@pithy-sh/core 0.13.0 → 0.14.0

package/dist/controlPlane/http/responses.d.ts

@@ -33,6 +33,24 @@ export declare const PublicKeyView: z.ZodObject<{
     revokedAt: z.ZodNullable<z.ZodISODateTime>;
 }, z.core.$strip>;
 export type PublicKeyView = z.output<typeof PublicKeyView>;
+/**
+ * One OIDC trust as `GET {basePath}/keys` lists it: who it admits, beside who sanctioned it.
+ *
+ * **The subject constraint is on the face of the listing**, because it *is* the population: a trust pinned to a
+ * workflow is usable by anyone who can run that workflow, and the claims are the only place that is written down.
+ * Nothing here is secret — an issuer, an audience and claim values are all public facts about a workload.
+ */
+export declare const TrustView: z.ZodObject<{
+    trustId: z.ZodString;
+    issuer: z.ZodString;
+    audience: z.ZodString;
+    claims: z.ZodRecord<z.ZodString, z.ZodString>;
+    authorizedBy: z.ZodString;
+    validFrom: z.ZodISODateTime;
+    revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    firstCallAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type TrustView = z.output<typeof TrustView>;
 /**
  * `GET /control-plane/ping`.
  *
@@ -69,6 +87,16 @@ export declare const ControlPlaneKeysResponse: z.ZodObject<{
         script: "script";
     }>>>;
     purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    trusts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        trustId: z.ZodString;
+        issuer: z.ZodString;
+        audience: z.ZodString;
+        claims: z.ZodRecord<z.ZodString, z.ZodString>;
+        authorizedBy: z.ZodString;
+        validFrom: z.ZodISODateTime;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+        firstCallAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type ControlPlaneKeysResponse = z.output<typeof ControlPlaneKeysResponse>;
 /** `POST /control-plane/keys` — the appended key, and the set as it now stands. */
@@ -246,9 +274,9 @@ export declare const ControlPlaneMigrationsResponse: z.ZodObject<{
 }, z.core.$strip>;
 export type ControlPlaneMigrationsResponse = z.output<typeof ControlPlaneMigrationsResponse>;
 /**
- * One marked field, as `GET {basePath}/privacy` reports it (#132).
+ * One marked field, as `GET {basePath}/privacy` reports it.
  *
- * **The per-field record.** Since #390 it says whether the field rests encrypted beside `class`, so "which of
+ * **The per-field record.** It says whether the field rests encrypted beside `class`, so "which of
  * your PHI fields are encrypted" is a derivation over this list rather than a second inventory to keep.
  */
 export declare const PrivacyFieldView: z.ZodObject<{
@@ -284,7 +312,7 @@ export declare const PrivacySchemaView: z.ZodObject<{
 }, z.core.$strip>;
 export type PrivacySchemaView = z.output<typeof PrivacySchemaView>;
 /**
- * `GET /control-plane/privacy` — the full inventory, behind `privacy:read` (#132).
+ * `GET /control-plane/privacy` — the full inventory, behind `privacy:read`.
  *
  * Derived at runtime from the schemas this Worker composed, walked once per isolate. The manifest's `privacy`
  * block is the headline; this is the detail, and it names fields, which is why it has a scope of its own.
@@ -343,4 +371,900 @@ export declare const ControlPlanePrivacyResponse: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ControlPlanePrivacyResponse = z.output<typeof ControlPlanePrivacyResponse>;
+/**
+ * One value a fact carries: a scalar, a list of names, or null where the record holds nothing.
+ *
+ * Scalars and string lists only, so a fact can never carry a row, a secret, or a key: it names and counts.
+ */
+export declare const EvidenceValue: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodArray<z.ZodString>]>;
+export type EvidenceValue = z.output<typeof EvidenceValue>;
+/** One fact the Worker read for a control, and the declaration it read it from. */
+export declare const EvidenceFact: z.ZodObject<{
+    fact: z.ZodString;
+    subject: z.ZodOptional<z.ZodString>;
+    value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodArray<z.ZodString>]>;
+    source: z.ZodEnum<{
+        auditRecorder: "auditRecorder";
+        bindings: "bindings";
+        capabilityHealth: "capabilityHealth";
+        composition: "composition";
+        connection: "connection";
+        connectionKeys: "connectionKeys";
+        encryptedMarkers: "encryptedMarkers";
+        fieldKeyRetirement: "fieldKeyRetirement";
+        migrationLedger: "migrationLedger";
+        privacyAttestation: "privacyAttestation";
+        privacyMarkers: "privacyMarkers";
+        routeSpec: "routeSpec";
+        sameOriginGate: "sameOriginGate";
+    }>;
+}, z.core.$strip>;
+export type EvidenceFact = z.output<typeof EvidenceFact>;
+/** One control in the pack: its references, the facts read, and what the Worker could say. */
+export declare const EvidenceEntry: z.ZodObject<{
+    control: z.ZodEnum<{
+        "audit-logging": "audit-logging";
+        "change-history": "change-history";
+        csrf: "csrf";
+        "data-protection": "data-protection";
+        "key-rotation": "key-rotation";
+        "management-access": "management-access";
+        "route-verification": "route-verification";
+    }>;
+    title: z.ZodString;
+    soc2: z.ZodArray<z.ZodString>;
+    iso27001: z.ZodArray<z.ZodString>;
+    state: z.ZodEnum<{
+        evidenced: "evidenced";
+        gap: "gap";
+        "not-derivable": "not-derivable";
+    }>;
+    reasons: z.ZodArray<z.ZodString>;
+    facts: z.ZodArray<z.ZodObject<{
+        fact: z.ZodString;
+        subject: z.ZodOptional<z.ZodString>;
+        value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodArray<z.ZodString>]>;
+        source: z.ZodEnum<{
+            auditRecorder: "auditRecorder";
+            bindings: "bindings";
+            capabilityHealth: "capabilityHealth";
+            composition: "composition";
+            connection: "connection";
+            connectionKeys: "connectionKeys";
+            encryptedMarkers: "encryptedMarkers";
+            fieldKeyRetirement: "fieldKeyRetirement";
+            migrationLedger: "migrationLedger";
+            privacyAttestation: "privacyAttestation";
+            privacyMarkers: "privacyMarkers";
+            routeSpec: "routeSpec";
+            sameOriginGate: "sameOriginGate";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type EvidenceEntry = z.output<typeof EvidenceEntry>;
+/**
+ * `GET /control-plane/evidence` — the evidence pack, behind `evidence:read`.
+ *
+ * Computed in the Worker because the Worker is the deployed build: every fact is read from what this build
+ * composes and records. It proves controls present and performs nothing.
+ */
+export declare const ControlPlaneEvidenceResponse: z.ZodObject<{
+    environment: z.ZodString;
+    generatedAt: z.ZodISODateTime;
+    version: z.ZodNullable<z.ZodString>;
+    mappingVersion: z.ZodNumber;
+    controls: z.ZodArray<z.ZodObject<{
+        control: z.ZodEnum<{
+            "audit-logging": "audit-logging";
+            "change-history": "change-history";
+            csrf: "csrf";
+            "data-protection": "data-protection";
+            "key-rotation": "key-rotation";
+            "management-access": "management-access";
+            "route-verification": "route-verification";
+        }>;
+        title: z.ZodString;
+        soc2: z.ZodArray<z.ZodString>;
+        iso27001: z.ZodArray<z.ZodString>;
+        state: z.ZodEnum<{
+            evidenced: "evidenced";
+            gap: "gap";
+            "not-derivable": "not-derivable";
+        }>;
+        reasons: z.ZodArray<z.ZodString>;
+        facts: z.ZodArray<z.ZodObject<{
+            fact: z.ZodString;
+            subject: z.ZodOptional<z.ZodString>;
+            value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodArray<z.ZodString>]>;
+            source: z.ZodEnum<{
+                auditRecorder: "auditRecorder";
+                bindings: "bindings";
+                capabilityHealth: "capabilityHealth";
+                composition: "composition";
+                connection: "connection";
+                connectionKeys: "connectionKeys";
+                encryptedMarkers: "encryptedMarkers";
+                fieldKeyRetirement: "fieldKeyRetirement";
+                migrationLedger: "migrationLedger";
+                privacyAttestation: "privacyAttestation";
+                privacyMarkers: "privacyMarkers";
+                routeSpec: "routeSpec";
+                sameOriginGate: "sameOriginGate";
+            }>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ControlPlaneEvidenceResponse = z.output<typeof ControlPlaneEvidenceResponse>;
+/** Where a purge stands. */
+export declare const ErasureState: z.ZodEnum<{
+    complete: "complete";
+    failed: "failed";
+    in_progress: "in_progress";
+    scheduled: "scheduled";
+}>;
+export type ErasureState = z.output<typeof ErasureState>;
+/** One recorded audit event, cited by id and chain position. Never its personal values. */
+export declare const ErasureCitation: z.ZodObject<{
+    eventId: z.ZodString;
+    action: z.ZodString;
+    occurredAt: z.ZodISODateTime;
+    tenant: z.ZodNullable<z.ZodString>;
+    seq: z.ZodNullable<z.ZodNumber>;
+    hash: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ErasureCitation = z.output<typeof ErasureCitation>;
+/** One purge step: whose rows, what happened to them, and the event that records it. */
+export declare const ErasureStepView: z.ZodObject<{
+    capability: z.ZodString;
+    disposition: z.ZodEnum<{
+        erased: "erased";
+        retained: "retained";
+    }>;
+    reason: z.ZodNullable<z.ZodString>;
+    summary: z.ZodNullable<z.ZodString>;
+    completedAt: z.ZodISODateTime;
+    audit: z.ZodNullable<z.ZodObject<{
+        eventId: z.ZodString;
+        action: z.ZodString;
+        occurredAt: z.ZodISODateTime;
+        tenant: z.ZodNullable<z.ZodString>;
+        seq: z.ZodNullable<z.ZodNumber>;
+        hash: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ErasureStepView = z.output<typeof ErasureStepView>;
+/** The subject an attestation is about: its kind and its id, and nothing else. */
+export declare const ErasureSubjectView: z.ZodObject<{
+    type: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+    }>;
+    id: z.ZodString;
+}, z.core.$strip>;
+export type ErasureSubjectView = z.output<typeof ErasureSubjectView>;
+/** One subject's erasure, attested. */
+export declare const ErasureAttestation: z.ZodObject<{
+    subject: z.ZodObject<{
+        type: z.ZodEnum<{
+            organization: "organization";
+            user: "user";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strip>;
+    deletion: z.ZodObject<{
+        at: z.ZodISODateTime;
+        actorType: z.ZodString;
+        reason: z.ZodNullable<z.ZodString>;
+        mode: z.ZodNullable<z.ZodEnum<{
+            hard: "hard";
+            soft: "soft";
+        }>>;
+        purgeAfter: z.ZodNullable<z.ZodISODateTime>;
+        audit: z.ZodNullable<z.ZodObject<{
+            eventId: z.ZodString;
+            action: z.ZodString;
+            occurredAt: z.ZodISODateTime;
+            tenant: z.ZodNullable<z.ZodString>;
+            seq: z.ZodNullable<z.ZodNumber>;
+            hash: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    state: z.ZodEnum<{
+        complete: "complete";
+        failed: "failed";
+        in_progress: "in_progress";
+        scheduled: "scheduled";
+    }>;
+    overdue: z.ZodBoolean;
+    stoppedAt: z.ZodNullable<z.ZodString>;
+    steps: z.ZodArray<z.ZodObject<{
+        capability: z.ZodString;
+        disposition: z.ZodEnum<{
+            erased: "erased";
+            retained: "retained";
+        }>;
+        reason: z.ZodNullable<z.ZodString>;
+        summary: z.ZodNullable<z.ZodString>;
+        completedAt: z.ZodISODateTime;
+        audit: z.ZodNullable<z.ZodObject<{
+            eventId: z.ZodString;
+            action: z.ZodString;
+            occurredAt: z.ZodISODateTime;
+            tenant: z.ZodNullable<z.ZodString>;
+            seq: z.ZodNullable<z.ZodNumber>;
+            hash: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    completedAt: z.ZodNullable<z.ZodISODateTime>;
+    completion: z.ZodNullable<z.ZodObject<{
+        eventId: z.ZodString;
+        action: z.ZodString;
+        occurredAt: z.ZodISODateTime;
+        tenant: z.ZodNullable<z.ZodString>;
+        seq: z.ZodNullable<z.ZodNumber>;
+        hash: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    failure: z.ZodNullable<z.ZodObject<{
+        eventId: z.ZodString;
+        action: z.ZodString;
+        occurredAt: z.ZodISODateTime;
+        tenant: z.ZodNullable<z.ZodString>;
+        seq: z.ZodNullable<z.ZodNumber>;
+        hash: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    trail: z.ZodEnum<{
+        absent: "absent";
+        recorded: "recorded";
+    }>;
+}, z.core.$strip>;
+export type ErasureAttestation = z.output<typeof ErasureAttestation>;
+/** `GET /control-plane/erasure/:subjectType/:subjectId` — one subject's attestation, behind `erasure:read`. */
+export declare const ControlPlaneErasureSubjectResponse: z.ZodObject<{
+    generatedAt: z.ZodISODateTime;
+    attestation: z.ZodObject<{
+        subject: z.ZodObject<{
+            type: z.ZodEnum<{
+                organization: "organization";
+                user: "user";
+            }>;
+            id: z.ZodString;
+        }, z.core.$strip>;
+        deletion: z.ZodObject<{
+            at: z.ZodISODateTime;
+            actorType: z.ZodString;
+            reason: z.ZodNullable<z.ZodString>;
+            mode: z.ZodNullable<z.ZodEnum<{
+                hard: "hard";
+                soft: "soft";
+            }>>;
+            purgeAfter: z.ZodNullable<z.ZodISODateTime>;
+            audit: z.ZodNullable<z.ZodObject<{
+                eventId: z.ZodString;
+                action: z.ZodString;
+                occurredAt: z.ZodISODateTime;
+                tenant: z.ZodNullable<z.ZodString>;
+                seq: z.ZodNullable<z.ZodNumber>;
+                hash: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        state: z.ZodEnum<{
+            complete: "complete";
+            failed: "failed";
+            in_progress: "in_progress";
+            scheduled: "scheduled";
+        }>;
+        overdue: z.ZodBoolean;
+        stoppedAt: z.ZodNullable<z.ZodString>;
+        steps: z.ZodArray<z.ZodObject<{
+            capability: z.ZodString;
+            disposition: z.ZodEnum<{
+                erased: "erased";
+                retained: "retained";
+            }>;
+            reason: z.ZodNullable<z.ZodString>;
+            summary: z.ZodNullable<z.ZodString>;
+            completedAt: z.ZodISODateTime;
+            audit: z.ZodNullable<z.ZodObject<{
+                eventId: z.ZodString;
+                action: z.ZodString;
+                occurredAt: z.ZodISODateTime;
+                tenant: z.ZodNullable<z.ZodString>;
+                seq: z.ZodNullable<z.ZodNumber>;
+                hash: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        completedAt: z.ZodNullable<z.ZodISODateTime>;
+        completion: z.ZodNullable<z.ZodObject<{
+            eventId: z.ZodString;
+            action: z.ZodString;
+            occurredAt: z.ZodISODateTime;
+            tenant: z.ZodNullable<z.ZodString>;
+            seq: z.ZodNullable<z.ZodNumber>;
+            hash: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        failure: z.ZodNullable<z.ZodObject<{
+            eventId: z.ZodString;
+            action: z.ZodString;
+            occurredAt: z.ZodISODateTime;
+            tenant: z.ZodNullable<z.ZodString>;
+            seq: z.ZodNullable<z.ZodNumber>;
+            hash: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        trail: z.ZodEnum<{
+            absent: "absent";
+            recorded: "recorded";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ControlPlaneErasureSubjectResponse = z.output<typeof ControlPlaneErasureSubjectResponse>;
+/** One purge in a period: who, where it stands, and where it stopped. */
+export declare const ErasurePeriodEntry: z.ZodObject<{
+    subject: z.ZodObject<{
+        type: z.ZodEnum<{
+            organization: "organization";
+            user: "user";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strip>;
+    state: z.ZodEnum<{
+        complete: "complete";
+        failed: "failed";
+        in_progress: "in_progress";
+        scheduled: "scheduled";
+    }>;
+    overdue: z.ZodBoolean;
+    purgeAfter: z.ZodNullable<z.ZodISODateTime>;
+    completedAt: z.ZodNullable<z.ZodISODateTime>;
+    stoppedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ErasurePeriodEntry = z.output<typeof ErasurePeriodEntry>;
+/** `GET /control-plane/erasure` — every purge in a period, counted. */
+export declare const ControlPlaneErasurePeriodResponse: z.ZodObject<{
+    generatedAt: z.ZodISODateTime;
+    since: z.ZodISODateTime;
+    until: z.ZodISODateTime;
+    subjects: z.ZodArray<z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+    }>>;
+    counts: z.ZodObject<{
+        scheduled: z.ZodNumber;
+        inProgress: z.ZodNumber;
+        complete: z.ZodNumber;
+        failed: z.ZodNumber;
+        overdue: z.ZodNumber;
+    }, z.core.$strip>;
+    attention: z.ZodArray<z.ZodObject<{
+        subject: z.ZodObject<{
+            type: z.ZodEnum<{
+                organization: "organization";
+                user: "user";
+            }>;
+            id: z.ZodString;
+        }, z.core.$strip>;
+        state: z.ZodEnum<{
+            complete: "complete";
+            failed: "failed";
+            in_progress: "in_progress";
+            scheduled: "scheduled";
+        }>;
+        overdue: z.ZodBoolean;
+        purgeAfter: z.ZodNullable<z.ZodISODateTime>;
+        completedAt: z.ZodNullable<z.ZodISODateTime>;
+        stoppedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    purges: z.ZodArray<z.ZodObject<{
+        subject: z.ZodObject<{
+            type: z.ZodEnum<{
+                organization: "organization";
+                user: "user";
+            }>;
+            id: z.ZodString;
+        }, z.core.$strip>;
+        state: z.ZodEnum<{
+            complete: "complete";
+            failed: "failed";
+            in_progress: "in_progress";
+            scheduled: "scheduled";
+        }>;
+        overdue: z.ZodBoolean;
+        purgeAfter: z.ZodNullable<z.ZodISODateTime>;
+        completedAt: z.ZodNullable<z.ZodISODateTime>;
+        stoppedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ControlPlaneErasurePeriodResponse = z.output<typeof ControlPlaneErasurePeriodResponse>;
+/** One legal hold, as the holds routes answer it. */
+export declare const LegalHoldView: z.ZodObject<{
+    id: z.ZodString;
+    subjectType: z.ZodEnum<{
+        audit: "audit";
+        organization: "organization";
+        user: "user";
+    }>;
+    subjectId: z.ZodNullable<z.ZodString>;
+    reason: z.ZodString;
+    placedBy: z.ZodString;
+    placedAt: z.ZodISODateTime;
+    state: z.ZodEnum<{
+        active: "active";
+        released: "released";
+    }>;
+    releasedAt: z.ZodNullable<z.ZodISODateTime>;
+    releasedBy: z.ZodNullable<z.ZodString>;
+    releaseReason: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type LegalHoldView = z.output<typeof LegalHoldView>;
+/** `GET /control-plane/holds`. */
+export declare const ControlPlaneHoldsResponse: z.ZodObject<{
+    active: z.ZodNumber;
+    holds: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        subjectType: z.ZodEnum<{
+            audit: "audit";
+            organization: "organization";
+            user: "user";
+        }>;
+        subjectId: z.ZodNullable<z.ZodString>;
+        reason: z.ZodString;
+        placedBy: z.ZodString;
+        placedAt: z.ZodISODateTime;
+        state: z.ZodEnum<{
+            active: "active";
+            released: "released";
+        }>;
+        releasedAt: z.ZodNullable<z.ZodISODateTime>;
+        releasedBy: z.ZodNullable<z.ZodString>;
+        releaseReason: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ControlPlaneHoldsResponse = z.output<typeof ControlPlaneHoldsResponse>;
+/** `POST /control-plane/holds` and `POST /control-plane/holds/:holdId/release`: the hold as it now stands. */
+export declare const ControlPlaneHoldResponse: z.ZodObject<{
+    hold: z.ZodObject<{
+        id: z.ZodString;
+        subjectType: z.ZodEnum<{
+            audit: "audit";
+            organization: "organization";
+            user: "user";
+        }>;
+        subjectId: z.ZodNullable<z.ZodString>;
+        reason: z.ZodString;
+        placedBy: z.ZodString;
+        placedAt: z.ZodISODateTime;
+        state: z.ZodEnum<{
+            active: "active";
+            released: "released";
+        }>;
+        releasedAt: z.ZodNullable<z.ZodISODateTime>;
+        releasedBy: z.ZodNullable<z.ZodString>;
+        releaseReason: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ControlPlaneHoldResponse = z.output<typeof ControlPlaneHoldResponse>;
+/** What kind of gap the processing record names. */
+export declare const ProcessingGapKind: z.ZodEnum<{
+    "class-not-stored": "class-not-stored";
+    "class-unclaimed": "class-unclaimed";
+    "no-consent-purpose": "no-consent-purpose";
+    "no-legal-basis": "no-legal-basis";
+    "no-standing-grant": "no-standing-grant";
+    "phi-not-covered": "phi-not-covered";
+}>;
+export type ProcessingGapKind = z.infer<typeof ProcessingGapKind>;
+/** One gap in the processing record. */
+export declare const ProcessingGap: z.ZodObject<{
+    kind: z.ZodEnum<{
+        "class-not-stored": "class-not-stored";
+        "class-unclaimed": "class-unclaimed";
+        "no-consent-purpose": "no-consent-purpose";
+        "no-legal-basis": "no-legal-basis";
+        "no-standing-grant": "no-standing-grant";
+        "phi-not-covered": "phi-not-covered";
+    }>;
+    subject: z.ZodString;
+    detail: z.ZodString;
+}, z.core.$strip>;
+export type ProcessingGap = z.infer<typeof ProcessingGap>;
+/** Where a recipient in the record came from. */
+export declare const ProcessingRecipientSource: z.ZodEnum<{
+    binding: "binding";
+    declared: "declared";
+    platform: "platform";
+}>;
+/** One recipient of personal data. */
+export declare const ProcessingRecipientView: z.ZodObject<{
+    name: z.ZodString;
+    receives: z.ZodString;
+    classes: z.ZodArray<z.ZodString>;
+    source: z.ZodEnum<{
+        binding: "binding";
+        declared: "declared";
+        platform: "platform";
+    }>;
+}, z.core.$strip>;
+export type ProcessingRecipientView = z.infer<typeof ProcessingRecipientView>;
+/** A consent-based activity's purpose, with where its subjects stand. */
+export declare const ProcessingConsentView: z.ZodObject<{
+    purpose: z.ZodString;
+    noticeVersion: z.ZodNullable<z.ZodNumber>;
+    explicit: z.ZodNullable<z.ZodBoolean>;
+    grants: z.ZodNullable<z.ZodNumber>;
+    withdrawals: z.ZodNullable<z.ZodNumber>;
+    standing: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+export type ProcessingConsentView = z.infer<typeof ProcessingConsentView>;
+/** How long the data an activity uses is kept. */
+export declare const ProcessingRetentionView: z.ZodObject<{
+    classAges: z.ZodArray<z.ZodObject<{
+        class: z.ZodString;
+        days: z.ZodNumber;
+    }, z.core.$strip>>;
+    purgeWindows: z.ZodArray<z.ZodObject<{
+        subject: z.ZodEnum<{
+            organization: "organization";
+            user: "user";
+        }>;
+        days: z.ZodNumber;
+        source: z.ZodEnum<{
+            capability: "capability";
+            floor: "floor";
+            policy: "policy";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ProcessingRetentionView = z.infer<typeof ProcessingRetentionView>;
+/** One activity in the record. */
+export declare const ProcessingEntry: z.ZodObject<{
+    id: z.ZodString;
+    purpose: z.ZodString;
+    declaredBy: z.ZodString;
+    classes: z.ZodArray<z.ZodString>;
+    legalBasis: z.ZodNullable<z.ZodEnum<{
+        consent: "consent";
+        contract: "contract";
+        "legal-obligation": "legal-obligation";
+        "legitimate-interests": "legitimate-interests";
+        "public-task": "public-task";
+        "vital-interests": "vital-interests";
+    }>>;
+    basisSource: z.ZodNullable<z.ZodEnum<{
+        capability: "capability";
+        config: "config";
+    }>>;
+    consent: z.ZodNullable<z.ZodObject<{
+        purpose: z.ZodString;
+        noticeVersion: z.ZodNullable<z.ZodNumber>;
+        explicit: z.ZodNullable<z.ZodBoolean>;
+        grants: z.ZodNullable<z.ZodNumber>;
+        withdrawals: z.ZodNullable<z.ZodNumber>;
+        standing: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+    recipients: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        receives: z.ZodString;
+        classes: z.ZodArray<z.ZodString>;
+        source: z.ZodEnum<{
+            binding: "binding";
+            declared: "declared";
+            platform: "platform";
+        }>;
+    }, z.core.$strip>>;
+    retention: z.ZodNullable<z.ZodObject<{
+        classAges: z.ZodArray<z.ZodObject<{
+            class: z.ZodString;
+            days: z.ZodNumber;
+        }, z.core.$strip>>;
+        purgeWindows: z.ZodArray<z.ZodObject<{
+            subject: z.ZodEnum<{
+                organization: "organization";
+                user: "user";
+            }>;
+            days: z.ZodNumber;
+            source: z.ZodEnum<{
+                capability: "capability";
+                floor: "floor";
+                policy: "policy";
+            }>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    measures: z.ZodArray<z.ZodEnum<{
+        "audit-logging": "audit-logging";
+        "change-history": "change-history";
+        csrf: "csrf";
+        "data-protection": "data-protection";
+        "key-rotation": "key-rotation";
+        "management-access": "management-access";
+        "route-verification": "route-verification";
+    }>>;
+    gaps: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "class-not-stored": "class-not-stored";
+            "class-unclaimed": "class-unclaimed";
+            "no-consent-purpose": "no-consent-purpose";
+            "no-legal-basis": "no-legal-basis";
+            "no-standing-grant": "no-standing-grant";
+            "phi-not-covered": "phi-not-covered";
+        }>;
+        subject: z.ZodString;
+        detail: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ProcessingEntry = z.infer<typeof ProcessingEntry>;
+/** One security measure, as the evidence pack names it. */
+export declare const ProcessingMeasure: z.ZodObject<{
+    control: z.ZodEnum<{
+        "audit-logging": "audit-logging";
+        "change-history": "change-history";
+        csrf: "csrf";
+        "data-protection": "data-protection";
+        "key-rotation": "key-rotation";
+        "management-access": "management-access";
+        "route-verification": "route-verification";
+    }>;
+    title: z.ZodString;
+    soc2: z.ZodArray<z.ZodString>;
+    iso27001: z.ZodArray<z.ZodString>;
+    state: z.ZodNullable<z.ZodEnum<{
+        evidenced: "evidenced";
+        gap: "gap";
+        "not-derivable": "not-derivable";
+    }>>;
+}, z.core.$strip>;
+export type ProcessingMeasure = z.infer<typeof ProcessingMeasure>;
+/**
+ * `GET /control-plane/processing` — the record of processing activities, behind `processing:read`. It describes
+ * the processing and changes none of it.
+ */
+export declare const ControlPlaneProcessingResponse: z.ZodObject<{
+    environment: z.ZodString;
+    generatedAt: z.ZodISODateTime;
+    version: z.ZodNullable<z.ZodString>;
+    activities: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        purpose: z.ZodString;
+        declaredBy: z.ZodString;
+        classes: z.ZodArray<z.ZodString>;
+        legalBasis: z.ZodNullable<z.ZodEnum<{
+            consent: "consent";
+            contract: "contract";
+            "legal-obligation": "legal-obligation";
+            "legitimate-interests": "legitimate-interests";
+            "public-task": "public-task";
+            "vital-interests": "vital-interests";
+        }>>;
+        basisSource: z.ZodNullable<z.ZodEnum<{
+            capability: "capability";
+            config: "config";
+        }>>;
+        consent: z.ZodNullable<z.ZodObject<{
+            purpose: z.ZodString;
+            noticeVersion: z.ZodNullable<z.ZodNumber>;
+            explicit: z.ZodNullable<z.ZodBoolean>;
+            grants: z.ZodNullable<z.ZodNumber>;
+            withdrawals: z.ZodNullable<z.ZodNumber>;
+            standing: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>>;
+        recipients: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            receives: z.ZodString;
+            classes: z.ZodArray<z.ZodString>;
+            source: z.ZodEnum<{
+                binding: "binding";
+                declared: "declared";
+                platform: "platform";
+            }>;
+        }, z.core.$strip>>;
+        retention: z.ZodNullable<z.ZodObject<{
+            classAges: z.ZodArray<z.ZodObject<{
+                class: z.ZodString;
+                days: z.ZodNumber;
+            }, z.core.$strip>>;
+            purgeWindows: z.ZodArray<z.ZodObject<{
+                subject: z.ZodEnum<{
+                    organization: "organization";
+                    user: "user";
+                }>;
+                days: z.ZodNumber;
+                source: z.ZodEnum<{
+                    capability: "capability";
+                    floor: "floor";
+                    policy: "policy";
+                }>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        measures: z.ZodArray<z.ZodEnum<{
+            "audit-logging": "audit-logging";
+            "change-history": "change-history";
+            csrf: "csrf";
+            "data-protection": "data-protection";
+            "key-rotation": "key-rotation";
+            "management-access": "management-access";
+            "route-verification": "route-verification";
+        }>>;
+        gaps: z.ZodArray<z.ZodObject<{
+            kind: z.ZodEnum<{
+                "class-not-stored": "class-not-stored";
+                "class-unclaimed": "class-unclaimed";
+                "no-consent-purpose": "no-consent-purpose";
+                "no-legal-basis": "no-legal-basis";
+                "no-standing-grant": "no-standing-grant";
+                "phi-not-covered": "phi-not-covered";
+            }>;
+            subject: z.ZodString;
+            detail: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    recipients: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        receives: z.ZodString;
+        classes: z.ZodArray<z.ZodString>;
+        source: z.ZodEnum<{
+            binding: "binding";
+            declared: "declared";
+            platform: "platform";
+        }>;
+    }, z.core.$strip>>;
+    measures: z.ZodArray<z.ZodObject<{
+        control: z.ZodEnum<{
+            "audit-logging": "audit-logging";
+            "change-history": "change-history";
+            csrf: "csrf";
+            "data-protection": "data-protection";
+            "key-rotation": "key-rotation";
+            "management-access": "management-access";
+            "route-verification": "route-verification";
+        }>;
+        title: z.ZodString;
+        soc2: z.ZodArray<z.ZodString>;
+        iso27001: z.ZodArray<z.ZodString>;
+        state: z.ZodNullable<z.ZodEnum<{
+            evidenced: "evidenced";
+            gap: "gap";
+            "not-derivable": "not-derivable";
+        }>>;
+    }, z.core.$strip>>;
+    gaps: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "class-not-stored": "class-not-stored";
+            "class-unclaimed": "class-unclaimed";
+            "no-consent-purpose": "no-consent-purpose";
+            "no-legal-basis": "no-legal-basis";
+            "no-standing-grant": "no-standing-grant";
+            "phi-not-covered": "phi-not-covered";
+        }>;
+        subject: z.ZodString;
+        detail: z.ZodString;
+    }, z.core.$strip>>;
+    notDerivable: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type ControlPlaneProcessingResponse = z.infer<typeof ControlPlaneProcessingResponse>;
+/** One trust's subject constraint, as a connection listing shows it: the population that may use the trust. */
+export declare const ConnectionTrustView: z.ZodObject<{
+    trustId: z.ZodString;
+    issuer: z.ZodString;
+    claims: z.ZodRecord<z.ZodString, z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ConnectionTrustView = z.output<typeof ConnectionTrustView>;
+/** One connection, as `GET {basePath}/connections` lists it. No key material and no secret. */
+export declare const ConnectionView: z.ZodObject<{
+    id: z.ZodString;
+    environment: z.ZodString;
+    actorKind: z.ZodNullable<z.ZodEnum<{
+        agent: "agent";
+        dashboard: "dashboard";
+        script: "script";
+    }>>;
+    purpose: z.ZodNullable<z.ZodString>;
+    authorizedBy: z.ZodNullable<z.ZodEmail>;
+    credentialKind: z.ZodEnum<{
+        both: "both";
+        key: "key";
+        none: "none";
+        trust: "trust";
+    }>;
+    scopes: z.ZodArray<z.ZodString>;
+    trusts: z.ZodArray<z.ZodObject<{
+        trustId: z.ZodString;
+        issuer: z.ZodString;
+        claims: z.ZodRecord<z.ZodString, z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+    live: z.ZodBoolean;
+    registeredAt: z.ZodISODateTime;
+    revokedAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type ConnectionView = z.output<typeof ConnectionView>;
+/** `GET /control-plane/connections`. */
+export declare const ControlPlaneConnectionsResponse: z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        environment: z.ZodString;
+        actorKind: z.ZodNullable<z.ZodEnum<{
+            agent: "agent";
+            dashboard: "dashboard";
+            script: "script";
+        }>>;
+        purpose: z.ZodNullable<z.ZodString>;
+        authorizedBy: z.ZodNullable<z.ZodEmail>;
+        credentialKind: z.ZodEnum<{
+            both: "both";
+            key: "key";
+            none: "none";
+            trust: "trust";
+        }>;
+        scopes: z.ZodArray<z.ZodString>;
+        trusts: z.ZodArray<z.ZodObject<{
+            trustId: z.ZodString;
+            issuer: z.ZodString;
+            claims: z.ZodRecord<z.ZodString, z.ZodString>;
+            revokedAt: z.ZodNullable<z.ZodISODateTime>;
+        }, z.core.$strip>>;
+        live: z.ZodBoolean;
+        registeredAt: z.ZodISODateTime;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+    unattributed: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        environment: z.ZodString;
+        actorKind: z.ZodNullable<z.ZodEnum<{
+            agent: "agent";
+            dashboard: "dashboard";
+            script: "script";
+        }>>;
+        purpose: z.ZodNullable<z.ZodString>;
+        authorizedBy: z.ZodNullable<z.ZodEmail>;
+        credentialKind: z.ZodEnum<{
+            both: "both";
+            key: "key";
+            none: "none";
+            trust: "trust";
+        }>;
+        scopes: z.ZodArray<z.ZodString>;
+        trusts: z.ZodArray<z.ZodObject<{
+            trustId: z.ZodString;
+            issuer: z.ZodString;
+            claims: z.ZodRecord<z.ZodString, z.ZodString>;
+            revokedAt: z.ZodNullable<z.ZodISODateTime>;
+        }, z.core.$strip>>;
+        live: z.ZodBoolean;
+        registeredAt: z.ZodISODateTime;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ControlPlaneConnectionsResponse = z.output<typeof ControlPlaneConnectionsResponse>;
+/** `POST /control-plane/connections/:connectionId/revoke`. */
+export declare const RevokeConnectionResponse: z.ZodObject<{
+    connection: z.ZodObject<{
+        id: z.ZodString;
+        environment: z.ZodString;
+        actorKind: z.ZodNullable<z.ZodEnum<{
+            agent: "agent";
+            dashboard: "dashboard";
+            script: "script";
+        }>>;
+        purpose: z.ZodNullable<z.ZodString>;
+        authorizedBy: z.ZodNullable<z.ZodEmail>;
+        credentialKind: z.ZodEnum<{
+            both: "both";
+            key: "key";
+            none: "none";
+            trust: "trust";
+        }>;
+        scopes: z.ZodArray<z.ZodString>;
+        trusts: z.ZodArray<z.ZodObject<{
+            trustId: z.ZodString;
+            issuer: z.ZodString;
+            claims: z.ZodRecord<z.ZodString, z.ZodString>;
+            revokedAt: z.ZodNullable<z.ZodISODateTime>;
+        }, z.core.$strip>>;
+        live: z.ZodBoolean;
+        registeredAt: z.ZodISODateTime;
+        revokedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>;
+    revokedKeyIds: z.ZodArray<z.ZodString>;
+    revokedTrustIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type RevokeConnectionResponse = z.output<typeof RevokeConnectionResponse>;
 //# sourceMappingURL=responses.d.ts.map