@vibesdotdev/integrations-digitalocean 0.0.0-stage → 1.0.0-rc.1

package/dist/schemas/credential-use.d.ts

@@ -0,0 +1,714 @@
+import * as z from 'zod/v4';
+import type { RuntimeClient } from '@vibesdotdev/kernel/client';
+import { CredentialCandidatesSchema } from '@vibesdotdev/secrets/schemas';
+import { type DigitalOceanCredentialUseOutcome, type DigitalOceanSpacesCredentialUseOutcome } from './control-plane.ts';
+export declare const DigitalOceanAuthenticatedRequestOptionsSchema: z.ZodObject<{
+    method: z.ZodDefault<z.ZodEnum<{
+        PUT: "PUT";
+        PATCH: "PATCH";
+        POST: "POST";
+        DELETE: "DELETE";
+        GET: "GET";
+    }>>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    body: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<ReadableStream<Uint8Array<ArrayBufferLike>>>, z.ZodInstanceOf<Blob>, z.ZodInstanceOf<FormData>, z.ZodInstanceOf<URLSearchParams>, z.ZodInstanceOf<ArrayBuffer>, z.ZodCustom<ArrayBufferView<ArrayBuffer>, ArrayBufferView<ArrayBuffer>>]>>;
+    credentialBindings: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"header">;
+        candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">, z.ZodObject<{
+            source: z.ZodLiteral<"oauth-account">;
+            providerId: z.ZodString;
+            token: z.ZodDefault<z.ZodEnum<{
+                accessToken: "accessToken";
+                refreshToken: "refreshToken";
+            }>>;
+        }, z.core.$strict>]>>;
+        header: z.ZodString;
+        prefix: z.ZodDefault<z.ZodString>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"basic-auth">;
+        username: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">, z.ZodObject<{
+            source: z.ZodLiteral<"oauth-account">;
+            providerId: z.ZodString;
+            token: z.ZodDefault<z.ZodEnum<{
+                accessToken: "accessToken";
+                refreshToken: "refreshToken";
+            }>>;
+        }, z.core.$strict>]>>;
+        password: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">, z.ZodObject<{
+            source: z.ZodLiteral<"oauth-account">;
+            providerId: z.ZodString;
+            token: z.ZodDefault<z.ZodEnum<{
+                accessToken: "accessToken";
+                refreshToken: "refreshToken";
+            }>>;
+        }, z.core.$strict>]>>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"json-field">;
+        candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">, z.ZodObject<{
+            source: z.ZodLiteral<"oauth-account">;
+            providerId: z.ZodString;
+            token: z.ZodDefault<z.ZodEnum<{
+                accessToken: "accessToken";
+                refreshToken: "refreshToken";
+            }>>;
+        }, z.core.$strict>]>>;
+        path: z.ZodArray<z.ZodString>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"form-field">;
+        candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">, z.ZodObject<{
+            source: z.ZodLiteral<"oauth-account">;
+            providerId: z.ZodString;
+            token: z.ZodDefault<z.ZodEnum<{
+                accessToken: "accessToken";
+                refreshToken: "refreshToken";
+            }>>;
+        }, z.core.$strict>]>>;
+        field: z.ZodString;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"path-segment">;
+        candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">, z.ZodObject<{
+            source: z.ZodLiteral<"oauth-account">;
+            providerId: z.ZodString;
+            token: z.ZodDefault<z.ZodEnum<{
+                accessToken: "accessToken";
+                refreshToken: "refreshToken";
+            }>>;
+        }, z.core.$strict>]>>;
+        name: z.ZodString;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"oauth-client-credentials">;
+        tokenEndpoint: z.ZodURL;
+        tokenEndpointBindings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            kind: z.ZodLiteral<"path-segment">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            name: z.ZodString;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>>;
+        clientId: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">, z.ZodObject<{
+            source: z.ZodLiteral<"oauth-account">;
+            providerId: z.ZodString;
+            token: z.ZodDefault<z.ZodEnum<{
+                accessToken: "accessToken";
+                refreshToken: "refreshToken";
+            }>>;
+        }, z.core.$strict>]>>;
+        clientSecret: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">, z.ZodObject<{
+            source: z.ZodLiteral<"oauth-account">;
+            providerId: z.ZodString;
+            token: z.ZodDefault<z.ZodEnum<{
+                accessToken: "accessToken";
+                refreshToken: "refreshToken";
+            }>>;
+        }, z.core.$strict>]>>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>], "kind">>>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+    bodyTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    maxRedirects: z.ZodDefault<z.ZodNumber>;
+    joinRuntimeLifecycle: z.ZodDefault<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export type DigitalOceanAuthenticatedRequestOptions = z.infer<typeof DigitalOceanAuthenticatedRequestOptionsSchema>;
+/**
+ * An ordered provider request. Candidate values never cross this boundary.
+ *
+ * `candidates` are complete references in the order to try; the factory selects
+ * one and hands it to the Secrets transport as a binding, so resolution,
+ * placement and sending all stay with the owner. `operation` is the context a
+ * guarded store issued for the caller: the factory forwards it to the transport,
+ * which hands it to the store it reads, so a backend that bootstraps its own
+ * authority through that same store receives `store-recursion` instead of a
+ * fresh resolution root that could await its own pending connection.
+ */
+export declare const DigitalOceanCredentialUseRequestSchema: z.ZodObject<{
+    url: z.ZodURL;
+    options: z.ZodObject<{
+        method: z.ZodDefault<z.ZodEnum<{
+            PUT: "PUT";
+            PATCH: "PATCH";
+            POST: "POST";
+            DELETE: "DELETE";
+            GET: "GET";
+        }>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        body: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<ReadableStream<Uint8Array<ArrayBufferLike>>>, z.ZodInstanceOf<Blob>, z.ZodInstanceOf<FormData>, z.ZodInstanceOf<URLSearchParams>, z.ZodInstanceOf<ArrayBuffer>, z.ZodCustom<ArrayBufferView<ArrayBuffer>, ArrayBufferView<ArrayBuffer>>]>>;
+        credentialBindings: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"header">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            header: z.ZodString;
+            prefix: z.ZodDefault<z.ZodString>;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"basic-auth">;
+            username: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            password: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"json-field">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            path: z.ZodArray<z.ZodString>;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"form-field">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            field: z.ZodString;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"path-segment">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            name: z.ZodString;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"oauth-client-credentials">;
+            tokenEndpoint: z.ZodURL;
+            tokenEndpointBindings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                kind: z.ZodLiteral<"path-segment">;
+                candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    source: z.ZodLiteral<"secret">;
+                    key: z.ZodString;
+                    store: z.ZodOptional<z.ZodString>;
+                    operation: z.ZodOptional<z.ZodCustom<object, object>>;
+                }, z.core.$strict>], "source">, z.ZodObject<{
+                    source: z.ZodLiteral<"oauth-account">;
+                    providerId: z.ZodString;
+                    token: z.ZodDefault<z.ZodEnum<{
+                        accessToken: "accessToken";
+                        refreshToken: "refreshToken";
+                    }>>;
+                }, z.core.$strict>]>>;
+                name: z.ZodString;
+                required: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            clientId: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            clientSecret: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>], "kind">>>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        bodyTimeoutMs: z.ZodDefault<z.ZodNumber>;
+        maxRedirects: z.ZodDefault<z.ZodNumber>;
+        joinRuntimeLifecycle: z.ZodDefault<z.ZodLiteral<true>>;
+    }, z.core.$strict>;
+    signal: z.ZodOptional<z.ZodInstanceOf<AbortSignal>>;
+    candidates: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodCustom<readonly {
+        reference: {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        };
+        kind: "vibes-system" | "user-token" | "user-api-token" | "user-api-key" | "explicit";
+    }[], readonly {
+        reference: {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        };
+        kind: "vibes-system" | "user-token" | "user-api-token" | "user-api-key" | "explicit";
+    }[]>, z.ZodArray<z.ZodObject<{
+        reference: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">;
+        kind: z.ZodEnum<{
+            "vibes-system": "vibes-system";
+            "user-token": "user-token";
+            "user-api-token": "user-api-token";
+            "user-api-key": "user-api-key";
+            explicit: "explicit";
+        }>;
+    }, z.core.$strict>>>, z.ZodTransform<readonly {
+        reference: {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        };
+        kind: "vibes-system" | "user-token" | "user-api-token" | "user-api-key" | "explicit";
+    }[], {
+        reference: {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        };
+        kind: "vibes-system" | "user-token" | "user-api-token" | "user-api-key" | "explicit";
+    }[]>>>;
+    operation: z.ZodOptional<z.ZodCustom<Readonly<{
+        [x: string]: string | number | boolean | null | undefined;
+        traceId?: string | undefined;
+    }>, Readonly<{
+        [x: string]: string | number | boolean | null | undefined;
+        traceId?: string | undefined;
+    }>>>;
+}, z.core.$strict>;
+export type DigitalOceanCredentialUseRequest = z.input<typeof DigitalOceanCredentialUseRequestSchema>;
+/** Safe account of which complete reference authenticated a request. */
+export declare const DigitalOceanCredentialProvenanceSchema: z.ZodObject<{
+    reference: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">;
+    kind: z.ZodEnum<{
+        "vibes-system": "vibes-system";
+        "user-token": "user-token";
+        "user-api-token": "user-api-token";
+        "user-api-key": "user-api-key";
+        explicit: "explicit";
+    }>;
+}, z.core.$strict>;
+export type DigitalOceanCredentialProvenance = z.infer<typeof DigitalOceanCredentialProvenanceSchema>;
+export declare const DigitalOceanModelAuthenticatedRequestSchema: z.ZodObject<{
+    operation: z.ZodOptional<z.ZodCustom<Readonly<{
+        [x: string]: string | number | boolean | null | undefined;
+        traceId?: string | undefined;
+    }>, Readonly<{
+        [x: string]: string | number | boolean | null | undefined;
+        traceId?: string | undefined;
+    }>>>;
+    url: z.ZodURL;
+    options: z.ZodObject<{
+        method: z.ZodDefault<z.ZodEnum<{
+            PUT: "PUT";
+            PATCH: "PATCH";
+            POST: "POST";
+            DELETE: "DELETE";
+            GET: "GET";
+        }>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        body: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<ReadableStream<Uint8Array<ArrayBufferLike>>>, z.ZodInstanceOf<Blob>, z.ZodInstanceOf<FormData>, z.ZodInstanceOf<URLSearchParams>, z.ZodInstanceOf<ArrayBuffer>, z.ZodCustom<ArrayBufferView<ArrayBuffer>, ArrayBufferView<ArrayBuffer>>]>>;
+        credentialBindings: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"header">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            header: z.ZodString;
+            prefix: z.ZodDefault<z.ZodString>;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"basic-auth">;
+            username: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            password: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"json-field">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            path: z.ZodArray<z.ZodString>;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"form-field">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            field: z.ZodString;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"path-segment">;
+            candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            name: z.ZodString;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"oauth-client-credentials">;
+            tokenEndpoint: z.ZodURL;
+            tokenEndpointBindings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                kind: z.ZodLiteral<"path-segment">;
+                candidates: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    source: z.ZodLiteral<"secret">;
+                    key: z.ZodString;
+                    store: z.ZodOptional<z.ZodString>;
+                    operation: z.ZodOptional<z.ZodCustom<object, object>>;
+                }, z.core.$strict>], "source">, z.ZodObject<{
+                    source: z.ZodLiteral<"oauth-account">;
+                    providerId: z.ZodString;
+                    token: z.ZodDefault<z.ZodEnum<{
+                        accessToken: "accessToken";
+                        refreshToken: "refreshToken";
+                    }>>;
+                }, z.core.$strict>]>>;
+                name: z.ZodString;
+                required: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            clientId: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            clientSecret: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<"secret">;
+                key: z.ZodString;
+                store: z.ZodOptional<z.ZodString>;
+                operation: z.ZodOptional<z.ZodCustom<object, object>>;
+            }, z.core.$strict>], "source">, z.ZodObject<{
+                source: z.ZodLiteral<"oauth-account">;
+                providerId: z.ZodString;
+                token: z.ZodDefault<z.ZodEnum<{
+                    accessToken: "accessToken";
+                    refreshToken: "refreshToken";
+                }>>;
+            }, z.core.$strict>]>>;
+            scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>], "kind">>>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        bodyTimeoutMs: z.ZodDefault<z.ZodNumber>;
+        maxRedirects: z.ZodDefault<z.ZodNumber>;
+        joinRuntimeLifecycle: z.ZodDefault<z.ZodLiteral<true>>;
+    }, z.core.$strict>;
+    signal: z.ZodOptional<z.ZodInstanceOf<AbortSignal>>;
+}, z.core.$strict>;
+export type DigitalOceanModelAuthenticatedRequest = z.input<typeof DigitalOceanModelAuthenticatedRequestSchema>;
+export declare const DigitalOceanModelCredentialProvenanceSchema: z.ZodObject<{
+    reference: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">;
+    kind: z.ZodLiteral<"model-access-key">;
+}, z.core.$strict>;
+export type DigitalOceanModelCredentialProvenance = z.infer<typeof DigitalOceanModelCredentialProvenanceSchema>;
+/**
+ * Ordered references for a non-token credential availability check. This
+ * reports presence only; it does not sign, authenticate, or execute a request.
+ */
+export declare const DigitalOceanCredentialUseReadSchema: z.ZodObject<{
+    candidates: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodCustom<readonly {
+        source: "secret";
+        key: string;
+        store?: string | undefined;
+        operation?: object | undefined;
+    }[], readonly {
+        source: "secret";
+        key: string;
+        store?: string | undefined;
+        operation?: object | undefined;
+    }[]>, z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>>, z.ZodTransform<readonly {
+        source: "secret";
+        key: string;
+        store?: string | undefined;
+        operation?: object | undefined;
+    }[], {
+        source: "secret";
+        key: string;
+        store?: string | undefined;
+        operation?: object | undefined;
+    }[]>>>;
+}, z.core.$strict>;
+export type DigitalOceanCredentialUseRead = z.input<typeof DigitalOceanCredentialUseReadSchema>;
+export declare const DigitalOceanSpacesCredentialUseRequestSchema: z.ZodObject<{
+    accessKeyId: z.ZodObject<{
+        candidates: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodCustom<readonly {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        }[], readonly {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        }[]>, z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">>>, z.ZodTransform<readonly {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        }[], {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        }[]>>>;
+    }, z.core.$strict>;
+    secretAccessKey: z.ZodObject<{
+        candidates: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodCustom<readonly {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        }[], readonly {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        }[]>, z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">>>, z.ZodTransform<readonly {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        }[], {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        }[]>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type DigitalOceanSpacesCredentialUseRequest = z.input<typeof DigitalOceanSpacesCredentialUseRequestSchema>;
+/**
+ * The credential-use surface: authenticated transport plus the non-token
+ * credential reads the package supports. Each returns safe outcomes — the
+ * selected reference and where it answered — never a resolved value.
+ */
+export interface DigitalOceanCredentialUseClient extends RuntimeClient {
+    sendAuthenticatedRequest(input: DigitalOceanCredentialUseRequest): Promise<{
+        response: Response;
+        provenance: DigitalOceanCredentialProvenance | undefined;
+    }>;
+    sendModelAuthenticatedRequest(input: DigitalOceanModelAuthenticatedRequest): Promise<{
+        response: Response;
+        provenance: DigitalOceanModelCredentialProvenance;
+    }>;
+    /** Read one credential through its ordered references; only provenance returns. */
+    useCredential(input: DigitalOceanCredentialUseRead): Promise<DigitalOceanCredentialUseOutcome>;
+    /** Read a Spaces key pair; each half reports its own selected reference. */
+    useSpacesCredentials(input: DigitalOceanSpacesCredentialUseRequest): Promise<DigitalOceanSpacesCredentialUseOutcome>;
+}
+/** Re-exported so a caller can name the candidate contract without the owner subpath. */
+export { CredentialCandidatesSchema };
+//# sourceMappingURL=credential-use.d.ts.map