declare function vaultProviderWireNameKey(name: string): string;
+/**
+ * The trusted native caller. Opengeni fills it from the authorized registry,
+ * never from model or body-supplied arguments.
+ */
+export declare const VaultProviderWireAuthority: z.ZodObject<{
+    accountId: z.ZodString;
+    workspaceId: z.ZodString;
+    subjectId: z.ZodNullable<z.ZodString>;
+    connectionWorkspaceId: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    turnId: z.ZodOptional<z.ZodString>;
+    attemptId: z.ZodOptional<z.ZodString>;
+    siteId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderWireAuthority = z.infer<typeof VaultProviderWireAuthority>;
+export declare const VaultProviderWirePage: z.ZodObject<{
+    limit: z.ZodNumber;
+    cursor: z.ZodOptional<z.ZodString>;
+    snapshot: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderWirePage = z.infer<typeof VaultProviderWirePage>;
+export declare const VaultProviderWireWriteField: z.ZodObject<{
+    externalFieldId: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        concealed: "concealed";
+        file: "file";
+        text: "text";
+        totp: "totp";
+    }>;
+    value: z.ZodOptional<z.ZodString>;
+    remove: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export type VaultProviderWireWriteField = z.infer<typeof VaultProviderWireWriteField>;
+export declare const VaultProviderWireWriteItem: z.ZodObject<{
+    externalItemId: z.ZodOptional<z.ZodString>;
+    expectedVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    name: z.ZodString;
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }> & z.ZodType<"api_key" | "card" | "file" | "identity" | "login" | "note" | "ssh_key", "api_key" | "card" | "file" | "identity" | "login" | "note" | "passkey" | "ssh_key", z.core.$ZodTypeInternals<"api_key" | "card" | "file" | "identity" | "login" | "note" | "ssh_key", "api_key" | "card" | "file" | "identity" | "login" | "note" | "passkey" | "ssh_key">>;
+    category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    websites: z.ZodArray<z.ZodString>;
+    fields: z.ZodArray<z.ZodObject<{
+        externalFieldId: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>;
+        value: z.ZodOptional<z.ZodString>;
+        remove: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type VaultProviderWireWriteItem = z.infer<typeof VaultProviderWireWriteItem>;
+export declare const VaultProviderWireOperation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    op: z.ZodLiteral<"describe">;
+}, z.core.$strict>, z.ZodObject<{
+    op: z.ZodLiteral<"refresh">;
+}, z.core.$strict>, z.ZodObject<{
+    forceRefresh: z.ZodBoolean;
+    cacheEpoch: z.ZodNullable<z.ZodString>;
+    op: z.ZodLiteral<"list_vaults">;
+    page: z.ZodObject<{
+        limit: z.ZodNumber;
+        cursor: z.ZodOptional<z.ZodString>;
+        snapshot: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    forceRefresh: z.ZodBoolean;
+    cacheEpoch: z.ZodNullable<z.ZodString>;
+    op: z.ZodLiteral<"list_items">;
+    externalVaultId: z.ZodString;
+    page: z.ZodObject<{
+        limit: z.ZodNumber;
+        cursor: z.ZodOptional<z.ZodString>;
+        snapshot: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    forceRefresh: z.ZodBoolean;
+    cacheEpoch: z.ZodNullable<z.ZodString>;
+    op: z.ZodLiteral<"read_fields">;
+    externalVaultId: z.ZodString;
+    externalItemId: z.ZodString;
+    externalFieldIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    op: z.ZodLiteral<"write_item">;
+    externalVaultId: z.ZodString;
+    item: z.ZodObject<{
+        externalItemId: z.ZodOptional<z.ZodString>;
+        expectedVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }> & z.ZodType<"api_key" | "card" | "file" | "identity" | "login" | "note" | "ssh_key", "api_key" | "card" | "file" | "identity" | "login" | "note" | "passkey" | "ssh_key", z.core.$ZodTypeInternals<"api_key" | "card" | "file" | "identity" | "login" | "note" | "ssh_key", "api_key" | "card" | "file" | "identity" | "login" | "note" | "passkey" | "ssh_key">>;
+        category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        websites: z.ZodArray<z.ZodString>;
+        fields: z.ZodArray<z.ZodObject<{
+            externalFieldId: z.ZodOptional<z.ZodString>;
+            name: z.ZodString;
+            kind: z.ZodEnum<{
+                concealed: "concealed";
+                file: "file";
+                text: "text";
+                totp: "totp";
+            }>;
+            value: z.ZodOptional<z.ZodString>;
+            remove: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    op: z.ZodLiteral<"archive_item">;
+    externalVaultId: z.ZodString;
+    externalItemId: z.ZodString;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>], "op">;
+export type VaultProviderWireOperation = z.infer<typeof VaultProviderWireOperation>;
+export type VaultProviderWireOperationOf<Op extends VaultProviderWireOperationName> = Extract<VaultProviderWireOperation, {
+    op: Op;
+}>;
+export declare const VaultProviderWireRequest: z.ZodObject<{
+    version: z.ZodLiteral<"opengeni.vault.v1">;
+    type: z.ZodLiteral<"request">;
+    requestId: z.ZodString;
+    sentAt: z.ZodString;
+    provider: z.ZodEnum<{
+        external: "external";
+    }>;
+    connectionId: z.ZodString;
+    authority: z.ZodObject<{
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        subjectId: z.ZodNullable<z.ZodString>;
+        connectionWorkspaceId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+        turnId: z.ZodOptional<z.ZodString>;
+        attemptId: z.ZodOptional<z.ZodString>;
+        siteId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    operation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        op: z.ZodLiteral<"describe">;
+    }, z.core.$strict>, z.ZodObject<{
+        op: z.ZodLiteral<"refresh">;
+    }, z.core.$strict>, z.ZodObject<{
+        forceRefresh: z.ZodBoolean;
+        cacheEpoch: z.ZodNullable<z.ZodString>;
+        op: z.ZodLiteral<"list_vaults">;
+        page: z.ZodObject<{
+            limit: z.ZodNumber;
+            cursor: z.ZodOptional<z.ZodString>;
+            snapshot: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        forceRefresh: z.ZodBoolean;
+        cacheEpoch: z.ZodNullable<z.ZodString>;
+        op: z.ZodLiteral<"list_items">;
+        externalVaultId: z.ZodString;
+        page: z.ZodObject<{
+            limit: z.ZodNumber;
+            cursor: z.ZodOptional<z.ZodString>;
+            snapshot: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        forceRefresh: z.ZodBoolean;
+        cacheEpoch: z.ZodNullable<z.ZodString>;
+        op: z.ZodLiteral<"read_fields">;
+        externalVaultId: z.ZodString;
+        externalItemId: z.ZodString;
+        externalFieldIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        op: z.ZodLiteral<"write_item">;
+        externalVaultId: z.ZodString;
+        item: z.ZodObject<{
+            externalItemId: z.ZodOptional<z.ZodString>;
+            expectedVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            name: z.ZodString;
+            type: z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }> & z.ZodType<"api_key" | "card" | "file" | "identity" | "login" | "note" | "ssh_key", "api_key" | "card" | "file" | "identity" | "login" | "note" | "passkey" | "ssh_key", z.core.$ZodTypeInternals<"api_key" | "card" | "file" | "identity" | "login" | "note" | "ssh_key", "api_key" | "card" | "file" | "identity" | "login" | "note" | "passkey" | "ssh_key">>;
+            category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            websites: z.ZodArray<z.ZodString>;
+            fields: z.ZodArray<z.ZodObject<{
+                externalFieldId: z.ZodOptional<z.ZodString>;
+                name: z.ZodString;
+                kind: z.ZodEnum<{
+                    concealed: "concealed";
+                    file: "file";
+                    text: "text";
+                    totp: "totp";
+                }>;
+                value: z.ZodOptional<z.ZodString>;
+                remove: z.ZodOptional<z.ZodLiteral<true>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        idempotencyKey: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        op: z.ZodLiteral<"archive_item">;
+        externalVaultId: z.ZodString;
+        externalItemId: z.ZodString;
+        idempotencyKey: z.ZodString;
+    }, z.core.$strict>], "op">;
+}, z.core.$strict>;
+export type VaultProviderWireRequest = z.infer<typeof VaultProviderWireRequest>;
+export declare const VaultProviderWireErrorCode: z.ZodEnum<{
+    provider_auth_expired: "provider_auth_expired";
+    provider_auth_invalid: "provider_auth_invalid";
+    provider_conflict: "provider_conflict";
+    provider_inventory_incomplete: "provider_inventory_incomplete";
+    provider_locked: "provider_locked";
+    provider_not_found: "provider_not_found";
+    provider_outcome_unknown: "provider_outcome_unknown";
+    provider_permission_denied: "provider_permission_denied";
+    provider_rate_limited: "provider_rate_limited";
+    provider_unavailable: "provider_unavailable";
+}>;
+/** Receiver freshness. Opengeni adds its own `lastCheckedAt`. */
+export declare const VaultProviderWireFreshness: z.ZodObject<{
+    state: z.ZodEnum<{
+        current: "current";
+        refreshing: "refreshing";
+        stale: "stale";
+        unavailable: "unavailable";
+    }>;
+    sourceSyncedAt: z.ZodNullable<z.ZodString>;
+    source: z.ZodEnum<{
+        cache: "cache";
+        live: "live";
+        unknown: "unknown";
+    }>;
+    errorCode: z.ZodNullable<z.ZodEnum<{
+        provider_auth_expired: "provider_auth_expired";
+        provider_auth_invalid: "provider_auth_invalid";
+        provider_conflict: "provider_conflict";
+        provider_inventory_incomplete: "provider_inventory_incomplete";
+        provider_locked: "provider_locked";
+        provider_not_found: "provider_not_found";
+        provider_outcome_unknown: "provider_outcome_unknown";
+        provider_permission_denied: "provider_permission_denied";
+        provider_rate_limited: "provider_rate_limited";
+        provider_unavailable: "provider_unavailable";
+    }>>;
+    retryAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderWireFreshness = z.infer<typeof VaultProviderWireFreshness>;
+export declare const VaultProviderWireVault: z.ZodObject<{
+    externalVaultId: z.ZodString;
+    name: z.ZodString;
+    contentVersion: z.ZodNullable<z.ZodString>;
+    itemCount: z.ZodNullable<z.ZodNumber>;
+    writeAccess: z.ZodEnum<{
+        read_only: "read_only";
+        read_write: "read_write";
+        unknown: "unknown";
+    }>;
+    operations: z.ZodOptional<z.ZodObject<{
+        createItemTypes: z.ZodArray<z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>>;
+        updateItem: z.ZodBoolean;
+        removeField: z.ZodBoolean;
+        archiveItem: z.ZodBoolean;
+        archiveKind: z.ZodEnum<{
+            archive: "archive";
+            none: "none";
+            trash: "trash";
+        }>;
+        deleteItem: z.ZodLiteral<false>;
+        restoreItem: z.ZodBoolean;
+        readFiles: z.ZodBoolean;
+        writeFiles: z.ZodBoolean;
+        createTotp: z.ZodBoolean;
+        updateTotp: z.ZodBoolean;
+        createVault: z.ZodBoolean;
+        restoreFieldHistory: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type VaultProviderWireVault = z.infer<typeof VaultProviderWireVault>;
+export declare const VaultProviderWireFieldMeta: z.ZodObject<{
+    externalFieldId: z.ZodString;
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        concealed: "concealed";
+        file: "file";
+        text: "text";
+        totp: "totp";
+    }>;
+}, z.core.$strict>;
+export type VaultProviderWireFieldMeta = z.infer<typeof VaultProviderWireFieldMeta>;
+/** Item metadata, including an optional username display hint but no other values. */
+export declare const VaultProviderWireItemMeta: z.ZodObject<{
+    externalItemId: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodEnum<{
+        api_key: "api_key";
+        card: "card";
+        file: "file";
+        identity: "identity";
+        login: "login";
+        note: "note";
+        passkey: "passkey";
+        ssh_key: "ssh_key";
+    }>;
+    username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    websites: z.ZodArray<z.ZodString>;
+    fields: z.ZodArray<z.ZodObject<{
+        externalFieldId: z.ZodString;
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            concealed: "concealed";
+            file: "file";
+            text: "text";
+            totp: "totp";
+        }>;
+    }, z.core.$strict>>;
+    version: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderWireItemMeta = z.infer<typeof VaultProviderWireItemMeta>;
+export declare const VaultProviderWireFieldValue: z.ZodObject<{
+    externalFieldId: z.ZodString;
+    value: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"text">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"totp">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"bytes">;
+        base64: z.ZodString;
+    }, z.core.$strict>], "type">;
+}, z.core.$strict>;
+export type VaultProviderWireFieldValue = z.infer<typeof VaultProviderWireFieldValue>;
+export declare const VaultProviderWireDescribeResult: z.ZodObject<{
+    accountId: z.ZodString;
+    accountName: z.ZodNullable<z.ZodString>;
+    operations: z.ZodObject<{
+        createItemTypes: z.ZodArray<z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>>;
+        updateItem: z.ZodBoolean;
+        removeField: z.ZodBoolean;
+        archiveItem: z.ZodBoolean;
+        archiveKind: z.ZodEnum<{
+            archive: "archive";
+            none: "none";
+            trash: "trash";
+        }>;
+        deleteItem: z.ZodLiteral<false>;
+        restoreItem: z.ZodBoolean;
+        readFiles: z.ZodBoolean;
+        writeFiles: z.ZodBoolean;
+        createTotp: z.ZodBoolean;
+        updateTotp: z.ZodBoolean;
+        createVault: z.ZodBoolean;
+        restoreFieldHistory: z.ZodBoolean;
+    }, z.core.$strict>;
+    capabilities: z.ZodObject<{
+        totp: z.ZodBoolean;
+        files: z.ZodBoolean;
+    }, z.core.$strict>;
+    inventoryScope: z.ZodLiteral<"connection">;
+}, z.core.$strict>;
+export type VaultProviderWireDescribeResult = z.infer<typeof VaultProviderWireDescribeResult>;
+export declare const VaultProviderWireListVaultsResult: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        externalVaultId: z.ZodString;
+        name: z.ZodString;
+        contentVersion: z.ZodNullable<z.ZodString>;
+        itemCount: z.ZodNullable<z.ZodNumber>;
+        writeAccess: z.ZodEnum<{
+            read_only: "read_only";
+            read_write: "read_write";
+            unknown: "unknown";
+        }>;
+        operations: z.ZodOptional<z.ZodObject<{
+            createItemTypes: z.ZodArray<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>>;
+            updateItem: z.ZodBoolean;
+            removeField: z.ZodBoolean;
+            archiveItem: z.ZodBoolean;
+            archiveKind: z.ZodEnum<{
+                archive: "archive";
+                none: "none";
+                trash: "trash";
+            }>;
+            deleteItem: z.ZodLiteral<false>;
+            restoreItem: z.ZodBoolean;
+            readFiles: z.ZodBoolean;
+            writeFiles: z.ZodBoolean;
+            createTotp: z.ZodBoolean;
+            updateTotp: z.ZodBoolean;
+            createVault: z.ZodBoolean;
+            restoreFieldHistory: z.ZodBoolean;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+    snapshot: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const VaultProviderWireListItemsResult: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        externalItemId: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>;
+        username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        websites: z.ZodArray<z.ZodString>;
+        fields: z.ZodArray<z.ZodObject<{
+            externalFieldId: z.ZodString;
+            name: z.ZodString;
+            kind: z.ZodEnum<{
+                concealed: "concealed";
+                file: "file";
+                text: "text";
+                totp: "totp";
+            }>;
+        }, z.core.$strict>>;
+        version: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+    snapshot: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const VaultProviderWireReadFieldsResult: z.ZodObject<{
+    fields: z.ZodArray<z.ZodObject<{
+        externalFieldId: z.ZodString;
+        value: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"text">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"totp">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"bytes">;
+            base64: z.ZodString;
+        }, z.core.$strict>], "type">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const VaultProviderWireRefreshResult: z.ZodObject<{
+    refreshed: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare const VaultProviderWireWriteItemResult: z.ZodObject<{
+    item: z.ZodObject<{
+        externalItemId: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            api_key: "api_key";
+            card: "card";
+            file: "file";
+            identity: "identity";
+            login: "login";
+            note: "note";
+            passkey: "passkey";
+            ssh_key: "ssh_key";
+        }>;
+        username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        websites: z.ZodArray<z.ZodString>;
+        fields: z.ZodArray<z.ZodObject<{
+            externalFieldId: z.ZodString;
+            name: z.ZodString;
+            kind: z.ZodEnum<{
+                concealed: "concealed";
+                file: "file";
+                text: "text";
+                totp: "totp";
+            }>;
+        }, z.core.$strict>>;
+        version: z.ZodNullable<z.ZodString>;
+        updatedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const VaultProviderWireArchiveItemResult: z.ZodObject<{
+    archived: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare const VaultProviderWireResults: {
+    readonly describe: z.ZodObject<{
+        accountId: z.ZodString;
+        accountName: z.ZodNullable<z.ZodString>;
+        operations: z.ZodObject<{
+            createItemTypes: z.ZodArray<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>>;
+            updateItem: z.ZodBoolean;
+            removeField: z.ZodBoolean;
+            archiveItem: z.ZodBoolean;
+            archiveKind: z.ZodEnum<{
+                archive: "archive";
+                none: "none";
+                trash: "trash";
+            }>;
+            deleteItem: z.ZodLiteral<false>;
+            restoreItem: z.ZodBoolean;
+            readFiles: z.ZodBoolean;
+            writeFiles: z.ZodBoolean;
+            createTotp: z.ZodBoolean;
+            updateTotp: z.ZodBoolean;
+            createVault: z.ZodBoolean;
+            restoreFieldHistory: z.ZodBoolean;
+        }, z.core.$strict>;
+        capabilities: z.ZodObject<{
+            totp: z.ZodBoolean;
+            files: z.ZodBoolean;
+        }, z.core.$strict>;
+        inventoryScope: z.ZodLiteral<"connection">;
+    }, z.core.$strict>;
+    readonly refresh: z.ZodObject<{
+        refreshed: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+    readonly list_vaults: z.ZodObject<{
+        items: z.ZodArray<z.ZodObject<{
+            externalVaultId: z.ZodString;
+            name: z.ZodString;
+            contentVersion: z.ZodNullable<z.ZodString>;
+            itemCount: z.ZodNullable<z.ZodNumber>;
+            writeAccess: z.ZodEnum<{
+                read_only: "read_only";
+                read_write: "read_write";
+                unknown: "unknown";
+            }>;
+            operations: z.ZodOptional<z.ZodObject<{
+                createItemTypes: z.ZodArray<z.ZodEnum<{
+                    api_key: "api_key";
+                    card: "card";
+                    file: "file";
+                    identity: "identity";
+                    login: "login";
+                    note: "note";
+                    passkey: "passkey";
+                    ssh_key: "ssh_key";
+                }>>;
+                updateItem: z.ZodBoolean;
+                removeField: z.ZodBoolean;
+                archiveItem: z.ZodBoolean;
+                archiveKind: z.ZodEnum<{
+                    archive: "archive";
+                    none: "none";
+                    trash: "trash";
+                }>;
+                deleteItem: z.ZodLiteral<false>;
+                restoreItem: z.ZodBoolean;
+                readFiles: z.ZodBoolean;
+                writeFiles: z.ZodBoolean;
+                createTotp: z.ZodBoolean;
+                updateTotp: z.ZodBoolean;
+                createVault: z.ZodBoolean;
+                restoreFieldHistory: z.ZodBoolean;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        nextCursor: z.ZodNullable<z.ZodString>;
+        snapshot: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    readonly list_items: z.ZodObject<{
+        items: z.ZodArray<z.ZodObject<{
+            externalItemId: z.ZodString;
+            name: z.ZodString;
+            type: z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>;
+            username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            websites: z.ZodArray<z.ZodString>;
+            fields: z.ZodArray<z.ZodObject<{
+                externalFieldId: z.ZodString;
+                name: z.ZodString;
+                kind: z.ZodEnum<{
+                    concealed: "concealed";
+                    file: "file";
+                    text: "text";
+                    totp: "totp";
+                }>;
+            }, z.core.$strict>>;
+            version: z.ZodNullable<z.ZodString>;
+            updatedAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        nextCursor: z.ZodNullable<z.ZodString>;
+        snapshot: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    readonly read_fields: z.ZodObject<{
+        fields: z.ZodArray<z.ZodObject<{
+            externalFieldId: z.ZodString;
+            value: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"text">;
+                value: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"totp">;
+                value: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"bytes">;
+                base64: z.ZodString;
+            }, z.core.$strict>], "type">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    readonly write_item: z.ZodObject<{
+        item: z.ZodObject<{
+            externalItemId: z.ZodString;
+            name: z.ZodString;
+            type: z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                file: "file";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                passkey: "passkey";
+                ssh_key: "ssh_key";
+            }>;
+            username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            category: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            websites: z.ZodArray<z.ZodString>;
+            fields: z.ZodArray<z.ZodObject<{
+                externalFieldId: z.ZodString;
+                name: z.ZodString;
+                kind: z.ZodEnum<{
+                    concealed: "concealed";
+                    file: "file";
+                    text: "text";
+                    totp: "totp";
+                }>;
+            }, z.core.$strict>>;
+            version: z.ZodNullable<z.ZodString>;
+            updatedAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    readonly archive_item: z.ZodObject<{
+        archived: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+};
+export type VaultProviderWireResult<Op extends VaultProviderWireOperationName> = z.infer<(typeof VaultProviderWireResults)[Op]>;
+export declare const VaultProviderWireError: z.ZodObject<{
+    code: z.ZodEnum<{
+        provider_auth_expired: "provider_auth_expired";
+        provider_auth_invalid: "provider_auth_invalid";
+        provider_conflict: "provider_conflict";
+        provider_inventory_incomplete: "provider_inventory_incomplete";
+        provider_locked: "provider_locked";
+        provider_not_found: "provider_not_found";
+        provider_outcome_unknown: "provider_outcome_unknown";
+        provider_permission_denied: "provider_permission_denied";
+        provider_rate_limited: "provider_rate_limited";
+        provider_unavailable: "provider_unavailable";
+    }>;
+    retryAfterMs: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>;
+export type VaultProviderWireError = z.infer<typeof VaultProviderWireError>;
+/**
+ * Response envelope. `result` is validated separately against
+ * `VaultProviderWireResults[op]` for the operation that was requested.
+ */
+export declare const VaultProviderWireResponseEnvelope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    version: z.ZodLiteral<"opengeni.vault.v1">;
+    type: z.ZodLiteral<"response">;
+    requestId: z.ZodString;
+    ok: z.ZodLiteral<true>;
+    op: z.ZodEnum<{
+        archive_item: "archive_item";
+        describe: "describe";
+        list_items: "list_items";
+        list_vaults: "list_vaults";
+        read_fields: "read_fields";
+        refresh: "refresh";
+        write_item: "write_item";
+    }>;
+    result: z.ZodUnknown;
+    freshness: z.ZodNullable<z.ZodObject<{
+        state: z.ZodEnum<{
+            current: "current";
+            refreshing: "refreshing";
+            stale: "stale";
+            unavailable: "unavailable";
+        }>;
+        sourceSyncedAt: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            cache: "cache";
+            live: "live";
+            unknown: "unknown";
+        }>;
+        errorCode: z.ZodNullable<z.ZodEnum<{
+            provider_auth_expired: "provider_auth_expired";
+            provider_auth_invalid: "provider_auth_invalid";
+            provider_conflict: "provider_conflict";
+            provider_inventory_incomplete: "provider_inventory_incomplete";
+            provider_locked: "provider_locked";
+            provider_not_found: "provider_not_found";
+            provider_outcome_unknown: "provider_outcome_unknown";
+            provider_permission_denied: "provider_permission_denied";
+            provider_rate_limited: "provider_rate_limited";
+            provider_unavailable: "provider_unavailable";
+        }>>;
+        retryAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<"opengeni.vault.v1">;
+    type: z.ZodLiteral<"response">;
+    requestId: z.ZodString;
+    ok: z.ZodLiteral<false>;
+    op: z.ZodEnum<{
+        archive_item: "archive_item";
+        describe: "describe";
+        list_items: "list_items";
+        list_vaults: "list_vaults";
+        read_fields: "read_fields";
+        refresh: "refresh";
+        write_item: "write_item";
+    }>;
+    error: z.ZodObject<{
+        code: z.ZodEnum<{
+            provider_auth_expired: "provider_auth_expired";
+            provider_auth_invalid: "provider_auth_invalid";
+            provider_conflict: "provider_conflict";
+            provider_inventory_incomplete: "provider_inventory_incomplete";
+            provider_locked: "provider_locked";
+            provider_not_found: "provider_not_found";
+            provider_outcome_unknown: "provider_outcome_unknown";
+            provider_permission_denied: "provider_permission_denied";
+            provider_rate_limited: "provider_rate_limited";
+            provider_unavailable: "provider_unavailable";
+        }>;
+        retryAfterMs: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>;
+    freshness: z.ZodNullable<z.ZodObject<{
+        state: z.ZodEnum<{
+            current: "current";
+            refreshing: "refreshing";
+            stale: "stale";
+            unavailable: "unavailable";
+        }>;
+        sourceSyncedAt: z.ZodNullable<z.ZodString>;
+        source: z.ZodEnum<{
+            cache: "cache";
+            live: "live";
+            unknown: "unknown";
+        }>;
+        errorCode: z.ZodNullable<z.ZodEnum<{
+            provider_auth_expired: "provider_auth_expired";
+            provider_auth_invalid: "provider_auth_invalid";
+            provider_conflict: "provider_conflict";
+            provider_inventory_incomplete: "provider_inventory_incomplete";
+            provider_locked: "provider_locked";
+            provider_not_found: "provider_not_found";
+            provider_outcome_unknown: "provider_outcome_unknown";
+            provider_permission_denied: "provider_permission_denied";
+            provider_rate_limited: "provider_rate_limited";
+            provider_unavailable: "provider_unavailable";
+        }>>;
+        retryAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "ok">;
+export type VaultProviderWireSuccess<Op extends VaultProviderWireOperationName = VaultProviderWireOperationName> = {
+    [K in Op]: {
+        version: typeof VAULT_PROVIDER_WIRE_VERSION;
+        type: "response";
+        requestId: string;
+        ok: true;
+        op: K;
+        result: VaultProviderWireResult<K>;
+        freshness: VaultProviderWireFreshness | null;
+    };
+}[Op];
+export type VaultProviderWireFailure = {
+    version: typeof VAULT_PROVIDER_WIRE_VERSION;
+    type: "response";
+    requestId: string;
+    ok: false;
+    op: VaultProviderWireOperationName;
+    error: VaultProviderWireError;
+    freshness: VaultProviderWireFreshness | null;
+};
+export type VaultProviderWireResponse = VaultProviderWireSuccess | VaultProviderWireFailure;
+/** Parse one response envelope and its operation-specific result. */
+export declare function parseVaultProviderWireResponse<Op extends VaultProviderWireOperationName>(value: unknown, expected: {
+    requestId: string;
+    op: Op;
+}): VaultProviderWireSuccess<Op> | VaultProviderWireFailure | null;