@whooshbang/contracts 1.0.0-rc.19 → 1.0.0-rc.21

package/dist/generated/whooshbang-v1.d.ts

@@ -5,7 +5,7 @@
 /**
  * Public request, resource, summary, and Problem Details models for the WhooshBang V1 REST API.
  */
-export type WhooshBangV1ContractDocument = AccountProjection | CreateProjectRequest | Project | ProjectCollection | RecipientCopyOverrideCollection | UpdateRecipientCopyOverrideRequest | CreateApiCredentialRequest | RotateApiCredentialRequest | ApiCredential | ApiCredentialCollection | ApiCredentialSecretReveal | ApiCredentialRotation | CreateCustomerEndpointRequest | CustomerEndpoint | CustomerEndpointCollection | CustomerEndpointMutationResult | CustomerEndpointAttemptCollection | CustomerEndpointVerificationChallenge | CreateSubscriptionLinkRequest | SubscriptionLink | CreateMessageRequest | Message | Problem | IdempotencyKey | ProviderCapabilitiesCollection | ConnectionProviderCollection | ChannelConnection | ChannelConnectionCollection | CreateChannelConnectionRequest | UpdateChannelConnectionRequest | RotateChannelConnectionCredentialRequest | NotifierConnectionCollection | AttachNotifierConnectionRequest | ProjectRecipientExperience | UpdateProjectRecipientExperienceRequest | RecipientBrandLogoUpload | NotificationImageAsset | EnvironmentRecipientExperience | UpdateEnvironmentRecipientExperienceRequest | CreateRecipientSessionRequest | CreateRecipientSessionResponse | RecipientSession | CreateProviderHandoffRequest | ProviderHandoff | RecipientHandoffCompletion | SetPreferredBindingRequest | PreferredBinding1 | CreateSubscriberRequest | Subscriber | CreateRecipientGroupRequest | RecipientGroup | RecipientGroupCollection | RecipientGroupMembership | RecipientGroupMembershipCollection | CreateGroupBroadcastRequest | GroupBroadcast;
+export type WhooshBangV1ContractDocument = AccountProjection | CreateProjectRequest | Project | ProjectCollection | RecipientCopyOverrideCollection | UpdateRecipientCopyOverrideRequest | CreateApiCredentialRequest | RotateApiCredentialRequest | ApiCredential | ApiCredentialCollection | ApiCredentialSecretReveal | ApiCredentialRotation | CreateAccountCredentialRequest | RotateAccountCredentialRequest | AccountCredential | AccountCredentialCollection | AccountCredentialSecretReveal | AccountCredentialRotation | CreateCustomerEndpointRequest | CustomerEndpoint | CustomerEndpointCollection | CustomerEndpointMutationResult | CustomerEndpointAttemptCollection | CustomerEndpointVerificationChallenge | CreateSubscriptionLinkRequest | SubscriptionLink | CreateMessageRequest | Message | Problem | IdempotencyKey | ProviderCapabilitiesCollection | ConnectionProviderCollection | ChannelConnection | ChannelConnectionCollection | CreateChannelConnectionRequest | UpdateChannelConnectionRequest | RotateChannelConnectionCredentialRequest | NotifierConnectionCollection | AttachNotifierConnectionRequest | ConnectionTest | ConnectionTestCollection | CreateConnectionTestRequest | CustomerOwnedSlackAppManifest | ProjectRecipientExperience | UpdateProjectRecipientExperienceRequest | RecipientBrandLogoUpload | NotificationImageAsset | EnvironmentRecipientExperience | UpdateEnvironmentRecipientExperienceRequest | CreateRecipientSessionRequest | CreateRecipientSessionResponse | RecipientSession | CreateProviderHandoffRequest | ProviderHandoff | RecipientHandoffCompletion | SetPreferredBindingRequest | PreferredBinding1 | CreateSubscriberRequest | Subscriber | CreateRecipientGroupRequest | RecipientGroup | RecipientGroupCollection | RecipientGroupMembership | RecipientGroupMembershipCollection | CreateGroupBroadcastRequest | GroupBroadcast;
 /**
  * An opaque identifier. Its shape, ordering, and embedded content are not public promises.
  */
@@ -52,7 +52,7 @@ export type RecipientCopyKey = "hostedConsent.openProvider" | "hostedConsent.rea
 export type RecipientCopyOverrideValue = string;
 /**
  * @minItems 1
- * @maxItems 9
+ * @maxItems 11
  */
 export type ApiCredentialScopeSet = [ApiCredentialScope] | [ApiCredentialScope, ApiCredentialScope] | [ApiCredentialScope, ApiCredentialScope, ApiCredentialScope] | [
     ApiCredentialScope,
@@ -99,11 +99,34 @@ export type ApiCredentialScopeSet = [ApiCredentialScope] | [ApiCredentialScope,
     ApiCredentialScope,
     ApiCredentialScope,
     ApiCredentialScope
+] | [
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope
+] | [
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope,
+    ApiCredentialScope
 ];
 /**
- * One project-credential capability. Environment authority always comes from the credential record, never a scope or request field.
+ * One project-credential capability. Environment authority always comes from the credential record, never a scope or request field. `projects:write` configures the credential's own project and environment; it never creates a project, which remains an account authority. The project-wide singletons — brand, default locale, logo and recipient copy — are what a live recipient sees, so writing them requires a live credential; a test credential may read them and may write its own environment's policy.
  */
-export type ApiCredentialScope = "messages:write" | "messages:read" | "subscriptions:write" | "subscriptions:read" | "machine-clients:write" | "machine-clients:read" | "capabilities:read" | "connections:write" | "connections:read";
+export type ApiCredentialScope = "projects:write" | "projects:read" | "messages:write" | "messages:read" | "subscriptions:write" | "subscriptions:read" | "machine-clients:write" | "machine-clients:read" | "capabilities:read" | "connections:write" | "connections:read";
 /**
  * Safe environment-scoped API credential metadata. It never contains a bearer secret, digest, Clerk identifier, or digest-key reference.
  */
@@ -142,6 +165,131 @@ export type ApiCredentialPrefix = string;
  * The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes.
  */
 export type ApiCredentialSecret = string;
+/**
+ * @minItems 1
+ * @maxItems 12
+ */
+export type AccountCredentialScopeSet = [AccountCredentialScope] | [AccountCredentialScope, AccountCredentialScope] | [AccountCredentialScope, AccountCredentialScope, AccountCredentialScope] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+] | [
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope,
+    AccountCredentialScope
+];
+/**
+ * One account-credential capability. `account:read` is the account's project directory — listing the account's projects and reading one — and is the only scope here a project credential can never carry; it authorizes nothing below the account. Every other name is the project-credential vocabulary unchanged, and is exercised only on the environment-scoped routes, where the project and environment come from the path and the credential's authority is the intersection of these scopes with the project-credential vocabulary. An account credential is therefore never wider than a project credential would have been for the same project environment.
+ */
+export type AccountCredentialScope = "account:read" | "projects:write" | "projects:read" | "messages:write" | "messages:read" | "subscriptions:write" | "subscriptions:read" | "machine-clients:write" | "machine-clients:read" | "capabilities:read" | "connections:write" | "connections:read";
+/**
+ * Safe account-scoped API credential metadata. It carries no project or environment, because it names neither: a request does, in its path. It never contains a bearer secret, digest, Clerk identifier, or digest-key reference.
+ */
+export type AccountCredential = {
+    [k: string]: unknown;
+} & {
+    id: AccountCredentialId;
+    prefix: AccountCredentialPrefix;
+    label: string;
+    scopes: AccountCredentialScopeSet;
+    /**
+     * An opaque identifier. Its shape, ordering, and embedded content are not public promises.
+     */
+    created_by: string;
+    created_at: Timestamp;
+    last_used_at?: Timestamp;
+    /**
+     * An RFC 3339 timestamp with a UTC offset. The server is authoritative.
+     */
+    scheduled_revocation_at?: string;
+    status: "active" | "revoked";
+    revoked_at?: Timestamp;
+};
+/**
+ * acred_ followed by the canonical unpadded base64url encoding of exactly 16 random bytes.
+ */
+export type AccountCredentialId = string;
+/**
+ * A safe display prefix containing the account-credential format marker and first eight base64url identity characters, never secret bytes.
+ */
+export type AccountCredentialPrefix = string;
+/**
+ * The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes.
+ */
+export type AccountCredentialSecret = string;
 export type CustomerEventType = "subscription.activated" | "subscription.revoked" | "message.provider_accepted" | "message.delivered" | "message.failed" | "message.expired" | "interaction.received" | "interaction.expired" | "agent_binding.degraded";
 export type CustomerEndpointStatus = "unverified" | "active" | "paused" | "disabled";
 /**
@@ -199,7 +347,7 @@ export type SubscriptionLink = {
      */
     cancellation_effective?: boolean;
 };
-export type ProblemCode = "authentication_required" | "credential_invalid" | "scope_forbidden" | "environment_mismatch" | "idempotency_key_required" | "idempotency_conflict" | "project_slug_conflict" | "request_invalid" | "replay_unavailable" | "subscriber_unbound" | "recipient_configuration_invalid" | "recipient_origin_forbidden" | "return_destination_not_found" | "recipient_capability_invalid" | "recipient_handoff_invalid" | "preferred_binding_conflict" | "preferred_binding_unavailable" | "subscriber_conflict" | "recipient_group_conflict" | "recipient_group_archived" | "resource_not_found" | "resource_expired" | "cancellation_too_late" | "endpoint_rotation_conflict" | "rate_limited" | "provider_retryable" | "provider_terminal" | "provider_outcome_unknown";
+export type ProblemCode = "authentication_required" | "credential_invalid" | "scope_forbidden" | "environment_mismatch" | "idempotency_key_required" | "idempotency_conflict" | "project_slug_conflict" | "request_invalid" | "replay_unavailable" | "subscriber_unbound" | "recipient_configuration_invalid" | "recipient_origin_forbidden" | "return_destination_not_found" | "recipient_capability_invalid" | "recipient_handoff_invalid" | "preferred_binding_conflict" | "preferred_binding_unavailable" | "subscriber_conflict" | "recipient_group_conflict" | "recipient_group_archived" | "resource_not_found" | "resource_expired" | "cancellation_too_late" | "credential_account_mismatch" | "endpoint_rotation_conflict" | "rate_limited" | "provider_retryable" | "provider_terminal" | "provider_outcome_unknown";
 /**
  * Creates one logical message for one subscriber and one resolved channel binding.
  */
@@ -773,6 +921,13 @@ export type Problem1 = {
     code?: "cancellation_too_late";
     retryable?: false;
     [k: string]: unknown;
+} | {
+    type?: "https://whooshbang.flowxo.com/problems/credential_account_mismatch";
+    title?: "Credential account mismatch";
+    status?: 403;
+    code?: "credential_account_mismatch";
+    retryable?: false;
+    [k: string]: unknown;
 } | {
     type?: "https://whooshbang.flowxo.com/problems/rate_limited";
     title?: "Rate limited";
@@ -1203,7 +1358,14 @@ export type ConnectionProvider = {
 } | {
     provider: "slack";
     display_name: string;
-    setup_modes: unknown[];
+    /**
+     * @minItems 1
+     * @maxItems 2
+     */
+    setup_modes: ["whooshbang_hosted" | "customer_managed"] | [
+        "whooshbang_hosted" | "customer_managed",
+        "whooshbang_hosted" | "customer_managed"
+    ];
     /**
      * @maxItems 9
      */
@@ -1268,7 +1430,7 @@ export type ProviderHealthState = "unknown" | "healthy" | "degraded" | "unhealth
 /**
  * One environment's provider-discriminated connection. Credentials and provider-native authority identifiers are structurally absent.
  */
-export type ChannelConnection = TelegramChannelConnection | HostedChannelConnection;
+export type ChannelConnection = TelegramChannelConnection | HostedChannelConnection | CustomerOwnedSlackChannelConnection;
 /**
  * `degraded` still delivers: the identity a subscriber consented to has not changed, only its last health check. `archived` is terminal, so consent granted against it is never revived.
  */
@@ -1305,6 +1467,14 @@ export type ProviderInstallationStatus = "pending" | "active" | "reauthorization
  * The exact safe next action for the current hosted lifecycle state. Provider wire errors and secret material never occupy this field.
  */
 export type HostedConnectionRecoveryAction = "none" | "complete_authorization" | "wait_for_admin_approval" | "retry_authorization" | "reinstall" | "retry_later" | "contact_support";
+/**
+ * How far a customer-owned Slack setup has reached, which is the only thing a caller can act on while the connection is still `pending`. Each verification state names a different authority, because Slack hands the app's secrets over together but exercises them at different moments: `awaiting_authorization` has the three values and is waiting for the install, `awaiting_ingress_proof` has a bot grant Slack confirmed and is waiting for the first request Slack itself signs. Collapsing them would let a connection report a verified ingress it has never verified.
+ */
+export type CustomerOwnedSlackSetupStatus = "awaiting_app_creation" | "awaiting_authorities" | "awaiting_authorization" | "awaiting_ingress_proof" | "provisioning" | "failed" | "expired";
+/**
+ * One app-specific authority the owner hands over. Product vocabulary for what each value is for, never the value: `client_identity` is safe metadata, and the other two are write-only.
+ */
+export type CustomerOwnedSlackAppAuthority = "client_identity" | "client_secret" | "signing_secret";
 /**
  * Selects the provider identity this environment will send through, discriminated on `mode`, and naming the provider it is for. The two customer-owned modes differ only in where the bot comes from: `customer_byok` connects one the customer already has, and `customer_managed` has Telegram create a new one on the administrator's own account. Neither supersedes the other, because a bot that already exists can never be adopted into managed mode — the manager that may act for a bot is fixed when the bot is created.
  */
@@ -1343,6 +1513,25 @@ export type CreateChannelConnectionRequest = {
      * The display name prefilled in the same dialog — what a subscriber reads at the top of the chat, as opposed to the @username they address. Unlike the username this one can be changed afterwards, so it is a convenience rather than a commitment. Omit it and Telegram's dialog opens with no name suggested.
      */
     suggested_bot_name?: string;
+} | {
+    mode: "customer_managed";
+    provider: "slack";
+    /**
+     * What this connection is called inside WhooshBang. Unrelated to what Slack shows the workspace.
+     */
+    display_name: string;
+    /**
+     * The app name Slack's creation dialog is prefilled with, constrained to Slack's own 35-character limit. The owner can still change it in Slack; this is a suggestion, not a reservation.
+     */
+    app_name: string;
+    /**
+     * The bot display name in the same dialog — what a recipient reads at the top of the conversation. Slack's own 80-character limit.
+     */
+    bot_display_name: string;
+    /**
+     * The short description Slack shows beside the app, within Slack's own 140-character limit.
+     */
+    app_description: string;
 } | {
     mode: "whooshbang_hosted";
     provider: "slack";
@@ -1353,9 +1542,25 @@ export type CreateChannelConnectionRequest = {
  */
 export type SuggestedBotUsername = string;
 /**
- * Replaces the secret behind a connection, discriminated by where a replacement can come from at all. A customer-owned bot has one only its owner can produce and therefore sends it; a managed bot has one only Telegram can issue and therefore sends nothing. Either way the connection keeps its provider identity, so a subscriber stays bound to the identity it consented to and only the secret changes.
+ * Replaces the secret behind a connection, discriminated by where a replacement can come from at all. A customer-owned bot has one only its owner can produce and therefore sends it; a managed bot has one only Telegram can issue and therefore sends nothing. A customer-owned Slack app has three separate authorities and names which of them it is replacing. Either way the connection keeps its provider identity, so a subscriber stays bound to the identity it consented to and only the secret changes.
+ *
+ * The first submission during setup uses this same boundary. Handing a secret over and replacing it are the same operation — a write that never reads the old value back — and giving initial setup its own endpoint would have meant two ways to do one thing, differing only in what the connection's status happened to be.
  */
 export type RotateChannelConnectionCredentialRequest = {
+    provider: "slack";
+    /**
+     * The app's Client ID, in Slack's own `<digits>.<digits>` shape. Safe app metadata rather than an authority: it identifies the app in an OAuth redirect the workspace can already see, so unlike the other two it is echoed back.
+     */
+    client_identity: string;
+    /**
+     * The app's Client Secret. Write-only: sealed on arrival, never echoed here or by any later read, and reachable only by the installation and identity exchanges — delivery cannot obtain it, and holding it sends no message.
+     */
+    client_secret: string;
+    /**
+     * The app's Signing Secret, which verifies that an inbound request really came from Slack. Write-only on the same terms, and reachable only by ingress verification.
+     */
+    signing_secret: string;
+} | {
     /**
      * The replacement provider credential. Write-only on the same terms as the credential a `customer_byok` create supplies: sealed on arrival and never echoed.
      */
@@ -1366,12 +1571,28 @@ export type RotateChannelConnectionCredentialRequest = {
      */
     source: "provider_managed";
 };
+/**
+ * Which half of a connection a test exercises. `outbound_notification` proves this exact identity can put a message in front of the person who set it up. `signed_interaction` proves the opposite direction: that the provider can reach this deployment's interactivity URL and that the request it signs verifies against the secret we hold. The two fail for entirely different reasons, so they are never collapsed into one result.
+ */
+export type ConnectionTestKind = "outbound_notification" | "signed_interaction";
+/**
+ * `pending` means the test is placed and its answer has not arrived; a signed-interaction test stays there until somebody presses the button it sent. `expired` is the honest reading of a pending test whose window closed: nothing failed, nobody answered.
+ */
+export type ConnectionTestStatus = "pending" | "succeeded" | "failed" | "expired";
+/**
+ * Why a test did not pass, in a vocabulary the owner can act on rather than the provider's wire error.
+ *
+ * `verification_target_unknown` means nobody has installed the app from this deployment yet, so there is no owner to send a test to. `unverified_request_received` is a statement of fact and not a diagnosis: a request carrying this test's own challenge reached the interactivity URL and its signature did not verify against the secret this connection holds.
+ *
+ * A window that closed with nothing arriving is not in this list, because it is not a failure: it reads as `expired`, which says nobody answered rather than that anything broke.
+ */
+export type ConnectionTestFailureCode = "setup_incomplete" | "verification_target_unknown" | "credential_unavailable" | "provider_rejected" | "provider_unavailable" | "provider_rate_limited" | "unverified_request_received";
 /**
  * An opaque identifier for one normalized project-owned recipient brand logo.
  */
 export type RecipientBrandAssetId = string;
 /**
- * One exact scheme, host, and optional port. Paths, queries, fragments, credentials, and wildcards are forbidden; HTTP is accepted only for localhost or synthetic .test configuration.
+ * One exact scheme, host, and optional port, in any spelling that means that same origin. A trailing slash, an uppercase host, and an explicitly written default port are accepted and stored in canonical form. Paths, queries, fragments, credentials, and wildcards are forbidden; HTTP is accepted only for localhost or synthetic .test configuration.
  */
 export type ExactOrigin = string;
 /**
@@ -1753,6 +1974,46 @@ export interface ApiCredentialRotation {
     credential: ApiCredentialSecretReveal;
     replaced_credential: ApiCredential;
 }
+/**
+ * Creates one credential against the whole account rather than one project environment.
+ */
+export interface CreateAccountCredentialRequest {
+    label: string;
+    scopes: AccountCredentialScopeSet;
+}
+/**
+ * Creates a replacement with the same label and scopes and schedules terminal revocation of the replaced credential after the declared overlap.
+ */
+export interface RotateAccountCredentialRequest {
+    overlap_seconds: number;
+}
+/**
+ * A stable page of safe account-credential metadata for one account.
+ */
+export interface AccountCredentialCollection {
+    /**
+     * @maxItems 100
+     */
+    items: AccountCredential[];
+    next_cursor?: string;
+    page?: ListPageNumber;
+    page_size?: ListPageSize;
+    total?: ListTotal;
+}
+/**
+ * The creation-only response. The secret is emitted in this response exactly once and is never available from list, rotate-target, revoke, or later read responses.
+ */
+export interface AccountCredentialSecretReveal {
+    credential: AccountCredential;
+    secret: AccountCredentialSecret;
+}
+/**
+ * A creation-only replacement secret plus safe metadata for the credential it replaces.
+ */
+export interface AccountCredentialRotation {
+    credential: AccountCredentialSecretReveal;
+    replaced_credential: AccountCredential;
+}
 /**
  * Creates one project/environment endpoint. The service validates the final normalized destination and never returns it from health or diagnostic reads.
  */
@@ -2876,6 +3137,7 @@ export interface TelegramChannelConnection {
     identity?: TelegramConnectionIdentity;
     setup?: ChannelConnectionSetup;
     authorization_setup?: never;
+    app_setup?: never;
     installation?: never;
     /**
      * Send this back on an update. A stale value is refused rather than silently overwriting a change made in between.
@@ -2930,6 +3192,7 @@ export interface HostedChannelConnection {
     capabilities: [] | [HostedConnectionCapability];
     identity?: SlackConnectionIdentity;
     setup?: never;
+    app_setup?: never;
     /**
      * The additive hosted authorization state. Older tolerant readers discard this unknown field rather than interpreting it as Telegram setup.
      */
@@ -2979,6 +3242,97 @@ export interface ProviderInstallationSummary {
     status: ProviderInstallationStatus;
     health: ProviderHealthState;
 }
+/**
+ * A Slack app the customer created and owns, referenced by one exact environment connection.
+ *
+ * It differs from the hosted arm in who owns the app and its lifecycle, not in what a notification can do. WhooshBang custodies the three app-specific authorities Slack makes unavoidable and none of them appears here or in any other read: absence, not redaction, is the mechanism.
+ */
+export interface CustomerOwnedSlackChannelConnection {
+    id: OpaqueIdentifier;
+    project_id: OpaqueIdentifier;
+    environment_id: OpaqueIdentifier;
+    environment: Environment;
+    provider: "slack";
+    mode: "customer_managed";
+    display_name: string;
+    status: ChannelConnectionStatus;
+    health: ProviderHealthState;
+    /**
+     * @maxItems 1
+     */
+    capabilities: [] | [HostedConnectionCapability];
+    identity?: SlackConnectionIdentity;
+    setup?: never;
+    authorization_setup?: never;
+    app_setup?: CustomerOwnedSlackConnectionSetup;
+    installation?: ProviderInstallationSummary1;
+    /**
+     * A provider-owned App Home deep link for the customer's own workspace and their own app. It is not a caller-supplied return URL.
+     */
+    management_url?: string;
+    recovery_action: HostedConnectionRecoveryAction;
+    last_successful_verification_at?: Timestamp;
+    last_successful_delivery_at?: Timestamp;
+    /**
+     * Send this back on an update. A stale value is refused rather than silently overwriting a change made in between.
+     */
+    row_version: number;
+    created_at: Timestamp;
+    updated_at: Timestamp;
+    archived_at?: Timestamp;
+    health_checked_at?: Timestamp;
+    last_transition_at?: Timestamp;
+    last_transition_reason?: string;
+    diagnostic_id: DiagnosticId;
+}
+/**
+ * The guided customer-owned setup state. A distinct field from Telegram's `setup` and the hosted arm's `authorization_setup` so a tolerant reader can never mistake one journey's progress for another's.
+ */
+export interface CustomerOwnedSlackConnectionSetup {
+    status: CustomerOwnedSlackSetupStatus;
+    /**
+     * Slack's own app-creation flow, opened with this app's manifest already filled in, so the owner reviews and presses Create rather than writing or pasting YAML. The URL carries configuration only: it names no account, project, or environment and contains no credential. The opaque handle it does carry selects candidate setup state and authorizes nothing.
+     */
+    creation_url: string;
+    /**
+     * An RFC 3339 timestamp with a UTC offset. The server is authoritative.
+     */
+    expires_at: string;
+    /**
+     * The short-lived handoff that installs the owner's app into their workspace, present once the three authorities have arrived and an installation has been started. It carries opaque state, never a provider credential or a raw authorization code, and the bot grant it produces is returned to WhooshBang by Slack rather than to the browser.
+     */
+    authorization_url?: string;
+    /**
+     * The name the owner chose, echoed so a resumed session shows the same app it started with. Slack's own limit.
+     */
+    app_name: string;
+    /**
+     * The bot display name the owner chose, echoed for the same reason. Slack's own limit.
+     */
+    bot_display_name: string;
+    /**
+     * Which of the three app-specific values this setup is still waiting for. Empty once they have all arrived; it never says what any of them are.
+     *
+     * @maxItems 3
+     */
+    outstanding_authorities: [] | [CustomerOwnedSlackAppAuthority] | [CustomerOwnedSlackAppAuthority, CustomerOwnedSlackAppAuthority] | [
+        CustomerOwnedSlackAppAuthority,
+        CustomerOwnedSlackAppAuthority,
+        CustomerOwnedSlackAppAuthority
+    ];
+    /**
+     * Why this attempt ended, in terms the owner can act on. It never echoes a submitted secret, whole or in part, and never names another customer: a Slack app already connected elsewhere says only that.
+     */
+    failure_reason?: string;
+}
+/**
+ * The safe installation this exact connection owns. It exposes no provider-native identifier and no credential reference.
+ */
+export interface ProviderInstallationSummary1 {
+    display_name: string;
+    status: ProviderInstallationStatus;
+    health: ProviderHealthState;
+}
 export interface ChannelConnectionCollection {
     /**
      * @maxItems 100
@@ -3040,6 +3394,479 @@ export interface AttachNotifierConnectionRequest {
      */
     is_default?: boolean;
 }
+/**
+ * One owner-triggered proof that an exact connection still works, run on demand and answered with evidence rather than with a claim.
+ *
+ * It is deliberately incapable of carrying a secret: nothing here is a credential, a provider-native identifier, or message content, and a test that failed says why in a closed vocabulary rather than by quoting a provider.
+ */
+export interface ConnectionTest {
+    id: OpaqueIdentifier;
+    connection_id: OpaqueIdentifier;
+    kind: ConnectionTestKind;
+    status: ConnectionTestStatus;
+    requested_at: Timestamp;
+    /**
+     * An RFC 3339 timestamp with a UTC offset. The server is authoritative.
+     */
+    completed_at?: string;
+    /**
+     * An RFC 3339 timestamp with a UTC offset. The server is authoritative.
+     */
+    expires_at: string;
+    evidence?: ConnectionTestEvidence;
+    failure_code?: ConnectionTestFailureCode;
+    /**
+     * The exact safe next action for this result. `none` on a pass.
+     */
+    recovery_action: "none" | "complete_setup" | "replace_credentials" | "reinstall" | "retry_later" | "check_request_url" | "contact_support";
+    diagnostic_id: DiagnosticId;
+}
+/**
+ * What a finished test actually observed. Every field is safe to render, log, and paste into an issue: no credential, no provider-native app, workspace, channel, or user identifier, and no message content.
+ */
+export interface ConnectionTestEvidence {
+    /**
+     * The visible handle the test went out as — the same identity a subscriber would see.
+     */
+    identity_handle?: string;
+    /**
+     * The provider workspace the test ran in, as its own members see it named.
+     */
+    workspace_display_name?: string;
+    /**
+     * An RFC 3339 timestamp with a UTC offset. The server is authoritative.
+     */
+    accepted_at?: string;
+    /**
+     * An RFC 3339 timestamp with a UTC offset. The server is authoritative.
+     */
+    observed_at?: string;
+    /**
+     * Milliseconds from placing the test to observing its answer.
+     */
+    round_trip_ms?: number;
+    /**
+     * Whether the provider's signature over the untouched request body verified against the secret this connection custodies. Present only once a request has arrived.
+     */
+    signature_verified?: boolean;
+    /**
+     * The public host the provider actually called, which is what a misconfigured or stale request URL gets wrong. It is this deployment's own hostname and names no tenant.
+     */
+    ingress_host?: string;
+}
+/**
+ * This connection's recent tests, newest first. It is the audit-safe failure history for a connection: what was tried, when, and what came back.
+ */
+export interface ConnectionTestCollection {
+    /**
+     * @maxItems 100
+     */
+    items: ConnectionTest[];
+    next_cursor?: string;
+    page?: ListPageNumber;
+    page_size?: ListPageSize;
+    total?: ListTotal;
+}
+/**
+ * Places one test against an exact connection. It carries nothing but which test to run: a test needs no target, because the only person it may address is the one who installed the app.
+ */
+export interface CreateConnectionTestRequest {
+    kind: ConnectionTestKind;
+}
+/**
+ * The exact configuration a customer-owned Slack app is created from, as data rather than as a URL-encoded blob.
+ *
+ * It exists so the owner can read what they are about to approve, and so a reviewer can check it, without opening Slack. It carries configuration only: no account, project, or environment, no credential, and no provider-native identifier. The opaque handle inside the request URLs selects candidate setup state and authorizes nothing — a request still has to carry Slack's signature over the untouched body before anything inside it is believed.
+ */
+export interface CustomerOwnedSlackAppManifest {
+    /**
+     * The same prefilled creation link the setup carries, repeated here so one read answers both questions.
+     */
+    creation_url: string;
+    app_name: string;
+    bot_display_name: string;
+    description: string;
+    /**
+     * Every provider scope the bot will ask for, exactly as Slack will show them. Raw provider vocabulary on purpose: this is the screen the owner is about to approve, and translating it would make it unverifiable.
+     *
+     * @maxItems 20
+     */
+    bot_scopes: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ];
+    /**
+     * Every provider scope a recipient will be asked for when they sign in. Separate from the bot scopes because they are approved by different people at different moments.
+     *
+     * @maxItems 20
+     */
+    user_scopes: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ] | [
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string,
+        string
+    ];
+    /**
+     * Where this deployment answers the app. A stale or edited value here is the failure a signed-interaction test detects.
+     */
+    request_urls: {
+        events: string;
+        interactions: string;
+        installation_redirect: string;
+        recipient_redirect: string;
+    };
+    /**
+     * The literal manifest document Slack is handed. Reproduced whole so what the owner reviews and what Slack receives cannot drift apart.
+     */
+    manifest: {
+        [k: string]: unknown;
+    };
+    diagnostic_id: DiagnosticId;
+}
 /**
  * The project-owned recipient identity and fallback locale.
  */