npm - @treeseed/sdk - Versions diffs - 0.13.0-rc.11 → 0.13.0-rc.111 - Mend

@treeseed/sdk 0.13.0-rc.11 → 0.13.0-rc.111

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (453) hide show

package/dist/deployment/hosted-topology.d.ts ADDED Viewed

@@ -0,0 +1,2698 @@
+import { z } from 'zod';
+export declare function hostedTopologyStateKey(input: {
+    teamId: string;
+    deploymentId: string;
+    environment: 'staging' | 'production';
+    stackId: string;
+}): string;
+declare const hostedStateBackendCoreSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-state-backend/v1">;
+    type: z.ZodLiteral<"s3">;
+    teamId: z.ZodString;
+    deploymentId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    stackId: z.ZodString;
+    connectionRef: z.ZodString;
+    bucket: z.ZodString;
+    key: z.ZodString;
+    region: z.ZodString;
+    endpoint: z.ZodOptional<z.ZodString>;
+    usePathStyle: z.ZodOptional<z.ZodBoolean>;
+    encryptionKeyRef: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "s3";
+    schemaVersion: "treeseed.hosted-state-backend/v1";
+    key: string;
+    teamId: string;
+    environment: "production" | "staging";
+    deploymentId: string;
+    bucket: string;
+    stackId: string;
+    connectionRef: string;
+    region: string;
+    encryptionKeyRef: string;
+    endpoint?: string | undefined;
+    usePathStyle?: boolean | undefined;
+}, {
+    type: "s3";
+    schemaVersion: "treeseed.hosted-state-backend/v1";
+    key: string;
+    teamId: string;
+    environment: "production" | "staging";
+    deploymentId: string;
+    bucket: string;
+    stackId: string;
+    connectionRef: string;
+    region: string;
+    encryptionKeyRef: string;
+    endpoint?: string | undefined;
+    usePathStyle?: boolean | undefined;
+}>;
+export declare const hostedStateBackendSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-state-backend/v1">;
+    type: z.ZodLiteral<"s3">;
+    teamId: z.ZodString;
+    deploymentId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    stackId: z.ZodString;
+    connectionRef: z.ZodString;
+    bucket: z.ZodString;
+    key: z.ZodString;
+    region: z.ZodString;
+    endpoint: z.ZodOptional<z.ZodString>;
+    usePathStyle: z.ZodOptional<z.ZodBoolean>;
+    encryptionKeyRef: z.ZodString;
+} & {
+    bindingDigest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "s3";
+    schemaVersion: "treeseed.hosted-state-backend/v1";
+    key: string;
+    teamId: string;
+    environment: "production" | "staging";
+    deploymentId: string;
+    bucket: string;
+    stackId: string;
+    connectionRef: string;
+    region: string;
+    encryptionKeyRef: string;
+    bindingDigest: string;
+    endpoint?: string | undefined;
+    usePathStyle?: boolean | undefined;
+}, {
+    type: "s3";
+    schemaVersion: "treeseed.hosted-state-backend/v1";
+    key: string;
+    teamId: string;
+    environment: "production" | "staging";
+    deploymentId: string;
+    bucket: string;
+    stackId: string;
+    connectionRef: string;
+    region: string;
+    encryptionKeyRef: string;
+    bindingDigest: string;
+    endpoint?: string | undefined;
+    usePathStyle?: boolean | undefined;
+}>, {
+    type: "s3";
+    schemaVersion: "treeseed.hosted-state-backend/v1";
+    key: string;
+    teamId: string;
+    environment: "production" | "staging";
+    deploymentId: string;
+    bucket: string;
+    stackId: string;
+    connectionRef: string;
+    region: string;
+    encryptionKeyRef: string;
+    bindingDigest: string;
+    endpoint?: string | undefined;
+    usePathStyle?: boolean | undefined;
+}, {
+    type: "s3";
+    schemaVersion: "treeseed.hosted-state-backend/v1";
+    key: string;
+    teamId: string;
+    environment: "production" | "staging";
+    deploymentId: string;
+    bucket: string;
+    stackId: string;
+    connectionRef: string;
+    region: string;
+    encryptionKeyRef: string;
+    bindingDigest: string;
+    endpoint?: string | undefined;
+    usePathStyle?: boolean | undefined;
+}>;
+export declare function bindHostedStateBackend(input: z.input<typeof hostedStateBackendCoreSchema>): {
+    type: "s3";
+    schemaVersion: "treeseed.hosted-state-backend/v1";
+    key: string;
+    teamId: string;
+    environment: "production" | "staging";
+    deploymentId: string;
+    bucket: string;
+    stackId: string;
+    connectionRef: string;
+    region: string;
+    encryptionKeyRef: string;
+    bindingDigest: string;
+    endpoint?: string | undefined;
+    usePathStyle?: boolean | undefined;
+};
+export declare const hostedProviderSchema: z.ZodEnum<["cloudflare", "railway"]>;
+export declare const hostedResourceKindSchema: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+export declare const hostedArtifactSchema: z.ZodUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"archive">;
+    format: z.ZodLiteral<"tar+gzip">;
+    digest: z.ZodString;
+    source: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "archive";
+    digest: string;
+    source: string;
+    format: "tar+gzip";
+}, {
+    kind: "archive";
+    digest: string;
+    source: string;
+    format: "tar+gzip";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"file">;
+    mediaType: z.ZodString;
+    digest: z.ZodString;
+    source: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "file";
+    digest: string;
+    source: string;
+    mediaType: string;
+}, {
+    kind: "file";
+    digest: string;
+    source: string;
+    mediaType: string;
+}>, z.ZodEffects<z.ZodObject<{
+    kind: z.ZodLiteral<"oci-image">;
+    digest: z.ZodString;
+    identity: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    identity: string;
+    kind: "oci-image";
+    digest: string;
+}, {
+    identity: string;
+    kind: "oci-image";
+    digest: string;
+}>, {
+    identity: string;
+    kind: "oci-image";
+    digest: string;
+}, {
+    identity: string;
+    kind: "oci-image";
+    digest: string;
+}>]>;
+declare const hostedConnectionSnapshotSchema: z.ZodEffects<z.ZodObject<{
+    connectionRef: z.ZodString;
+    nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+}, "strict", z.ZodTypeAny, {
+    connectionRef: string;
+    nonSecretConfig: Record<string, string | number | boolean>;
+}, {
+    connectionRef: string;
+    nonSecretConfig: Record<string, string | number | boolean>;
+}>, {
+    connectionRef: string;
+    nonSecretConfig: Record<string, string | number | boolean>;
+}, {
+    connectionRef: string;
+    nonSecretConfig: Record<string, string | number | boolean>;
+}>;
+export declare const hostedResourceDeclarationSchema: z.ZodObject<{
+    id: z.ZodString;
+    provider: z.ZodEnum<["cloudflare", "railway"]>;
+    kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+    dependsOn: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    parameters: z.ZodDefault<z.ZodRecord<z.ZodUnion<[z.ZodString, z.ZodString]>, z.ZodUnion<[z.ZodObject<{
+        input: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        input: string;
+    }, {
+        input: string;
+    }>, z.ZodObject<{
+        artifact: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        artifact: string;
+    }, {
+        artifact: string;
+    }>, z.ZodObject<{
+        resourceOutput: z.ZodObject<{
+            resourceId: z.ZodString;
+            output: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            resourceId: string;
+            output: string;
+        }, {
+            resourceId: string;
+            output: string;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        resourceOutput: {
+            resourceId: string;
+            output: string;
+        };
+    }, {
+        resourceOutput: {
+            resourceId: string;
+            output: string;
+        };
+    }>, z.ZodObject<{
+        literal: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+    }, "strict", z.ZodTypeAny, {
+        literal: string | number | boolean;
+    }, {
+        literal: string | number | boolean;
+    }>]>>>;
+    adoption: z.ZodObject<{
+        mode: z.ZodLiteral<"adopt-or-create">;
+        externalIdInput: z.ZodOptional<z.ZodString>;
+        replacement: z.ZodLiteral<"forbidden">;
+    }, "strict", z.ZodTypeAny, {
+        mode: "adopt-or-create";
+        replacement: "forbidden";
+        externalIdInput?: string | undefined;
+    }, {
+        mode: "adopt-or-create";
+        replacement: "forbidden";
+        externalIdInput?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+    provider: "cloudflare" | "railway";
+    id: string;
+    dependsOn: string[];
+    parameters: Record<string, {
+        input: string;
+    } | {
+        artifact: string;
+    } | {
+        resourceOutput: {
+            resourceId: string;
+            output: string;
+        };
+    } | {
+        literal: string | number | boolean;
+    }>;
+    adoption: {
+        mode: "adopt-or-create";
+        replacement: "forbidden";
+        externalIdInput?: string | undefined;
+    };
+}, {
+    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+    provider: "cloudflare" | "railway";
+    id: string;
+    adoption: {
+        mode: "adopt-or-create";
+        replacement: "forbidden";
+        externalIdInput?: string | undefined;
+    };
+    dependsOn?: string[] | undefined;
+    parameters?: Record<string, {
+        input: string;
+    } | {
+        artifact: string;
+    } | {
+        resourceOutput: {
+            resourceId: string;
+            output: string;
+        };
+    } | {
+        literal: string | number | boolean;
+    }> | undefined;
+}>;
+export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology/v1">;
+    id: z.ZodString;
+    teamId: z.ZodString;
+    deploymentId: z.ZodString;
+    stackId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    mutation: z.ZodLiteral<"agent-authorized">;
+    platform: z.ZodObject<{
+        repository: z.ZodLiteral<"treeseed-ai/platform">;
+        commit: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        repository: "treeseed-ai/platform";
+        commit: string;
+    }, {
+        repository: "treeseed-ai/platform";
+        commit: string;
+    }>;
+    stateBackend: z.ZodObject<{
+        connectionRef: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        connectionRef: string;
+    }, {
+        connectionRef: string;
+    }>;
+    providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodObject<{
+        connectionRef: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        connectionRef: string;
+    }, {
+        connectionRef: string;
+    }>>;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"archive">;
+        format: z.ZodLiteral<"tar+gzip">;
+        digest: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    }, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"file">;
+        mediaType: z.ZodString;
+        digest: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    }, {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    }>, z.ZodEffects<z.ZodObject<{
+        kind: z.ZodLiteral<"oci-image">;
+        digest: z.ZodString;
+        identity: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>]>>;
+    resources: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        provider: z.ZodEnum<["cloudflare", "railway"]>;
+        kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+        dependsOn: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        parameters: z.ZodDefault<z.ZodRecord<z.ZodUnion<[z.ZodString, z.ZodString]>, z.ZodUnion<[z.ZodObject<{
+            input: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            input: string;
+        }, {
+            input: string;
+        }>, z.ZodObject<{
+            artifact: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            artifact: string;
+        }, {
+            artifact: string;
+        }>, z.ZodObject<{
+            resourceOutput: z.ZodObject<{
+                resourceId: z.ZodString;
+                output: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                resourceId: string;
+                output: string;
+            }, {
+                resourceId: string;
+                output: string;
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            resourceOutput: {
+                resourceId: string;
+                output: string;
+            };
+        }, {
+            resourceOutput: {
+                resourceId: string;
+                output: string;
+            };
+        }>, z.ZodObject<{
+            literal: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+        }, "strict", z.ZodTypeAny, {
+            literal: string | number | boolean;
+        }, {
+            literal: string | number | boolean;
+        }>]>>>;
+        adoption: z.ZodObject<{
+            mode: z.ZodLiteral<"adopt-or-create">;
+            externalIdInput: z.ZodOptional<z.ZodString>;
+            replacement: z.ZodLiteral<"forbidden">;
+        }, "strict", z.ZodTypeAny, {
+            mode: "adopt-or-create";
+            replacement: "forbidden";
+            externalIdInput?: string | undefined;
+        }, {
+            mode: "adopt-or-create";
+            replacement: "forbidden";
+            externalIdInput?: string | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        id: string;
+        dependsOn: string[];
+        parameters: Record<string, {
+            input: string;
+        } | {
+            artifact: string;
+        } | {
+            resourceOutput: {
+                resourceId: string;
+                output: string;
+            };
+        } | {
+            literal: string | number | boolean;
+        }>;
+        adoption: {
+            mode: "adopt-or-create";
+            replacement: "forbidden";
+            externalIdInput?: string | undefined;
+        };
+    }, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        id: string;
+        adoption: {
+            mode: "adopt-or-create";
+            replacement: "forbidden";
+            externalIdInput?: string | undefined;
+        };
+        dependsOn?: string[] | undefined;
+        parameters?: Record<string, {
+            input: string;
+        } | {
+            artifact: string;
+        } | {
+            resourceOutput: {
+                resourceId: string;
+                output: string;
+            };
+        } | {
+            literal: string | number | boolean;
+        }> | undefined;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    schemaVersion: "treeseed.hosted-topology/v1";
+    resources: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        id: string;
+        dependsOn: string[];
+        parameters: Record<string, {
+            input: string;
+        } | {
+            artifact: string;
+        } | {
+            resourceOutput: {
+                resourceId: string;
+                output: string;
+            };
+        } | {
+            literal: string | number | boolean;
+        }>;
+        adoption: {
+            mode: "adopt-or-create";
+            replacement: "forbidden";
+            externalIdInput?: string | undefined;
+        };
+    }[];
+    teamId: string;
+    platform: {
+        repository: "treeseed-ai/platform";
+        commit: string;
+    };
+    mutation: "agent-authorized";
+    environment: "production" | "staging";
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        connectionRef: string;
+    };
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+    }>>;
+}, {
+    id: string;
+    schemaVersion: "treeseed.hosted-topology/v1";
+    resources: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        id: string;
+        adoption: {
+            mode: "adopt-or-create";
+            replacement: "forbidden";
+            externalIdInput?: string | undefined;
+        };
+        dependsOn?: string[] | undefined;
+        parameters?: Record<string, {
+            input: string;
+        } | {
+            artifact: string;
+        } | {
+            resourceOutput: {
+                resourceId: string;
+                output: string;
+            };
+        } | {
+            literal: string | number | boolean;
+        }> | undefined;
+    }[];
+    teamId: string;
+    platform: {
+        repository: "treeseed-ai/platform";
+        commit: string;
+    };
+    mutation: "agent-authorized";
+    environment: "production" | "staging";
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        connectionRef: string;
+    };
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+    }>>;
+}>, {
+    id: string;
+    schemaVersion: "treeseed.hosted-topology/v1";
+    resources: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        id: string;
+        dependsOn: string[];
+        parameters: Record<string, {
+            input: string;
+        } | {
+            artifact: string;
+        } | {
+            resourceOutput: {
+                resourceId: string;
+                output: string;
+            };
+        } | {
+            literal: string | number | boolean;
+        }>;
+        adoption: {
+            mode: "adopt-or-create";
+            replacement: "forbidden";
+            externalIdInput?: string | undefined;
+        };
+    }[];
+    teamId: string;
+    platform: {
+        repository: "treeseed-ai/platform";
+        commit: string;
+    };
+    mutation: "agent-authorized";
+    environment: "production" | "staging";
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        connectionRef: string;
+    };
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+    }>>;
+}, {
+    id: string;
+    schemaVersion: "treeseed.hosted-topology/v1";
+    resources: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        id: string;
+        adoption: {
+            mode: "adopt-or-create";
+            replacement: "forbidden";
+            externalIdInput?: string | undefined;
+        };
+        dependsOn?: string[] | undefined;
+        parameters?: Record<string, {
+            input: string;
+        } | {
+            artifact: string;
+        } | {
+            resourceOutput: {
+                resourceId: string;
+                output: string;
+            };
+        } | {
+            literal: string | number | boolean;
+        }> | undefined;
+    }[];
+    teamId: string;
+    platform: {
+        repository: "treeseed-ai/platform";
+        commit: string;
+    };
+    mutation: "agent-authorized";
+    environment: "production" | "staging";
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        connectionRef: string;
+    };
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+    }>>;
+}>;
+export declare const hostedResourceObservationSchema: z.ZodObject<{
+    resourceId: z.ZodString;
+    provider: z.ZodEnum<["cloudflare", "railway"]>;
+    kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+    providerResourceId: z.ZodNullable<z.ZodString>;
+    state: z.ZodEnum<["missing", "healthy", "degraded"]>;
+    managedBy: z.ZodNullable<z.ZodEnum<["treeseed", "external"]>>;
+    observedDigest: z.ZodNullable<z.ZodString>;
+    observedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+    provider: "cloudflare" | "railway";
+    state: "missing" | "degraded" | "healthy";
+    resourceId: string;
+    providerResourceId: string | null;
+    managedBy: "external" | "treeseed" | null;
+    observedDigest: string | null;
+    observedAt: string;
+}, {
+    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+    provider: "cloudflare" | "railway";
+    state: "missing" | "degraded" | "healthy";
+    resourceId: string;
+    providerResourceId: string | null;
+    managedBy: "external" | "treeseed" | null;
+    observedDigest: string | null;
+    observedAt: string;
+}>;
+export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
+    readonly schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-plan/v1">;
+    readonly planId: z.ZodString;
+    readonly planDigest: z.ZodString;
+    readonly declarationDigest: z.ZodString;
+    readonly topologyId: z.ZodString;
+    readonly teamId: z.ZodString;
+    readonly deploymentId: z.ZodString;
+    readonly stackId: z.ZodString;
+    readonly environment: z.ZodEnum<["staging", "production"]>;
+    readonly platformCommit: z.ZodString;
+    readonly stateBackend: z.ZodNullable<z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"treeseed.hosted-state-backend/v1">;
+        type: z.ZodLiteral<"s3">;
+        teamId: z.ZodString;
+        deploymentId: z.ZodString;
+        environment: z.ZodEnum<["staging", "production"]>;
+        stackId: z.ZodString;
+        connectionRef: z.ZodString;
+        bucket: z.ZodString;
+        key: z.ZodString;
+        region: z.ZodString;
+        endpoint: z.ZodOptional<z.ZodString>;
+        usePathStyle: z.ZodOptional<z.ZodBoolean>;
+        encryptionKeyRef: z.ZodString;
+    } & {
+        bindingDigest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    }, {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    }>, {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    }, {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    }>>;
+    readonly artifacts: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"archive">;
+        format: z.ZodLiteral<"tar+gzip">;
+        digest: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    }, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"file">;
+        mediaType: z.ZodString;
+        digest: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    }, {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    }>, z.ZodEffects<z.ZodObject<{
+        kind: z.ZodLiteral<"oci-image">;
+        digest: z.ZodString;
+        identity: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>]>>;
+    readonly providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodEffects<z.ZodObject<{
+        connectionRef: z.ZodString;
+        nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, "strict", z.ZodTypeAny, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    readonly actions: z.ZodArray<z.ZodObject<{
+        resourceId: z.ZodString;
+        provider: z.ZodEnum<["cloudflare", "railway"]>;
+        kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+        action: z.ZodEnum<["create", "adopt", "update", "noop"]>;
+        desiredResource: z.ZodObject<{
+            id: z.ZodString;
+            provider: z.ZodEnum<["cloudflare", "railway"]>;
+            kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+            dependsOn: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            parameters: z.ZodDefault<z.ZodRecord<z.ZodUnion<[z.ZodString, z.ZodString]>, z.ZodUnion<[z.ZodObject<{
+                input: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                input: string;
+            }, {
+                input: string;
+            }>, z.ZodObject<{
+                artifact: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                artifact: string;
+            }, {
+                artifact: string;
+            }>, z.ZodObject<{
+                resourceOutput: z.ZodObject<{
+                    resourceId: z.ZodString;
+                    output: z.ZodString;
+                }, "strict", z.ZodTypeAny, {
+                    resourceId: string;
+                    output: string;
+                }, {
+                    resourceId: string;
+                    output: string;
+                }>;
+            }, "strict", z.ZodTypeAny, {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            }, {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            }>, z.ZodObject<{
+                literal: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            }, "strict", z.ZodTypeAny, {
+                literal: string | number | boolean;
+            }, {
+                literal: string | number | boolean;
+            }>]>>>;
+            adoption: z.ZodObject<{
+                mode: z.ZodLiteral<"adopt-or-create">;
+                externalIdInput: z.ZodOptional<z.ZodString>;
+                replacement: z.ZodLiteral<"forbidden">;
+            }, "strict", z.ZodTypeAny, {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            }, {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            dependsOn: string[];
+            parameters: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }>;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+        }, {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+            dependsOn?: string[] | undefined;
+            parameters?: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }> | undefined;
+        }>;
+        desiredDigest: z.ZodString;
+        previousDigest: z.ZodNullable<z.ZodString>;
+        providerResourceId: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            dependsOn: string[];
+            parameters: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }>;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+            dependsOn?: string[] | undefined;
+            parameters?: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }> | undefined;
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }>, "many">;
+    readonly blockers: z.ZodArray<z.ZodObject<{
+        code: z.ZodEnum<["connection-unavailable", "state-backend-unavailable", "dependency-cycle", "observation-unhealthy", "adoption-drift"]>;
+        resourceId: z.ZodOptional<z.ZodString>;
+        message: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }, {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }>, "many">;
+    readonly authorization: z.ZodLiteral<"authenticated-agent">;
+    readonly executable: z.ZodLiteral<false>;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.hosted-topology-plan/v1";
+    blockers: {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }[];
+    planDigest: string;
+    actions: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            dependsOn: string[];
+            parameters: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }>;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }[];
+    teamId: string;
+    environment: "production" | "staging";
+    executable: false;
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    planId: string;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    } | null;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    authorization: "authenticated-agent";
+}, {
+    schemaVersion: "treeseed.hosted-topology-plan/v1";
+    blockers: {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }[];
+    planDigest: string;
+    actions: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+            dependsOn?: string[] | undefined;
+            parameters?: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }> | undefined;
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }[];
+    teamId: string;
+    environment: "production" | "staging";
+    executable: false;
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    planId: string;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    } | null;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    authorization: "authenticated-agent";
+}>, {
+    schemaVersion: "treeseed.hosted-topology-plan/v1";
+    blockers: {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }[];
+    planDigest: string;
+    actions: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            dependsOn: string[];
+            parameters: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }>;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }[];
+    teamId: string;
+    environment: "production" | "staging";
+    executable: false;
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    planId: string;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    } | null;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    authorization: "authenticated-agent";
+}, {
+    schemaVersion: "treeseed.hosted-topology-plan/v1";
+    blockers: {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }[];
+    planDigest: string;
+    actions: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+            dependsOn?: string[] | undefined;
+            parameters?: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }> | undefined;
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }[];
+    teamId: string;
+    environment: "production" | "staging";
+    executable: false;
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    planId: string;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    } | null;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    authorization: "authenticated-agent";
+}>;
+export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
+    executable: z.ZodLiteral<true>;
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-plan/v1">;
+    planId: z.ZodString;
+    planDigest: z.ZodString;
+    declarationDigest: z.ZodString;
+    topologyId: z.ZodString;
+    teamId: z.ZodString;
+    deploymentId: z.ZodString;
+    stackId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    platformCommit: z.ZodString;
+    stateBackend: z.ZodNullable<z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"treeseed.hosted-state-backend/v1">;
+        type: z.ZodLiteral<"s3">;
+        teamId: z.ZodString;
+        deploymentId: z.ZodString;
+        environment: z.ZodEnum<["staging", "production"]>;
+        stackId: z.ZodString;
+        connectionRef: z.ZodString;
+        bucket: z.ZodString;
+        key: z.ZodString;
+        region: z.ZodString;
+        endpoint: z.ZodOptional<z.ZodString>;
+        usePathStyle: z.ZodOptional<z.ZodBoolean>;
+        encryptionKeyRef: z.ZodString;
+    } & {
+        bindingDigest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    }, {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    }>, {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    }, {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    }>>;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"archive">;
+        format: z.ZodLiteral<"tar+gzip">;
+        digest: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    }, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"file">;
+        mediaType: z.ZodString;
+        digest: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    }, {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    }>, z.ZodEffects<z.ZodObject<{
+        kind: z.ZodLiteral<"oci-image">;
+        digest: z.ZodString;
+        identity: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }, {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>]>>;
+    providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodEffects<z.ZodObject<{
+        connectionRef: z.ZodString;
+        nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, "strict", z.ZodTypeAny, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    actions: z.ZodArray<z.ZodObject<{
+        resourceId: z.ZodString;
+        provider: z.ZodEnum<["cloudflare", "railway"]>;
+        kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+        action: z.ZodEnum<["create", "adopt", "update", "noop"]>;
+        desiredResource: z.ZodObject<{
+            id: z.ZodString;
+            provider: z.ZodEnum<["cloudflare", "railway"]>;
+            kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+            dependsOn: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            parameters: z.ZodDefault<z.ZodRecord<z.ZodUnion<[z.ZodString, z.ZodString]>, z.ZodUnion<[z.ZodObject<{
+                input: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                input: string;
+            }, {
+                input: string;
+            }>, z.ZodObject<{
+                artifact: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                artifact: string;
+            }, {
+                artifact: string;
+            }>, z.ZodObject<{
+                resourceOutput: z.ZodObject<{
+                    resourceId: z.ZodString;
+                    output: z.ZodString;
+                }, "strict", z.ZodTypeAny, {
+                    resourceId: string;
+                    output: string;
+                }, {
+                    resourceId: string;
+                    output: string;
+                }>;
+            }, "strict", z.ZodTypeAny, {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            }, {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            }>, z.ZodObject<{
+                literal: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            }, "strict", z.ZodTypeAny, {
+                literal: string | number | boolean;
+            }, {
+                literal: string | number | boolean;
+            }>]>>>;
+            adoption: z.ZodObject<{
+                mode: z.ZodLiteral<"adopt-or-create">;
+                externalIdInput: z.ZodOptional<z.ZodString>;
+                replacement: z.ZodLiteral<"forbidden">;
+            }, "strict", z.ZodTypeAny, {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            }, {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            dependsOn: string[];
+            parameters: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }>;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+        }, {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+            dependsOn?: string[] | undefined;
+            parameters?: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }> | undefined;
+        }>;
+        desiredDigest: z.ZodString;
+        previousDigest: z.ZodNullable<z.ZodString>;
+        providerResourceId: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            dependsOn: string[];
+            parameters: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }>;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+            dependsOn?: string[] | undefined;
+            parameters?: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }> | undefined;
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }>, "many">;
+    blockers: z.ZodArray<z.ZodObject<{
+        code: z.ZodEnum<["connection-unavailable", "state-backend-unavailable", "dependency-cycle", "observation-unhealthy", "adoption-drift"]>;
+        resourceId: z.ZodOptional<z.ZodString>;
+        message: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }, {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }>, "many">;
+    authorization: z.ZodLiteral<"authenticated-agent">;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.hosted-topology-plan/v1";
+    blockers: {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }[];
+    planDigest: string;
+    actions: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            dependsOn: string[];
+            parameters: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }>;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }[];
+    teamId: string;
+    environment: "production" | "staging";
+    executable: true;
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    planId: string;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    } | null;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    authorization: "authenticated-agent";
+}, {
+    schemaVersion: "treeseed.hosted-topology-plan/v1";
+    blockers: {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }[];
+    planDigest: string;
+    actions: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+            dependsOn?: string[] | undefined;
+            parameters?: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }> | undefined;
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }[];
+    teamId: string;
+    environment: "production" | "staging";
+    executable: true;
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    planId: string;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    } | null;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    authorization: "authenticated-agent";
+}>, {
+    schemaVersion: "treeseed.hosted-topology-plan/v1";
+    blockers: {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }[];
+    planDigest: string;
+    actions: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            dependsOn: string[];
+            parameters: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }>;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }[];
+    teamId: string;
+    environment: "production" | "staging";
+    executable: true;
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    planId: string;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    } | null;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    authorization: "authenticated-agent";
+}, {
+    schemaVersion: "treeseed.hosted-topology-plan/v1";
+    blockers: {
+        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+        message: string;
+        resourceId?: string | undefined;
+    }[];
+    planDigest: string;
+    actions: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        action: "noop" | "create" | "adopt" | "update";
+        resourceId: string;
+        providerResourceId: string | null;
+        desiredResource: {
+            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            id: string;
+            adoption: {
+                mode: "adopt-or-create";
+                replacement: "forbidden";
+                externalIdInput?: string | undefined;
+            };
+            dependsOn?: string[] | undefined;
+            parameters?: Record<string, {
+                input: string;
+            } | {
+                artifact: string;
+            } | {
+                resourceOutput: {
+                    resourceId: string;
+                    output: string;
+                };
+            } | {
+                literal: string | number | boolean;
+            }> | undefined;
+        };
+        desiredDigest: string;
+        previousDigest: string | null;
+    }[];
+    teamId: string;
+    environment: "production" | "staging";
+    executable: true;
+    artifacts: Record<string, {
+        kind: "archive";
+        digest: string;
+        source: string;
+        format: "tar+gzip";
+    } | {
+        kind: "file";
+        digest: string;
+        source: string;
+        mediaType: string;
+    } | {
+        identity: string;
+        kind: "oci-image";
+        digest: string;
+    }>;
+    planId: string;
+    deploymentId: string;
+    stackId: string;
+    stateBackend: {
+        type: "s3";
+        schemaVersion: "treeseed.hosted-state-backend/v1";
+        key: string;
+        teamId: string;
+        environment: "production" | "staging";
+        deploymentId: string;
+        bucket: string;
+        stackId: string;
+        connectionRef: string;
+        region: string;
+        encryptionKeyRef: string;
+        bindingDigest: string;
+        endpoint?: string | undefined;
+        usePathStyle?: boolean | undefined;
+    } | null;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    authorization: "authenticated-agent";
+}>;
+export declare const hostedTopologyReceiptSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-receipt/v1">;
+    receiptId: z.ZodString;
+    planDigest: z.ZodString;
+    declarationDigest: z.ZodString;
+    topologyId: z.ZodString;
+    teamId: z.ZodString;
+    deploymentId: z.ZodString;
+    stackId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    backendBindingDigest: z.ZodString;
+    platformCommit: z.ZodString;
+    resources: z.ZodArray<z.ZodObject<{
+        resourceId: z.ZodString;
+        provider: z.ZodEnum<["cloudflare", "railway"]>;
+        kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+        providerResourceId: z.ZodNullable<z.ZodString>;
+        state: z.ZodEnum<["missing", "healthy", "degraded"]>;
+        managedBy: z.ZodNullable<z.ZodEnum<["treeseed", "external"]>>;
+        observedDigest: z.ZodNullable<z.ZodString>;
+        observedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        state: "missing" | "degraded" | "healthy";
+        resourceId: string;
+        providerResourceId: string | null;
+        managedBy: "external" | "treeseed" | null;
+        observedDigest: string | null;
+        observedAt: string;
+    }, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        state: "missing" | "degraded" | "healthy";
+        resourceId: string;
+        providerResourceId: string | null;
+        managedBy: "external" | "treeseed" | null;
+        observedDigest: string | null;
+        observedAt: string;
+    }>, "many">;
+    previousResources: z.ZodArray<z.ZodObject<{
+        resourceId: z.ZodString;
+        provider: z.ZodEnum<["cloudflare", "railway"]>;
+        kind: z.ZodEnum<["admin-application", "pages-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+        providerResourceId: z.ZodNullable<z.ZodString>;
+        state: z.ZodEnum<["missing", "healthy", "degraded"]>;
+        managedBy: z.ZodNullable<z.ZodEnum<["treeseed", "external"]>>;
+        observedDigest: z.ZodNullable<z.ZodString>;
+        observedAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        state: "missing" | "degraded" | "healthy";
+        resourceId: string;
+        providerResourceId: string | null;
+        managedBy: "external" | "treeseed" | null;
+        observedDigest: string | null;
+        observedAt: string;
+    }, {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        state: "missing" | "degraded" | "healthy";
+        resourceId: string;
+        providerResourceId: string | null;
+        managedBy: "external" | "treeseed" | null;
+        observedDigest: string | null;
+        observedAt: string;
+    }>, "many">;
+    state: z.ZodLiteral<"known-good">;
+    completedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    state: "known-good";
+    schemaVersion: "treeseed.hosted-topology-receipt/v1";
+    resources: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        state: "missing" | "degraded" | "healthy";
+        resourceId: string;
+        providerResourceId: string | null;
+        managedBy: "external" | "treeseed" | null;
+        observedDigest: string | null;
+        observedAt: string;
+    }[];
+    planDigest: string;
+    teamId: string;
+    environment: "production" | "staging";
+    completedAt: string;
+    receiptId: string;
+    deploymentId: string;
+    stackId: string;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    backendBindingDigest: string;
+    previousResources: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        state: "missing" | "degraded" | "healthy";
+        resourceId: string;
+        providerResourceId: string | null;
+        managedBy: "external" | "treeseed" | null;
+        observedDigest: string | null;
+        observedAt: string;
+    }[];
+}, {
+    state: "known-good";
+    schemaVersion: "treeseed.hosted-topology-receipt/v1";
+    resources: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        state: "missing" | "degraded" | "healthy";
+        resourceId: string;
+        providerResourceId: string | null;
+        managedBy: "external" | "treeseed" | null;
+        observedDigest: string | null;
+        observedAt: string;
+    }[];
+    planDigest: string;
+    teamId: string;
+    environment: "production" | "staging";
+    completedAt: string;
+    receiptId: string;
+    deploymentId: string;
+    stackId: string;
+    declarationDigest: string;
+    topologyId: string;
+    platformCommit: string;
+    backendBindingDigest: string;
+    previousResources: {
+        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+        provider: "cloudflare" | "railway";
+        state: "missing" | "degraded" | "healthy";
+        resourceId: string;
+        providerResourceId: string | null;
+        managedBy: "external" | "treeseed" | null;
+        observedDigest: string | null;
+        observedAt: string;
+    }[];
+}>;
+export declare const hostedTopologyRollbackSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback/v1">;
+    rollbackId: z.ZodString;
+    sourceReceiptId: z.ZodString;
+    teamId: z.ZodString;
+    deploymentId: z.ZodString;
+    stackId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    backendBindingDigest: z.ZodString;
+    operations: z.ZodArray<z.ZodObject<{
+        resourceId: z.ZodString;
+        action: z.ZodEnum<["restore", "delete-created", "noop"]>;
+        providerResourceId: z.ZodString;
+        targetDigest: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }, {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }>, "many">;
+    rollbackDigest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.hosted-topology-rollback/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    operations: {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }[];
+    deploymentId: string;
+    stackId: string;
+    backendBindingDigest: string;
+    rollbackId: string;
+    sourceReceiptId: string;
+    rollbackDigest: string;
+}, {
+    schemaVersion: "treeseed.hosted-topology-rollback/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    operations: {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }[];
+    deploymentId: string;
+    stackId: string;
+    backendBindingDigest: string;
+    rollbackId: string;
+    sourceReceiptId: string;
+    rollbackDigest: string;
+}>, {
+    schemaVersion: "treeseed.hosted-topology-rollback/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    operations: {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }[];
+    deploymentId: string;
+    stackId: string;
+    backendBindingDigest: string;
+    rollbackId: string;
+    sourceReceiptId: string;
+    rollbackDigest: string;
+}, {
+    schemaVersion: "treeseed.hosted-topology-rollback/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    operations: {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }[];
+    deploymentId: string;
+    stackId: string;
+    backendBindingDigest: string;
+    rollbackId: string;
+    sourceReceiptId: string;
+    rollbackDigest: string;
+}>;
+export declare const hostedTopologyRollbackExecutionSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback-execution/v1">;
+    rollback: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback/v1">;
+        rollbackId: z.ZodString;
+        sourceReceiptId: z.ZodString;
+        teamId: z.ZodString;
+        deploymentId: z.ZodString;
+        stackId: z.ZodString;
+        environment: z.ZodEnum<["staging", "production"]>;
+        backendBindingDigest: z.ZodString;
+        operations: z.ZodArray<z.ZodObject<{
+            resourceId: z.ZodString;
+            action: z.ZodEnum<["restore", "delete-created", "noop"]>;
+            providerResourceId: z.ZodString;
+            targetDigest: z.ZodNullable<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }, {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }>, "many">;
+        rollbackDigest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    }, {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    }>, {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    }, {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    }>;
+    sourceReceiptId: z.ZodString;
+    topologyId: z.ZodString;
+    teamId: z.ZodString;
+    deploymentId: z.ZodString;
+    stackId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    backendBindingDigest: z.ZodString;
+    sourcePlanDigest: z.ZodString;
+    targetPlanDigest: z.ZodString;
+    executionDigest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    deploymentId: string;
+    stackId: string;
+    topologyId: string;
+    backendBindingDigest: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+}, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    deploymentId: string;
+    stackId: string;
+    topologyId: string;
+    backendBindingDigest: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+}>, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    deploymentId: string;
+    stackId: string;
+    topologyId: string;
+    backendBindingDigest: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+}, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    deploymentId: string;
+    stackId: string;
+    topologyId: string;
+    backendBindingDigest: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+}>;
+export type HostedTopologyDeclaration = z.infer<typeof hostedTopologyDeclarationSchema>;
+export type HostedStateBackend = z.infer<typeof hostedStateBackendSchema>;
+export type HostedResourceObservation = z.infer<typeof hostedResourceObservationSchema>;
+export type HostedTopologyPlan = z.infer<typeof hostedTopologyPlanSchema>;
+export type AuthorizedHostedTopologyPlan = z.infer<typeof authorizedHostedTopologyPlanSchema>;
+export type HostedTopologyReceipt = z.infer<typeof hostedTopologyReceiptSchema>;
+export type HostedTopologyRollbackExecution = z.infer<typeof hostedTopologyRollbackExecutionSchema>;
+export declare function planHostedTopology(input: {
+    declaration: HostedTopologyDeclaration;
+    observations: HostedResourceObservation[];
+    connections: Partial<Record<z.infer<typeof hostedProviderSchema>, z.input<typeof hostedConnectionSnapshotSchema>>>;
+    stateBackend?: z.input<typeof hostedStateBackendSchema>;
+}): HostedTopologyPlan;
+export declare function authorizeHostedTopologyPlan(planInput: HostedTopologyPlan): AuthorizedHostedTopologyPlan;
+export declare function verifyHostedTopologyReadback(input: {
+    plan: AuthorizedHostedTopologyPlan;
+    previousResources: HostedResourceObservation[];
+    resources: HostedResourceObservation[];
+    completedAt: string;
+}): HostedTopologyReceipt;
+export declare function planHostedTopologyRollback(receiptInput: HostedTopologyReceipt): {
+    schemaVersion: "treeseed.hosted-topology-rollback/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    operations: {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }[];
+    deploymentId: string;
+    stackId: string;
+    backendBindingDigest: string;
+    rollbackId: string;
+    sourceReceiptId: string;
+    rollbackDigest: string;
+};
+export declare function authorizeHostedTopologyRollback(rollbackInput: z.input<typeof hostedTopologyRollbackSchema>): {
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+};
+export declare function planHostedTopologyRollbackExecution(input: {
+    rollback: z.input<typeof hostedTopologyRollbackSchema>;
+    sourceReceipt: z.input<typeof hostedTopologyReceiptSchema>;
+    sourcePlan: z.input<typeof hostedTopologyPlanSchema> | z.input<typeof authorizedHostedTopologyPlanSchema>;
+    targetPlan: z.input<typeof hostedTopologyPlanSchema>;
+}): {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    teamId: string;
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    deploymentId: string;
+    stackId: string;
+    topologyId: string;
+    backendBindingDigest: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+};
+export declare function authorizeHostedTopologyRollbackExecution(executionInput: z.input<typeof hostedTopologyRollbackExecutionSchema>): {
+    execution: {
+        schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        rollback: {
+            schemaVersion: "treeseed.hosted-topology-rollback/v1";
+            teamId: string;
+            environment: "production" | "staging";
+            operations: {
+                action: "noop" | "restore" | "delete-created";
+                resourceId: string;
+                providerResourceId: string;
+                targetDigest: string | null;
+            }[];
+            deploymentId: string;
+            stackId: string;
+            backendBindingDigest: string;
+            rollbackId: string;
+            sourceReceiptId: string;
+            rollbackDigest: string;
+        };
+        deploymentId: string;
+        stackId: string;
+        topologyId: string;
+        backendBindingDigest: string;
+        sourceReceiptId: string;
+        sourcePlanDigest: string;
+        targetPlanDigest: string;
+        executionDigest: string;
+    };
+};
+export {};