@superdurable/connectors-sdk 0.0.0-stage → 0.1.0

package/dist/projectconfig/index.d.ts

@@ -0,0 +1,569 @@
+import { z } from 'zod';
+import { inspect } from 'node:util';
+import { S3Client } from '@aws-sdk/client-s3';
+import { t as CredentialProvider$1, C as Call, W as RefreshingCredentialProvider$1, X as RejectedCredentialRefreshingProvider, u as CredentialRefreshDriver } from '../credentials-vrvW0d4j.js';
+import '@superdurable/dex';
+
+/** Current secret-free project configuration schema shared with Dex Web. */
+declare const ConfigurationSchemaVersion = "connectors.dex.dev/project-configuration/v1alpha3";
+/** Local Dex Web connections file schema. */
+declare const LocalConnectionsSchemaVersion = "connectors.dex.dev/local-connections/v1alpha1";
+/** RFC3339 timestamp with at most nanosecond precision. */
+declare const RFC3339NanoSchema: z.ZodISODateTime;
+/** Fixed project and Live or Preview credential boundary. */
+declare const ScopeSchema: z.ZodObject<{
+    projectId: z.ZodString;
+    kind: z.ZodEnum<{
+        live: "live";
+        preview: "preview";
+    }>;
+}, z.core.$strict>;
+/** Project ID and live or preview scope. */
+type Scope = z.infer<typeof ScopeSchema>;
+/** Return the canonical relative storage prefix for a trusted scope. */
+declare function scopePrefix(scope: Scope): string;
+/** Exact versioned private application secret reference. */
+declare const ApplicationSecretRefSchema: z.ZodObject<{
+    key: z.ZodString;
+    version: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strict>;
+/** Immutable private application secret reference. */
+type ApplicationSecretRef = z.infer<typeof ApplicationSecretRefSchema>;
+/** Ordinary or private application environment value. */
+declare const EnvironmentValueSchema: z.ZodObject<{
+    value: z.ZodOptional<z.ZodString>;
+    secretRef: z.ZodOptional<z.ZodObject<{
+        key: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Ordinary value or private secret reference. */
+type EnvironmentValue = z.infer<typeof EnvironmentValueSchema>;
+/** Logical connection and manifest-validated ordinary settings. */
+declare const ConnectionConfigurationSchema: z.ZodObject<{
+    connectorId: z.ZodString;
+    connectionName: z.ZodString;
+    modulePath: z.ZodString;
+    provider: z.ZodString;
+    authMethodId: z.ZodOptional<z.ZodString>;
+    sharedConnectionId: z.ZodOptional<z.ZodString>;
+    configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>;
+/** Ordinary connection configuration and optional shared identity. */
+type ConnectionConfiguration = z.infer<typeof ConnectionConfigurationSchema>;
+/** Connector Trigger binding startup settings. */
+declare const TriggerConfigurationSchema: z.ZodObject<{
+    connectorId: z.ZodString;
+    connectionName: z.ZodString;
+    triggerName: z.ZodString;
+    bindingName: z.ZodString;
+    configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>;
+/** Trigger binding and ordinary configuration. */
+type TriggerConfiguration = z.infer<typeof TriggerConfigurationSchema>;
+/** Exact Flow and Step use configuration. */
+declare const OperationConfigurationSchema: z.ZodObject<{
+    connectorId: z.ZodString;
+    connectionName: z.ZodString;
+    operationId: z.ZodString;
+    flowType: z.ZodString;
+    stepType: z.ZodString;
+    configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>;
+/** Operation configuration for one Flow and Step. */
+type OperationConfiguration = z.infer<typeof OperationConfigurationSchema>;
+/** Scope-owned credential broker endpoint and exact scope token reference. */
+declare const CredentialBrokerConfigurationSchema: z.ZodObject<{
+    endpoint: z.ZodURL;
+    tokenSecretRef: z.ZodObject<{
+        key: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** Shared credential broker endpoint and token reference. */
+type CredentialBrokerConfiguration = z.infer<typeof CredentialBrokerConfigurationSchema>;
+/** Immutable ordinary project configuration snapshot. */
+declare const ConfigurationSchema: z.ZodObject<{
+    schemaVersion: z.ZodEnum<{
+        "connectors.dex.dev/project-configuration/v1alpha3": "connectors.dex.dev/project-configuration/v1alpha3";
+        "connectors.dex.dev/project-configuration/v1alpha2": "connectors.dex.dev/project-configuration/v1alpha2";
+    }>;
+    scope: z.ZodObject<{
+        projectId: z.ZodString;
+        kind: z.ZodEnum<{
+            live: "live";
+            preview: "preview";
+        }>;
+    }, z.core.$strict>;
+    revision: z.ZodNumber;
+    connections: z.ZodArray<z.ZodObject<{
+        connectorId: z.ZodString;
+        connectionName: z.ZodString;
+        modulePath: z.ZodString;
+        provider: z.ZodString;
+        authMethodId: z.ZodOptional<z.ZodString>;
+        sharedConnectionId: z.ZodOptional<z.ZodString>;
+        configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>>;
+    triggerBindings: z.ZodArray<z.ZodObject<{
+        connectorId: z.ZodString;
+        connectionName: z.ZodString;
+        triggerName: z.ZodString;
+        bindingName: z.ZodString;
+        configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>>;
+    operationConfigurations: z.ZodArray<z.ZodObject<{
+        connectorId: z.ZodString;
+        connectionName: z.ZodString;
+        operationId: z.ZodString;
+        flowType: z.ZodString;
+        stepType: z.ZodString;
+        configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>>;
+    environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        value: z.ZodOptional<z.ZodString>;
+        secretRef: z.ZodOptional<z.ZodObject<{
+            key: z.ZodString;
+            version: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    credentialBroker: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodURL;
+        tokenSecretRef: z.ZodObject<{
+            key: z.ZodString;
+            version: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Versioned ordinary project configuration. */
+type Configuration = z.infer<typeof ConfigurationSchema>;
+/** Exact immutable configuration object version and digest. */
+declare const SnapshotRefSchema: z.ZodObject<{
+    key: z.ZodString;
+    version: z.ZodString;
+    digest: z.ZodString;
+    mediaType: z.ZodLiteral<"application/json">;
+}, z.core.$strict>;
+/** Exact immutable configuration snapshot reference. */
+type SnapshotRef = z.infer<typeof SnapshotRefSchema>;
+/** Local Dex Web record; credential contents remain private. */
+declare const LocalConnectionSchema: z.ZodObject<{
+    connectorId: z.ZodString;
+    connectionName: z.ZodString;
+    modulePath: z.ZodString;
+    provider: z.ZodString;
+    authMethodId: z.ZodOptional<z.ZodString>;
+    authMethodIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    credentials: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    credentialExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+}, z.core.$strip>;
+/** Private Dex Web connection record. */
+type LocalConnection = z.infer<typeof LocalConnectionSchema>;
+/** Dex Web local file, allowing future additive members. */
+declare const LocalConnectionsFileSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"connectors.dex.dev/local-connections/v1alpha1">;
+    connections: z.ZodArray<z.ZodObject<{
+        connectorId: z.ZodString;
+        connectionName: z.ZodString;
+        modulePath: z.ZodString;
+        provider: z.ZodString;
+        authMethodId: z.ZodOptional<z.ZodString>;
+        authMethodIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        credentials: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        credentialExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+    }, z.core.$strip>>;
+    triggerBindings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        connectorId: z.ZodString;
+        connectionName: z.ZodString;
+        triggerName: z.ZodString;
+        bindingName: z.ZodString;
+        configuration: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>>>;
+}, z.core.$strip>;
+/** Private Dex Web local connections file. */
+type LocalConnectionsFile = z.infer<typeof LocalConnectionsFileSchema>;
+
+/** Object is absent at the requested key or exact version. */
+declare class ObjectNotFoundError extends Error {
+    constructor();
+}
+/** Conditional write lost to another revision. */
+declare class ConflictError extends Error {
+    constructor();
+}
+/** Write acceptance is unknown and must be reconciled before another mutation. */
+declare class OutcomeUnknownError extends Error {
+    constructor();
+}
+/** Private object with exact version and compare-and-swap identity. */
+declare class ProjectObject {
+    #private;
+    readonly key: string;
+    readonly version: string;
+    readonly etag: string;
+    /** Keep private bytes outside Node inspection; key, version, and ETag identify the exact object. */
+    constructor(key: string, version: string, etag: string, contents: Uint8Array);
+    /** Exact private bytes; callers must not log or persist them. */
+    get contents(): Uint8Array;
+    /** Never format private contents. */
+    toString(): string;
+    /** Keep Node inspection and console output secret-safe. */
+    [inspect.custom](): string;
+    /** Reject accidental JSON transport. */
+    toJSON(): never;
+}
+/** Strongly consistent versioned object store with conditional writes. */
+interface ObjectStore {
+    /** Read current or exact object version. */
+    readObject(key: string, version?: string): Promise<ProjectObject>;
+    /** Create only when the key is absent. */
+    createObject(key: string, contents: Uint8Array): Promise<ProjectObject>;
+    /** Replace only if current ETag equals the expected value. */
+    compareAndSwapObject(key: string, expectedETag: string, contents: Uint8Array): Promise<ProjectObject>;
+}
+/** Process-local versioned store for Dex Web preview and deterministic tests. */
+declare class InMemoryObjectStore implements ObjectStore {
+    #private;
+    /** Read the latest object or an exact immutable version. */
+    readObject(key: string, version?: string): Promise<ProjectObject>;
+    /** Create only when no object exists under this key. */
+    createObject(key: string, contents: Uint8Array): Promise<ProjectObject>;
+    /** Compare and swap the latest object by ETag. */
+    compareAndSwapObject(key: string, expectedETag: string, contents: Uint8Array): Promise<ProjectObject>;
+}
+/** Fixed S3 storage boundary with exact encryption configuration. */
+interface S3StoreConfig {
+    /** Authenticated S3 client owned by the application. */ client: S3Client;
+    /** Existing private, versioned bucket. */ bucket: string;
+    /** Optional trusted key prefix. */ prefix?: string;
+    /** Exact KMS key ARN. */ kmsKeyId?: string;
+    /** Isolated local fixture only. */ allowUnencrypted?: boolean;
+}
+/** S3 implementation using If-Match and If-None-Match without write retries. */
+declare class S3ObjectStore implements ObjectStore {
+    private readonly configuration;
+    private readonly prefix;
+    private constructor();
+    /** Verify bucket versioning before any application request. */
+    static create(configuration: S3StoreConfig): Promise<S3ObjectStore>;
+    /** Read bounded private bytes and validate exact version and KMS key. */
+    readObject(key: string, version?: string): Promise<ProjectObject>;
+    /** Write once with If-None-Match. */
+    createObject(key: string, contents: Uint8Array): Promise<ProjectObject>;
+    /** Write once with If-Match; ambiguous outcomes stay unknown. */
+    compareAndSwapObject(key: string, expectedETag: string, contents: Uint8Array): Promise<ProjectObject>;
+    private writeObject;
+}
+/** Configuration CAS and immutable snapshot reader. */
+declare class ConfigurationStore {
+    #private;
+    private readonly objects;
+    private readonly scope;
+    /** Bind a private object store to one validated project scope. */
+    constructor(objects: ObjectStore, scope: Scope);
+    /** Read and validate current ordinary configuration. */
+    readConfiguration(): Promise<{
+        configuration: Configuration;
+        object: ProjectObject;
+    }>;
+    /** Conditionally replace ordinary settings using an expected revision. */
+    writeConfiguration(expectedRevision: number, document: Omit<Configuration, 'schemaVersion' | 'scope' | 'revision'>): Promise<Configuration>;
+    /** Read an exact pinned snapshot after checking its digest. */
+    readSnapshot(reference: SnapshotRef): Promise<Configuration>;
+    /** Pin the current version when its revision is still expected. */
+    freezeConfiguration(expectedRevision: number): Promise<SnapshotRef>;
+    private decodeConfiguration;
+}
+/** Validate a relative object key before accessing private storage. */
+declare function validateObjectKey(key: string): void;
+/** Return the scoped Go-compatible head key for a named connection. */
+declare function connectionHeadKey(scope: Scope, connectorId: string, connectionName: string): string;
+/** SHA-256 digest in Go projectconfig wire format. */
+declare function digestBytes(contents: Uint8Array): string;
+/** Encode Go-compatible compact JSON before hashing. Known structs use field-order heuristics; raw maps sort UTF-8 keys, unlike Go's preserved RawMessage order. Unpaired surrogates retain JavaScript escaping. */
+declare function encodeGoCompatibleJSON(document: unknown): string;
+
+/** Private connection head shared with the Go project store. */
+declare const ConnectionRecordSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"connectors.dex.dev/project-connection/v1alpha2">;
+    connection: z.ZodObject<{
+        connectorId: z.ZodString;
+        connectionName: z.ZodString;
+    }, z.core.$strict>;
+    scope: z.ZodObject<{
+        projectId: z.ZodString;
+        kind: z.ZodEnum<{
+            live: "live";
+            preview: "preview";
+        }>;
+    }, z.core.$strict>;
+    revision: z.ZodNumber;
+    fence: z.ZodNumber;
+    status: z.ZodEnum<{
+        READY: "READY";
+        AUTHORIZING: "AUTHORIZING";
+        REFRESHING: "REFRESHING";
+        REAUTHORIZATION_REQUIRED: "REAUTHORIZATION_REQUIRED";
+        REVOKED: "REVOKED";
+    }>;
+    authMethod: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+    credential: z.ZodOptional<z.ZodObject<{
+        key: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>>;
+    mutation: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodString;
+        invocationId: z.ZodString;
+        id: z.ZodString;
+        fence: z.ZodNumber;
+        baseRevision: z.ZodNumber;
+        deadline: z.ZodISODateTime;
+        resultKey: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Private connection head. */
+type ConnectionRecord = z.infer<typeof ConnectionRecordSchema>;
+/** Immutable private credential material. */
+declare const CredentialEnvelopeSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"connectors.dex.dev/project-connection/v1alpha2">;
+    scope: z.ZodObject<{
+        projectId: z.ZodString;
+        kind: z.ZodEnum<{
+            live: "live";
+            preview: "preview";
+        }>;
+    }, z.core.$strict>;
+    connection: z.ZodObject<{
+        connectorId: z.ZodString;
+        connectionName: z.ZodString;
+    }, z.core.$strict>;
+    fence: z.ZodNumber;
+    attemptId: z.ZodOptional<z.ZodString>;
+    credentials: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+    authMethod: z.ZodString;
+}, z.core.$strict>;
+
+/** Broker temporarily unavailable; another read may succeed. */
+declare class CredentialBrokerUnavailableError extends Error {
+    constructor();
+}
+/** Broker rejected the scope or returned an invalid answer. */
+declare class CredentialBrokerRejectedError extends Error {
+    constructor();
+}
+/** Loaded scope no longer selects this shared connection. */
+declare class ConnectionNotSelectedError extends Error {
+    constructor();
+}
+/** Broker returned the same revision after provider rejection; the call must stop. */
+declare class RejectedCredentialNotRefreshedError extends Error {
+    constructor();
+}
+/** Complete provider credential returned only at the private boundary. */
+interface BrokerCredential {
+    /** Credential object without host-kept renewal secrets. */ credential: Record<string, unknown>;
+    /** Positive broker revision. */ revision: number;
+    /** Optional issuance time. */ issuedAt?: string;
+    /** Optional expiry time. */ expiresAt?: string | null;
+}
+/** Additive broker wire response, including terminal statuses. */
+declare const BrokerAnswerSchema: z.ZodObject<{
+    status: z.ZodEnum<{
+        READY: "READY";
+        REAUTHORIZATION_REQUIRED: "REAUTHORIZATION_REQUIRED";
+        CONNECTION_NOT_SELECTED: "CONNECTION_NOT_SELECTED";
+    }>;
+    credential: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    revision: z.ZodOptional<z.ZodNumber>;
+    issuedAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+}, z.core.$strip>;
+/** Client for one trusted credential broker endpoint and scope token source. */
+declare class CredentialBrokerClient {
+    #private;
+    private readonly endpoint;
+    private readonly readToken;
+    private readonly transport;
+    /** Bind a trusted endpoint, token source, and optional transport; tokens renew only after 401. */
+    constructor(endpoint: string, readToken: (renew?: boolean) => Promise<string>, transport?: typeof fetch);
+    /** Read a shared credential; rejectedRevision is sent only when positive. */
+    read(sharedConnectionId: string, rejectedRevision?: number, signal?: AbortSignal): Promise<BrokerCredential>;
+    private readWithinDeadline;
+    private post;
+}
+
+/** Broker-backed shared selections fixed by the loaded project configuration. */
+declare class SharedConnections {
+    #private;
+    private readonly broker;
+    /** Bind shared entries to the project's trusted credential broker. */
+    constructor(configuration: Configuration, broker: Pick<CredentialBrokerClient, 'read'>);
+    /** Whether a loaded connection resolves through the broker. */
+    has(key: ConnectionKey): boolean;
+    /** Read a current shared credential and remember the revision issued to this call. */
+    read(key: ConnectionKey, callId: string, signal?: AbortSignal): Promise<BrokerCredential>;
+    /** Ask the broker for a revision newer than the one issued to this call. */
+    readAfterRejection(key: ConnectionKey, callId: string, signal?: AbortSignal): Promise<BrokerCredential>;
+}
+
+/** Manifest connector ID and application-selected connection name. */
+interface ConnectionKey {
+    /** Manifest connector ID. */ connectorId: string;
+    /** Static application connection name. */ connectionName: string;
+}
+/** Validate a connection key and return its scoped object prefix. */
+declare function connectionPath(scope: Scope, key: ConnectionKey): string;
+/** Private connector credential material outside Dex Flow state. */
+declare class CredentialMaterial {
+    readonly credentials: Record<string, unknown>;
+    readonly expiresAt: Date | undefined;
+    readonly authMethod: string;
+    /** Capture complete private credentials and optional access expiry. */
+    constructor(credentials: Record<string, unknown>, expiresAt: Date | undefined, authMethod: string);
+    /** Reject accidental durable JSON serialization. */ toJSON(): never;
+    /** Redact private material in logs. */ [inspect.custom](): string;
+}
+/** Safe authoritative connection metadata without private credential bytes. */
+interface Connection {
+    /** Connection identity. */ key: ConnectionKey;
+    /** Project scope. */ scope: Scope;
+    /** Head revision. */ revision: number;
+    /** Monotonic mutation fence. */ fence: number;
+    /** Authorization status. */ status: ConnectionRecord['status'];
+    /** Known access expiry. */ expiresAt?: Date;
+    /** Manifest authorization method. */ authMethod: string;
+}
+/** Versioned connection heads and immutable credential objects. */
+declare class ConnectionStore {
+    #private;
+    readonly objects: ObjectStore;
+    readonly scope: Scope;
+    readonly shared?: SharedConnections | undefined;
+    /** Bind one object store and validated project scope. */
+    constructor(objects: ObjectStore, scope: Scope, shared?: SharedConnections | undefined);
+    /** Read safe connection metadata without credential material. */
+    readConnection(key: ConnectionKey): Promise<Connection>;
+    /** Read exact current private material from a READY connection. */
+    readCredentialMaterial(key: ConnectionKey): Promise<{
+        material: CredentialMaterial;
+        connection: Connection;
+    }>;
+    /** Read and validate a current head for refresh admission. */
+    readRecord(key: ConnectionKey): Promise<{
+        record: ConnectionRecord;
+        object: ProjectObject;
+    }>;
+    /** Read private material by an already validated head. */
+    readMaterial(key: ConnectionKey, record: ConnectionRecord): Promise<CredentialMaterial>;
+    /** Fence prior work and publish one complete immutable credential version. */
+    replaceCredential(key: ConnectionKey, expectedRevision: number, material: CredentialMaterial): Promise<Connection>;
+    /** Conditionally publish a new head and reconcile an unknown write outcome. */
+    writeHead(key: ConnectionKey, previous: ProjectObject | undefined, record: ConnectionRecord): Promise<ProjectObject>;
+}
+/** Build a Go-compatible private credential envelope. */
+declare function credentialEnvelope(scope: Scope, key: ConnectionKey, fence: number, material: CredentialMaterial, attemptId?: string): Record<string, unknown>;
+/** Build a Go-compatible connection head. */
+declare function connectionRecord(scope: Scope, key: ConnectionKey, revision: number, fence: number, status: ConnectionRecord['status'], expiresAt: Date | undefined, authMethod: string, credential?: ConnectionRecord['credential'], mutation?: ConnectionRecord['mutation']): ConnectionRecord;
+
+/** Selects the private local connections.json written by Dex Web. */
+declare const LocalConnectionsFileEnvironment = "DEX_CONNECTOR_CONFIG_FILE";
+/** Loaded ordinary configuration and private connection resolver. */
+declare class LoadedProject {
+    #private;
+    /** Startup-pinned ordinary document. */ readonly configuration: Configuration;
+    /** Exact immutable document reference. */ readonly snapshot: SnapshotRef | undefined;
+    private readonly broker;
+    /** Versioned private connection store for generated provider adapters. */
+    readonly connections: ConnectionStore;
+    /** Bind startup-pinned configuration to exactly one private credential source. */
+    constructor(
+    /** Startup-pinned ordinary document. */ configuration: Configuration, 
+    /** Exact immutable document reference. */ snapshot: SnapshotRef | undefined, objects: ObjectStore | undefined, _localFilePath: string | undefined, broker: CredentialBrokerClient | undefined);
+    /** Read a current private credential, never returning it through a Flow result. */
+    resolveCredential(connectorId: string, connectionName: string, signal?: AbortSignal): Promise<Record<string, unknown>>;
+    /** Resolve a newer shared credential after the provider rejected one revision. */
+    resolveCredentialAfterRejection(connectorId: string, connectionName: string, rejectedRevision: number, signal?: AbortSignal): Promise<Record<string, unknown>>;
+}
+/** Load trusted DEX_PROJECT_* settings or a local Dex Web file at startup. */
+declare function loadFromEnvironment(environment?: NodeJS.ProcessEnv): Promise<LoadedProject>;
+/** Read a mode-0600 regular file without exposing private values in errors. */
+declare function readLocalConnectionsFile(path: string): Promise<{
+    connections: LocalConnection[];
+    triggerBindings?: Configuration['triggerBindings'];
+}>;
+
+/** Connector-owned validation of complete private credential JSON. */
+type CredentialDecoder<C> = (document: Record<string, unknown>) => C;
+/** Connector-owned encoding of complete replacement material. */
+type CredentialEncoder<C> = (credentials: C) => Record<string, unknown>;
+/** Decode broker material that omits secrets retained by the shared connection host. */
+type SharedCredentialDecoder<C> = (document: Record<string, unknown>) => C;
+/** Another invocation owns provider dispatch for this credential generation. */
+declare class ExchangePendingError extends Error {
+    constructor();
+}
+/** Refresh failed without proving the prior authorization invalid. */
+declare class RefreshFailedError extends Error {
+    constructor(message?: string);
+}
+/** Read a non-refreshing project credential on every connector invocation. */
+declare class CredentialProvider<C> implements CredentialProvider$1<C> {
+    protected readonly store: ConnectionStore;
+    protected readonly key: ConnectionKey;
+    protected readonly decode: CredentialDecoder<C>;
+    protected readonly decodeShared?: SharedCredentialDecoder<C> | undefined;
+    /** Bind one validated project connection and a credential decoder. */
+    constructor(store: ConnectionStore, key: ConnectionKey, decode: CredentialDecoder<C>, decodeShared?: SharedCredentialDecoder<C> | undefined);
+    /** Read current private material without refreshing known-expired credentials. */
+    resolve(call: Call, signal?: AbortSignal): Promise<C>;
+    /** Read current material under an explicit cancellation signal. */
+    resolveContext(call: Call, signal: AbortSignal): Promise<C>;
+    /** Reject a call aimed at another configured connection. */
+    protected validateCall(call: Call): void;
+    /** Decode private material without leaking invalid values in errors. */
+    protected decodeMaterial(material: CredentialMaterial): C;
+    /** Decode a broker response with the connector's shared credential rules. */
+    protected decodeSharedMaterial(document: Record<string, unknown>): C;
+}
+/** Refresh and persist project credentials once per generation across replicas. */
+declare class RefreshingCredentialProvider<C> extends CredentialProvider<C> implements RefreshingCredentialProvider$1<C>, RejectedCredentialRefreshingProvider<C> {
+    #private;
+    /** Bind a complete replacement encoder in addition to the decoder. */
+    constructor(store: ConnectionStore, key: ConnectionKey, decode: CredentialDecoder<C>, encode: CredentialEncoder<C>, decodeShared?: SharedCredentialDecoder<C>);
+    /** Admit a durable refresh before one provider request; observers recover its result. */
+    resolveWithRefresh(call: Call, driver: CredentialRefreshDriver<C>, signal?: AbortSignal): Promise<C>;
+    /** Force refresh only when stored expiry proves the rejected token expired. */
+    resolveAfterRejection(call: Call, driver: CredentialRefreshDriver<C>, signal?: AbortSignal): Promise<C>;
+}
+/** Bind an API-key or other non-refreshing credential to one project connection. */
+declare function newCredentialProvider<C>(store: ConnectionStore, key: ConnectionKey, decode: CredentialDecoder<C>, decodeShared?: SharedCredentialDecoder<C>): CredentialProvider<C>;
+/** Bind a renewable credential and complete replacement encoder to one connection. */
+declare function newRefreshingCredentialProvider<C>(store: ConnectionStore, key: ConnectionKey, decode: CredentialDecoder<C>, encode: CredentialEncoder<C>, decodeShared?: SharedCredentialDecoder<C>): RefreshingCredentialProvider<C>;
+
+/** Process-local Dex Web credential projection with guarded owner-only writeback. */
+declare class DexWebObjectStore implements ObjectStore {
+    #private;
+    private readonly path;
+    /** Bind a mode-0600 connections.json file and local project scope. */
+    constructor(path: string, scope: Scope);
+    /** Import current Dex Web credentials before application registration. */
+    initialize(): Promise<void>;
+    /** Adopt Dex Web updates before reading a connection head. */
+    readObject(key: string, version?: string): Promise<ProjectObject>;
+    /** Create an immutable private object in process memory. */
+    createObject(key: string, contents: Uint8Array): Promise<ProjectObject>;
+    /** CAS a head, then write back a refreshed credential if the file is still current. */
+    compareAndSwapObject(key: string, expectedETag: string, contents: Uint8Array): Promise<ProjectObject>;
+}
+
+export { type ApplicationSecretRef, ApplicationSecretRefSchema, BrokerAnswerSchema, type BrokerCredential, type Configuration, ConfigurationSchema, ConfigurationSchemaVersion, ConfigurationStore, ConflictError, type Connection, type ConnectionConfiguration, ConnectionConfigurationSchema, type ConnectionKey, ConnectionNotSelectedError, ConnectionRecordSchema, ConnectionStore, CredentialBrokerClient, type CredentialBrokerConfiguration, CredentialBrokerConfigurationSchema, CredentialBrokerRejectedError, CredentialBrokerUnavailableError, type CredentialDecoder, type CredentialEncoder, CredentialEnvelopeSchema, CredentialMaterial, CredentialProvider, DexWebObjectStore, type EnvironmentValue, EnvironmentValueSchema, ExchangePendingError, InMemoryObjectStore, LoadedProject, type LocalConnection, LocalConnectionSchema, type LocalConnectionsFile, LocalConnectionsFileEnvironment, LocalConnectionsFileSchema, LocalConnectionsSchemaVersion, ObjectNotFoundError, type ObjectStore, type OperationConfiguration, OperationConfigurationSchema, OutcomeUnknownError, ProjectObject, RFC3339NanoSchema, RefreshFailedError, RefreshingCredentialProvider, RejectedCredentialNotRefreshedError, S3ObjectStore, type S3StoreConfig, type Scope, ScopeSchema, SharedConnections, type SharedCredentialDecoder, type SnapshotRef, SnapshotRefSchema, type TriggerConfiguration, TriggerConfigurationSchema, connectionHeadKey, connectionPath, connectionRecord, credentialEnvelope, digestBytes, encodeGoCompatibleJSON, loadFromEnvironment, newCredentialProvider, newRefreshingCredentialProvider, readLocalConnectionsFile, scopePrefix, validateObjectKey };