@oxy.so/contracts 1.0.0

package/dist/types/inference/providerConnection.d.ts

@@ -0,0 +1,968 @@
+/**
+ * BYOK provider connections — the metadata Oxy holds about a customer's own
+ * upstream provider credential.
+ *
+ * The credential itself is NOT here and cannot be put here. This shape carries
+ * an opaque Kaana credential handle, its exact revision and validation state.
+ * Three mechanisms
+ * make that structural rather than a convention somebody must remember:
+ *
+ *  - The object is `.strict()`. A producer that attaches `apiKey`, `secret`,
+ *    `token`, `privateKey` or `headers` fails the parse. Nothing is silently
+ *    stripped, because a stripped field is one that still exists upstream of
+ *    the parse, in a log line or an error report.
+ *  - No prefix or digest derived from the credential exists in this contract;
+ *    even a partial value can make a short credential recoverable by guessing.
+ *  - `credentialHandle` is an opaque, closed-format identifier minted by Kaana.
+ *    Oxy cannot resolve it and never stores either plaintext or ciphertext.
+ *
+ * BYOK does not move the billing relationship: the upstream provider bills the
+ * customer's own account directly, and Oxy charges only its platform fee. The
+ * record says so explicitly so a receipt against a BYOK route can be read
+ * correctly without consulting anything else.
+ *
+ * Decided in: issue #972 workstream 10.
+ */
+import { z } from 'zod';
+/**
+ * How widely a connection applies.
+ *
+ * In the unified account graph a project IS an account, so `account` and
+ * `project` differ by INHERITANCE, not by id space: an `account` connection is
+ * inherited by every descendant project and application, a `project` one
+ * applies to that project account alone, and an `application` one to a single
+ * application. Recording which the customer chose is what makes a later
+ * "why did this app use that key" answerable.
+ */
+export declare const providerConnectionScopeSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"account">;
+    accountId: z.ZodBranded<z.ZodString, "OxyAccountId">;
+}, "strict", z.ZodTypeAny, {
+    kind: "account";
+    accountId: string & z.BRAND<"OxyAccountId">;
+}, {
+    kind: "account";
+    accountId: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"project">;
+    accountId: z.ZodBranded<z.ZodString, "OxyAccountId">;
+}, "strict", z.ZodTypeAny, {
+    kind: "project";
+    accountId: string & z.BRAND<"OxyAccountId">;
+}, {
+    kind: "project";
+    accountId: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"application">;
+    accountId: z.ZodBranded<z.ZodString, "OxyAccountId">;
+    applicationId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "application";
+    accountId: string & z.BRAND<"OxyAccountId">;
+    applicationId: string;
+}, {
+    kind: "application";
+    accountId: string;
+    applicationId: string;
+}>]>;
+/** Opaque reference minted by Kaana. It is not a KMS/Vault/SSM locator. */
+export declare const kaanaCredentialHandleSchema: z.ZodString;
+/** Oxy-minted, case-sensitive replay identity for one exact Kaana mutation. */
+export declare const kaanaCredentialOperationIdSchema: z.ZodString;
+export declare const kaanaCredentialOperationActionSchema: z.ZodEnum<["create", "rotate", "revoke"]>;
+/** Exact immutable Oxy identity repeated by both mutation and reconciliation. */
+export declare const kaanaCredentialIdentitySchema: z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    provider: string;
+    connectionId: string;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    provider: string;
+    connectionId: string;
+}>;
+export declare const kaanaCredentialCreateMutationSchema: z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"create">;
+    operationId: z.ZodString;
+    operationActor: z.ZodEffects<z.ZodString, string, string>;
+    secretBase64: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "create";
+    operationId: string;
+    operationActor: string;
+    secretBase64: string;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "create";
+    operationId: string;
+    operationActor: string;
+    secretBase64: string;
+}>;
+export declare const kaanaCredentialRotateMutationSchema: z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"rotate">;
+    operationId: z.ZodString;
+    operationActor: z.ZodEffects<z.ZodString, string, string>;
+    credentialHandle: z.ZodString;
+    expectedRevision: z.ZodNumber;
+    secretBase64: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "rotate";
+    operationId: string;
+    operationActor: string;
+    secretBase64: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "rotate";
+    operationId: string;
+    operationActor: string;
+    secretBase64: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}>;
+export declare const kaanaCredentialRevokeMutationSchema: z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"revoke">;
+    operationId: z.ZodString;
+    operationActor: z.ZodEffects<z.ZodString, string, string>;
+    credentialHandle: z.ZodString;
+    expectedRevision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "revoke";
+    operationId: string;
+    operationActor: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "revoke";
+    operationId: string;
+    operationActor: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}>;
+export declare const kaanaCredentialMutationSchema: z.ZodDiscriminatedUnion<"action", [z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"create">;
+    operationId: z.ZodString;
+    operationActor: z.ZodEffects<z.ZodString, string, string>;
+    secretBase64: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "create";
+    operationId: string;
+    operationActor: string;
+    secretBase64: string;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "create";
+    operationId: string;
+    operationActor: string;
+    secretBase64: string;
+}>, z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"rotate">;
+    operationId: z.ZodString;
+    operationActor: z.ZodEffects<z.ZodString, string, string>;
+    credentialHandle: z.ZodString;
+    expectedRevision: z.ZodNumber;
+    secretBase64: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "rotate";
+    operationId: string;
+    operationActor: string;
+    secretBase64: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "rotate";
+    operationId: string;
+    operationActor: string;
+    secretBase64: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}>, z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"revoke">;
+    operationId: z.ZodString;
+    operationActor: z.ZodEffects<z.ZodString, string, string>;
+    credentialHandle: z.ZodString;
+    expectedRevision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "revoke";
+    operationId: string;
+    operationActor: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "revoke";
+    operationId: string;
+    operationActor: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}>]>;
+export declare const kaanaCredentialCreateOutcomeRequestSchema: z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"create">;
+    operationId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "create";
+    operationId: string;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "create";
+    operationId: string;
+}>;
+export declare const kaanaCredentialRotateOutcomeRequestSchema: z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"rotate">;
+    operationId: z.ZodString;
+    credentialHandle: z.ZodString;
+    expectedRevision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "rotate";
+    operationId: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "rotate";
+    operationId: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}>;
+export declare const kaanaCredentialRevokeOutcomeRequestSchema: z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"revoke">;
+    operationId: z.ZodString;
+    credentialHandle: z.ZodString;
+    expectedRevision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "revoke";
+    operationId: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "revoke";
+    operationId: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}>;
+export declare const kaanaCredentialOutcomeRequestSchema: z.ZodDiscriminatedUnion<"action", [z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"create">;
+    operationId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "create";
+    operationId: string;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "create";
+    operationId: string;
+}>, z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"rotate">;
+    operationId: z.ZodString;
+    credentialHandle: z.ZodString;
+    expectedRevision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "rotate";
+    operationId: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "rotate";
+    operationId: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}>, z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    action: z.ZodLiteral<"revoke">;
+    operationId: z.ZodString;
+    credentialHandle: z.ZodString;
+    expectedRevision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "revoke";
+    operationId: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    schemaVersion: 1;
+    provider: string;
+    connectionId: string;
+    action: "revoke";
+    operationId: string;
+    credentialHandle: string;
+    expectedRevision: number;
+}>]>;
+export declare const kaanaCredentialAppliedOutcomeSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    operationId: z.ZodString;
+    action: z.ZodEnum<["create", "rotate", "revoke"]>;
+    status: z.ZodLiteral<"applied">;
+    credentialHandle: z.ZodString;
+    revision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "applied";
+    schemaVersion: 1;
+    revision: number;
+    action: "create" | "revoke" | "rotate";
+    operationId: string;
+    credentialHandle: string;
+}, {
+    status: "applied";
+    schemaVersion: 1;
+    revision: number;
+    action: "create" | "revoke" | "rotate";
+    operationId: string;
+    credentialHandle: string;
+}>;
+export declare const kaanaCredentialConflictOutcomeSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    operationId: z.ZodString;
+    action: z.ZodEnum<["create", "rotate", "revoke"]>;
+    status: z.ZodLiteral<"conflict">;
+}, "strict", z.ZodTypeAny, {
+    status: "conflict";
+    schemaVersion: 1;
+    action: "create" | "revoke" | "rotate";
+    operationId: string;
+}, {
+    status: "conflict";
+    schemaVersion: 1;
+    action: "create" | "revoke" | "rotate";
+    operationId: string;
+}>;
+export declare const kaanaCredentialOutcomeSchema: z.ZodDiscriminatedUnion<"status", [z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    operationId: z.ZodString;
+    action: z.ZodEnum<["create", "rotate", "revoke"]>;
+    status: z.ZodLiteral<"applied">;
+    credentialHandle: z.ZodString;
+    revision: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "applied";
+    schemaVersion: 1;
+    revision: number;
+    action: "create" | "revoke" | "rotate";
+    operationId: string;
+    credentialHandle: string;
+}, {
+    status: "applied";
+    schemaVersion: 1;
+    revision: number;
+    action: "create" | "revoke" | "rotate";
+    operationId: string;
+    credentialHandle: string;
+}>, z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    operationId: z.ZodString;
+    action: z.ZodEnum<["create", "rotate", "revoke"]>;
+    status: z.ZodLiteral<"conflict">;
+}, "strict", z.ZodTypeAny, {
+    status: "conflict";
+    schemaVersion: 1;
+    action: "create" | "revoke" | "rotate";
+    operationId: string;
+}, {
+    status: "conflict";
+    schemaVersion: 1;
+    action: "create" | "revoke" | "rotate";
+    operationId: string;
+}>]>;
+/**
+ * One separately authenticated check of a quarantined BYOK generation.
+ *
+ * This is deliberately not an inference request. It carries no prompt, user
+ * response, routing policy or billing principal, and it can select only one
+ * exact Kaana deployment plus one exact credential generation.
+ */
+export declare const kaanaCredentialValidationTaskSchema: z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    operationId: z.ZodString;
+    applicationId: z.ZodString;
+    credentialHandle: z.ZodString;
+    credentialRevision: z.ZodNumber;
+    deploymentId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    applicationId: string;
+    schemaVersion: 1;
+    provider: string;
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    credentialHandle: string;
+    credentialRevision: number;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    applicationId: string;
+    schemaVersion: 1;
+    provider: string;
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    credentialHandle: string;
+    credentialRevision: number;
+}>;
+export declare const kaanaCredentialValidationOutcomeStateSchema: z.ZodEnum<["pending", "valid", "invalid", "inconclusive"]>;
+export declare const kaanaCredentialValidationFailureCodeSchema: z.ZodEnum<["unauthorized", "forbidden", "not_found", "rate_limited", "network", "unknown"]>;
+/**
+ * Durable result for one exact validation operation. `inconclusive` is a
+ * terminal answer about the attempt, never evidence that the credential is
+ * invalid; Oxy leaves the generation quarantined and may start a new exact
+ * operation. Kaana reports terminal outcomes through its service principal.
+ */
+export declare const kaanaCredentialValidationOutcomeSchema: z.ZodEffects<z.ZodObject<{
+    provider: z.ZodString;
+    ownerAccountId: z.ZodString;
+    connectionId: z.ZodString;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+} & {
+    schemaVersion: z.ZodLiteral<1>;
+    operationId: z.ZodString;
+    applicationId: z.ZodString;
+    credentialHandle: z.ZodString;
+    credentialRevision: z.ZodNumber;
+    deploymentId: z.ZodString;
+} & {
+    state: z.ZodEnum<["pending", "valid", "invalid", "inconclusive"]>;
+    failureCode: z.ZodOptional<z.ZodEnum<["unauthorized", "forbidden", "not_found", "rate_limited", "network", "unknown"]>>;
+}, "strict", z.ZodTypeAny, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    applicationId: string;
+    schemaVersion: 1;
+    state: "valid" | "pending" | "invalid" | "inconclusive";
+    provider: string;
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    credentialHandle: string;
+    credentialRevision: number;
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    applicationId: string;
+    schemaVersion: 1;
+    state: "valid" | "pending" | "invalid" | "inconclusive";
+    provider: string;
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    credentialHandle: string;
+    credentialRevision: number;
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+}>, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    applicationId: string;
+    schemaVersion: 1;
+    state: "valid" | "pending" | "invalid" | "inconclusive";
+    provider: string;
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    credentialHandle: string;
+    credentialRevision: number;
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+}, {
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    applicationId: string;
+    schemaVersion: 1;
+    state: "valid" | "pending" | "invalid" | "inconclusive";
+    provider: string;
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    credentialHandle: string;
+    credentialRevision: number;
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+}>;
+/**
+ * Customer-safe view of one explicit bootstrap attempt.
+ *
+ * `deploymentId` is the exact Oxy catalogue row selected by the customer. The
+ * internal Kaana route id remains protected; Oxy binds the two in its durable
+ * ledger and signs the latter to Kaana.
+ */
+export declare const providerCredentialValidationOperationSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    operationId: z.ZodString;
+    connectionId: z.ZodString;
+    applicationId: z.ZodString;
+    deploymentId: z.ZodString;
+    state: z.ZodEnum<["pending", "valid", "invalid", "inconclusive"]>;
+    failureCode: z.ZodOptional<z.ZodEnum<["unauthorized", "forbidden", "not_found", "rate_limited", "network", "unknown"]>>;
+    createdAt: z.ZodString;
+    completedAt: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    applicationId: string;
+    createdAt: string;
+    schemaVersion: 1;
+    state: "valid" | "pending" | "invalid" | "inconclusive";
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+    completedAt?: string | undefined;
+}, {
+    applicationId: string;
+    createdAt: string;
+    schemaVersion: 1;
+    state: "valid" | "pending" | "invalid" | "inconclusive";
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+    completedAt?: string | undefined;
+}>, {
+    applicationId: string;
+    createdAt: string;
+    schemaVersion: 1;
+    state: "valid" | "pending" | "invalid" | "inconclusive";
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+    completedAt?: string | undefined;
+}, {
+    applicationId: string;
+    createdAt: string;
+    schemaVersion: 1;
+    state: "valid" | "pending" | "invalid" | "inconclusive";
+    deploymentId: string;
+    connectionId: string;
+    operationId: string;
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+    completedAt?: string | undefined;
+}>;
+/** Exact customer-selectable catalogue ids; no internal Kaana route is exposed. */
+export declare const providerCredentialValidationDeploymentSchema: z.ZodObject<{
+    deploymentId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    deploymentId: string;
+}, {
+    deploymentId: string;
+}>;
+/**
+ * Oxy's view of the cross-service mutation. Only `ready` may be routed.
+ * `reconcile` is the fail-closed state after an outcome could not be proven.
+ */
+export declare const providerCredentialCustodyStateSchema: z.ZodEnum<["pending", "ready", "reconcile", "revoked"]>;
+/** Why a credential check failed, as a closed set the Console can render. */
+export declare const providerConnectionValidationSchema: z.ZodObject<{
+    state: z.ZodEnum<["unvalidated", "valid", "invalid", "expired"]>;
+    lastValidatedAt: z.ZodOptional<z.ZodString>;
+    /** Required when `invalid`: a failure nobody can act on is not a result. */
+    failureCode: z.ZodOptional<z.ZodEnum<["unauthorized", "forbidden", "not_found", "rate_limited", "network", "unknown"]>>;
+}, "strict", z.ZodTypeAny, {
+    state: "valid" | "invalid" | "expired" | "unvalidated";
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+    lastValidatedAt?: string | undefined;
+}, {
+    state: "valid" | "invalid" | "expired" | "unvalidated";
+    failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+    lastValidatedAt?: string | undefined;
+}>;
+/**
+ * Lifecycle of a connection. `pending_validation` is quarantined from normal
+ * serving, `revoked` is terminal, and `disabled` is reversible.
+ */
+export declare const providerConnectionStatusSchema: z.ZodEnum<["pending_validation", "active", "disabled", "revoked"]>;
+/**
+ * A customer's provider connection, without secrets.
+ *
+ * This is the whole of what Oxy stores, and the whole of what the data plane
+ * is given.
+ * Resolving the opaque handle to plaintext happens only inside Kaana inference.
+ */
+export declare const providerConnectionSchema: z.ZodEffects<z.ZodObject<{
+    /** See `version.ts`: exchanged with the data plane and rendered by Console. */
+    schemaVersion: z.ZodLiteral<2>;
+    connectionId: z.ZodString;
+    provider: z.ZodString;
+    /** The Oxy account that owns the connection and answers for its use. */
+    ownerAccountId: z.ZodBranded<z.ZodString, "OxyAccountId">;
+    scope: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"account">;
+        accountId: z.ZodBranded<z.ZodString, "OxyAccountId">;
+    }, "strict", z.ZodTypeAny, {
+        kind: "account";
+        accountId: string & z.BRAND<"OxyAccountId">;
+    }, {
+        kind: "account";
+        accountId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"project">;
+        accountId: z.ZodBranded<z.ZodString, "OxyAccountId">;
+    }, "strict", z.ZodTypeAny, {
+        kind: "project";
+        accountId: string & z.BRAND<"OxyAccountId">;
+    }, {
+        kind: "project";
+        accountId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"application">;
+        accountId: z.ZodBranded<z.ZodString, "OxyAccountId">;
+        applicationId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "application";
+        accountId: string & z.BRAND<"OxyAccountId">;
+        applicationId: string;
+    }, {
+        kind: "application";
+        accountId: string;
+        applicationId: string;
+    }>]>;
+    environment: z.ZodEnum<["development", "staging", "production"]>;
+    status: z.ZodEnum<["pending_validation", "active", "disabled", "revoked"]>;
+    custodyState: z.ZodEnum<["pending", "ready", "reconcile", "revoked"]>;
+    credentialHandle: z.ZodOptional<z.ZodString>;
+    credentialRevision: z.ZodOptional<z.ZodNumber>;
+    validation: z.ZodObject<{
+        state: z.ZodEnum<["unvalidated", "valid", "invalid", "expired"]>;
+        lastValidatedAt: z.ZodOptional<z.ZodString>;
+        /** Required when `invalid`: a failure nobody can act on is not a result. */
+        failureCode: z.ZodOptional<z.ZodEnum<["unauthorized", "forbidden", "not_found", "rate_limited", "network", "unknown"]>>;
+    }, "strict", z.ZodTypeAny, {
+        state: "valid" | "invalid" | "expired" | "unvalidated";
+        failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+        lastValidatedAt?: string | undefined;
+    }, {
+        state: "valid" | "invalid" | "expired" | "unvalidated";
+        failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+        lastValidatedAt?: string | undefined;
+    }>;
+    /**
+     * Always `true` for a BYOK connection: the provider bills the customer's own
+     * upstream account, and Oxy charges only its platform fee. Stated as data so
+     * a receipt against this route is readable without a second lookup.
+     */
+    upstreamBillsCustomerDirectly: z.ZodLiteral<true>;
+    /** Set when the provider's terms require a per-customer acknowledgement. */
+    termsAcknowledgedAt: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodString;
+    rotatedAt: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    validation: {
+        state: "valid" | "invalid" | "expired" | "unvalidated";
+        failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+        lastValidatedAt?: string | undefined;
+    };
+    status: "active" | "revoked" | "disabled" | "pending_validation";
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string & z.BRAND<"OxyAccountId">;
+    createdAt: string;
+    schemaVersion: 2;
+    scope: {
+        kind: "account";
+        accountId: string & z.BRAND<"OxyAccountId">;
+    } | {
+        kind: "project";
+        accountId: string & z.BRAND<"OxyAccountId">;
+    } | {
+        kind: "application";
+        accountId: string & z.BRAND<"OxyAccountId">;
+        applicationId: string;
+    };
+    provider: string;
+    connectionId: string;
+    custodyState: "revoked" | "pending" | "ready" | "reconcile";
+    upstreamBillsCustomerDirectly: true;
+    credentialHandle?: string | undefined;
+    credentialRevision?: number | undefined;
+    termsAcknowledgedAt?: string | undefined;
+    rotatedAt?: string | undefined;
+}, {
+    validation: {
+        state: "valid" | "invalid" | "expired" | "unvalidated";
+        failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+        lastValidatedAt?: string | undefined;
+    };
+    status: "active" | "revoked" | "disabled" | "pending_validation";
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    createdAt: string;
+    schemaVersion: 2;
+    scope: {
+        kind: "account";
+        accountId: string;
+    } | {
+        kind: "project";
+        accountId: string;
+    } | {
+        kind: "application";
+        accountId: string;
+        applicationId: string;
+    };
+    provider: string;
+    connectionId: string;
+    custodyState: "revoked" | "pending" | "ready" | "reconcile";
+    upstreamBillsCustomerDirectly: true;
+    credentialHandle?: string | undefined;
+    credentialRevision?: number | undefined;
+    termsAcknowledgedAt?: string | undefined;
+    rotatedAt?: string | undefined;
+}>, {
+    validation: {
+        state: "valid" | "invalid" | "expired" | "unvalidated";
+        failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+        lastValidatedAt?: string | undefined;
+    };
+    status: "active" | "revoked" | "disabled" | "pending_validation";
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string & z.BRAND<"OxyAccountId">;
+    createdAt: string;
+    schemaVersion: 2;
+    scope: {
+        kind: "account";
+        accountId: string & z.BRAND<"OxyAccountId">;
+    } | {
+        kind: "project";
+        accountId: string & z.BRAND<"OxyAccountId">;
+    } | {
+        kind: "application";
+        accountId: string & z.BRAND<"OxyAccountId">;
+        applicationId: string;
+    };
+    provider: string;
+    connectionId: string;
+    custodyState: "revoked" | "pending" | "ready" | "reconcile";
+    upstreamBillsCustomerDirectly: true;
+    credentialHandle?: string | undefined;
+    credentialRevision?: number | undefined;
+    termsAcknowledgedAt?: string | undefined;
+    rotatedAt?: string | undefined;
+}, {
+    validation: {
+        state: "valid" | "invalid" | "expired" | "unvalidated";
+        failureCode?: "unknown" | "network" | "rate_limited" | "unauthorized" | "forbidden" | "not_found" | undefined;
+        lastValidatedAt?: string | undefined;
+    };
+    status: "active" | "revoked" | "disabled" | "pending_validation";
+    environment: "development" | "staging" | "production";
+    ownerAccountId: string;
+    createdAt: string;
+    schemaVersion: 2;
+    scope: {
+        kind: "account";
+        accountId: string;
+    } | {
+        kind: "project";
+        accountId: string;
+    } | {
+        kind: "application";
+        accountId: string;
+        applicationId: string;
+    };
+    provider: string;
+    connectionId: string;
+    custodyState: "revoked" | "pending" | "ready" | "reconcile";
+    upstreamBillsCustomerDirectly: true;
+    credentialHandle?: string | undefined;
+    credentialRevision?: number | undefined;
+    termsAcknowledgedAt?: string | undefined;
+    rotatedAt?: string | undefined;
+}>;
+export type ProviderConnectionScope = z.infer<typeof providerConnectionScopeSchema>;
+export type KaanaCredentialOperationAction = z.infer<typeof kaanaCredentialOperationActionSchema>;
+export type KaanaCredentialIdentity = z.infer<typeof kaanaCredentialIdentitySchema>;
+export type KaanaCredentialMutation = z.infer<typeof kaanaCredentialMutationSchema>;
+export type KaanaCredentialOutcomeRequest = z.infer<typeof kaanaCredentialOutcomeRequestSchema>;
+export type KaanaCredentialOutcome = z.infer<typeof kaanaCredentialOutcomeSchema>;
+export type KaanaCredentialValidationTask = z.infer<typeof kaanaCredentialValidationTaskSchema>;
+export type KaanaCredentialValidationOutcome = z.infer<typeof kaanaCredentialValidationOutcomeSchema>;
+export type ProviderCredentialValidationOperation = z.infer<typeof providerCredentialValidationOperationSchema>;
+export type ProviderCredentialValidationDeployment = z.infer<typeof providerCredentialValidationDeploymentSchema>;
+export type ProviderConnectionValidation = z.infer<typeof providerConnectionValidationSchema>;
+export type ProviderConnectionStatus = z.infer<typeof providerConnectionStatusSchema>;
+export type ProviderCredentialCustodyState = z.infer<typeof providerCredentialCustodyStateSchema>;
+export type ProviderConnection = z.infer<typeof providerConnectionSchema>;