@wirebench/engine 2.1.1

package/dist/project/schema.d.ts

@@ -0,0 +1,1329 @@
+/**
+ * Zod schemas for every YAML document in a project folder.
+ *
+ * Every object schema is `z.looseObject`: unknown keys are accepted and
+ * IGNORED on load (the loader only ever reads the fields it knows about), and
+ * `saveProject` only ever writes known fields back out, so a 1.x build reading
+ * a file written by a newer 1.x build silently drops fields it does not
+ * understand rather than refusing to open the project. A breaking change to a
+ * document's shape bumps `formatVersion` instead of relying on strictness
+ * here. `formatVersion` itself stays a `z.literal` so an out-of-range value is
+ * still caught explicitly (see `migrate.ts`).
+ *
+ * The policy that follows from that, stated once so nobody has to rediscover
+ * it: **any additive field bumps `formatVersion`.** Since an unknown key is
+ * dropped on load and never written back, a field added inside the current
+ * version does not merely go unread by older builds — it is deleted from the
+ * project the first time an older build saves. "Additive is safe" is true of
+ * formats that round-trip unknown keys; this one deliberately does not. See
+ * ADR-0003.
+ */
+import { z } from 'zod';
+/**
+ * Credentials as persisted: usernames and a `secretRef`, never a password
+ * value. Unlike every other schema here, a plaintext `password` key is
+ * explicitly rejected rather than merely ignored — secrets must never be
+ * written to a project file, in any format.
+ */
+export declare const endpointAuthSchema: z.ZodObject<{
+    type: z.ZodEnum<{
+        none: "none";
+        basic: "basic";
+        ntlm: "ntlm";
+    }>;
+    username: z.ZodOptional<z.ZodString>;
+    passwordRef: z.ZodOptional<z.ZodString>;
+    passwordEnv: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    workstation: z.ZodOptional<z.ZodString>;
+    preemptive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/**
+ * Authentication as persisted anywhere a project configures it. `endpointAuthSchema` is one arm,
+ * so a file written before the REST client — which only ever held `none`/`basic`/`ntlm` — parses
+ * unchanged. `inherit` is accepted here and rejected by the SOAP schemas that reuse
+ * `endpointAuthSchema` instead, since an interface has nothing to inherit from.
+ */
+export declare const authConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
+    type: z.ZodEnum<{
+        none: "none";
+        basic: "basic";
+        ntlm: "ntlm";
+    }>;
+    username: z.ZodOptional<z.ZodString>;
+    passwordRef: z.ZodOptional<z.ZodString>;
+    passwordEnv: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    workstation: z.ZodOptional<z.ZodString>;
+    preemptive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"inherit">;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    tokenRef: z.ZodOptional<z.ZodString>;
+    tokenEnv: z.ZodOptional<z.ZodString>;
+    scheme: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"api-key">;
+    name: z.ZodString;
+    valueRef: z.ZodOptional<z.ZodString>;
+    valueEnv: z.ZodOptional<z.ZodString>;
+    in: z.ZodEnum<{
+        header: "header";
+        query: "query";
+    }>;
+}, z.core.$loose>, z.ZodObject<{
+    type: z.ZodLiteral<"oauth2">;
+    grant: z.ZodEnum<{
+        "client-credentials": "client-credentials";
+        "authorization-code": "authorization-code";
+    }>;
+    tokenUrl: z.ZodString;
+    authorizationUrl: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    clientSecretRef: z.ZodOptional<z.ZodString>;
+    clientSecretEnv: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    audience: z.ZodOptional<z.ZodString>;
+    clientAuth: z.ZodDefault<z.ZodEnum<{
+        basic: "basic";
+        body: "body";
+    }>>;
+    pkce: z.ZodDefault<z.ZodBoolean>;
+    refreshTokenRef: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>]>;
+/** `wirebench.yaml`. */
+export declare const manifestSchema: z.ZodObject<{
+    formatVersion: z.ZodLiteral<4>;
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    settings: z.ZodObject<{
+        cacheDefinitions: z.ZodBoolean;
+        defaultTimeoutMs: z.ZodNumber;
+        resourceRoot: z.ZodOptional<z.ZodString>;
+        prettyPrintResponses: z.ZodBoolean;
+    }, z.core.$loose>;
+    properties: z.ZodRecord<z.ZodString, z.ZodString>;
+    disabled: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    activeEnvironmentId: z.ZodOptional<z.ZodString>;
+    writtenBy: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+/** `interfaces/<slug>/interface.yaml`. */
+export declare const interfaceFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"soap">;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    definitionUrl: z.ZodString;
+    cacheDefinition: z.ZodBoolean;
+    targetNamespace: z.ZodOptional<z.ZodString>;
+    endpoints: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        url: z.ZodString;
+        auth: z.ZodOptional<z.ZodObject<{
+            type: z.ZodEnum<{
+                none: "none";
+                basic: "basic";
+                ntlm: "ntlm";
+            }>;
+            username: z.ZodOptional<z.ZodString>;
+            passwordRef: z.ZodOptional<z.ZodString>;
+            passwordEnv: z.ZodOptional<z.ZodString>;
+            domain: z.ZodOptional<z.ZodString>;
+            workstation: z.ZodOptional<z.ZodString>;
+            preemptive: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>>;
+        authMode: z.ZodEnum<{
+            override: "override";
+            complement: "complement";
+        }>;
+        trustInvalid: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    defaultEndpointId: z.ZodOptional<z.ZodString>;
+    wsa: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        version: z.ZodOptional<z.ZodEnum<{
+            "2005/08": "2005/08";
+            "2004/08": "2004/08";
+        }>>;
+        mustUnderstand: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            true: "true";
+            false: "false";
+        }>>;
+        action: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+        messageId: z.ZodOptional<z.ZodString>;
+        replyTo: z.ZodOptional<z.ZodString>;
+        from: z.ZodOptional<z.ZodString>;
+        faultTo: z.ZodOptional<z.ZodString>;
+        relatesTo: z.ZodOptional<z.ZodString>;
+        relationshipType: z.ZodOptional<z.ZodString>;
+        addDefaultAction: z.ZodOptional<z.ZodBoolean>;
+        addDefaultTo: z.ZodOptional<z.ZodBoolean>;
+        generateMessageId: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>;
+    auth: z.ZodOptional<z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    operations: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        bindingName: z.ZodString;
+        slug: z.ZodString;
+        order: z.ZodNumber;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/** Where a file's bytes live: the project's content-addressed cache, or a path on disk. */
+export declare const attachmentSourceSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"cache">;
+    sha256: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    kind: z.ZodLiteral<"path">;
+    path: z.ZodString;
+}, z.core.$loose>]>;
+/** `interfaces/<slug>/operations/<slug>/<name>.request.yaml` (the envelope lives in the sibling `.xml`). */
+export declare const requestFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"soap">;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    endpointId: z.ZodOptional<z.ZodString>;
+    endpointUrl: z.ZodOptional<z.ZodString>;
+    soapVersion: z.ZodEnum<{
+        1.1: "1.1";
+        1.2: "1.2";
+    }>;
+    soapAction: z.ZodOptional<z.ZodString>;
+    headers: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$loose>>;
+    attachments: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        contentType: z.ZodString;
+        size: z.ZodNumber;
+        part: z.ZodOptional<z.ZodString>;
+        type: z.ZodEnum<{
+            XOP: "XOP";
+            MIME: "MIME";
+            SWAREF: "SWAREF";
+            CONTENT: "CONTENT";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        contentId: z.ZodString;
+        cached: z.ZodBoolean;
+        source: z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"cache">;
+            sha256: z.ZodString;
+        }, z.core.$loose>, z.ZodObject<{
+            kind: z.ZodLiteral<"path">;
+            path: z.ZodString;
+        }, z.core.$loose>]>;
+    }, z.core.$loose>>;
+    auth: z.ZodOptional<z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    wsa: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        version: z.ZodOptional<z.ZodEnum<{
+            "2005/08": "2005/08";
+            "2004/08": "2004/08";
+        }>>;
+        mustUnderstand: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            true: "true";
+            false: "false";
+        }>>;
+        action: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+        messageId: z.ZodOptional<z.ZodString>;
+        replyTo: z.ZodOptional<z.ZodString>;
+        from: z.ZodOptional<z.ZodString>;
+        faultTo: z.ZodOptional<z.ZodString>;
+        relatesTo: z.ZodOptional<z.ZodString>;
+        relationshipType: z.ZodOptional<z.ZodString>;
+        addDefaultAction: z.ZodOptional<z.ZodBoolean>;
+        addDefaultTo: z.ZodOptional<z.ZodBoolean>;
+        generateMessageId: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    wssOutgoingRef: z.ZodOptional<z.ZodString>;
+    wssIncomingRef: z.ZodOptional<z.ZodString>;
+    properties: z.ZodObject<{
+        encoding: z.ZodString;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        bindAddress: z.ZodOptional<z.ZodString>;
+        followRedirects: z.ZodBoolean;
+        skipSoapAction: z.ZodBoolean;
+        enableMtom: z.ZodBoolean;
+        forceMtom: z.ZodBoolean;
+        inlineResponseAttachments: z.ZodBoolean;
+        expandMtomAttachments: z.ZodBoolean;
+        disableMultiparts: z.ZodBoolean;
+        encodeAttachments: z.ZodBoolean;
+        enableInlineFiles: z.ZodBoolean;
+        removeEmptyContent: z.ZodBoolean;
+        entitizeProperties: z.ZodBoolean;
+        prettyPrint: z.ZodBoolean;
+        stripWhitespaces: z.ZodBoolean;
+        dumpFile: z.ZodOptional<z.ZodString>;
+        maxSizeBytes: z.ZodOptional<z.ZodNumber>;
+        wssPasswordType: z.ZodOptional<z.ZodEnum<{
+            text: "text";
+            digest: "digest";
+        }>>;
+        wssTimeToLive: z.ZodOptional<z.ZodNumber>;
+        sslKeystoreRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
+    assertions: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"status">;
+        equals: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>]>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"soap-fault">;
+        expect: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            present: "present";
+        }>>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"match">;
+        language: z.ZodEnum<{
+            xpath: "xpath";
+            xquery: "xquery";
+            jsonpath: "jsonpath";
+        }>;
+        expression: z.ZodString;
+        namespaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        equals: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        matches: z.ZodOptional<z.ZodString>;
+        exists: z.ZodOptional<z.ZodBoolean>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"schema">;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"sla">;
+        maxMs: z.ZodNumber;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>], "type">>>;
+    orphaned: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/**
+ * One table row as persisted. `enabled` is written only when `false`, so a missing key means
+ * enabled; names may repeat and their order is the wire order.
+ */
+export declare const keyValueEntrySchema: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+/**
+ * A request body as persisted. A raw body names its sibling file rather than carrying its text:
+ * `file` is a bare file name in the request's own directory, validated as a path segment before
+ * anything is read or written (ADR-0005).
+ */
+export declare const restBodySchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+}, z.core.$loose>, z.ZodObject<{
+    kind: z.ZodLiteral<"raw">;
+    language: z.ZodEnum<{
+        text: "text";
+        json: "json";
+        xml: "xml";
+        html: "html";
+        javascript: "javascript";
+    }>;
+    contentType: z.ZodOptional<z.ZodString>;
+    file: z.ZodString;
+}, z.core.$loose>, z.ZodObject<{
+    kind: z.ZodLiteral<"form">;
+    fields: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+}, z.core.$loose>, z.ZodObject<{
+    kind: z.ZodLiteral<"multipart">;
+    parts: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"text">;
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        contentType: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"file">;
+        name: z.ZodString;
+        source: z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"cache">;
+            sha256: z.ZodString;
+        }, z.core.$loose>, z.ZodObject<{
+            kind: z.ZodLiteral<"path">;
+            path: z.ZodString;
+        }, z.core.$loose>]>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        fileName: z.ZodOptional<z.ZodString>;
+        contentType: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>]>>>;
+}, z.core.$loose>, z.ZodObject<{
+    kind: z.ZodLiteral<"binary">;
+    source: z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"cache">;
+        sha256: z.ZodString;
+    }, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"path">;
+        path: z.ZodString;
+    }, z.core.$loose>]>;
+    contentType: z.ZodString;
+}, z.core.$loose>]>;
+/** `apis/<slug>/requests/[<folder>/…]<name>.request.yaml`. */
+export declare const restRequestFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"rest">;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    method: z.ZodString;
+    url: z.ZodString;
+    pathParams: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    query: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    headers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    body: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"none">;
+    }, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"raw">;
+        language: z.ZodEnum<{
+            text: "text";
+            json: "json";
+            xml: "xml";
+            html: "html";
+            javascript: "javascript";
+        }>;
+        contentType: z.ZodOptional<z.ZodString>;
+        file: z.ZodString;
+    }, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"form">;
+        fields: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            description: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>>;
+    }, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"multipart">;
+        parts: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"text">;
+            name: z.ZodString;
+            value: z.ZodString;
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            contentType: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>, z.ZodObject<{
+            kind: z.ZodLiteral<"file">;
+            name: z.ZodString;
+            source: z.ZodUnion<readonly [z.ZodObject<{
+                kind: z.ZodLiteral<"cache">;
+                sha256: z.ZodString;
+            }, z.core.$loose>, z.ZodObject<{
+                kind: z.ZodLiteral<"path">;
+                path: z.ZodString;
+            }, z.core.$loose>]>;
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            fileName: z.ZodOptional<z.ZodString>;
+            contentType: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>]>>>;
+    }, z.core.$loose>, z.ZodObject<{
+        kind: z.ZodLiteral<"binary">;
+        source: z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"cache">;
+            sha256: z.ZodString;
+        }, z.core.$loose>, z.ZodObject<{
+            kind: z.ZodLiteral<"path">;
+            path: z.ZodString;
+        }, z.core.$loose>]>;
+        contentType: z.ZodString;
+    }, z.core.$loose>]>>;
+    auth: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"inherit">;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        tokenRef: z.ZodOptional<z.ZodString>;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        scheme: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key">;
+        name: z.ZodString;
+        valueRef: z.ZodOptional<z.ZodString>;
+        valueEnv: z.ZodOptional<z.ZodString>;
+        in: z.ZodEnum<{
+            header: "header";
+            query: "query";
+        }>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        grant: z.ZodEnum<{
+            "client-credentials": "client-credentials";
+            "authorization-code": "authorization-code";
+        }>;
+        tokenUrl: z.ZodString;
+        authorizationUrl: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        clientSecretRef: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        audience: z.ZodOptional<z.ZodString>;
+        clientAuth: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            body: "body";
+        }>>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        refreshTokenRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>]>>;
+    settings: z.ZodDefault<z.ZodObject<{
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        followRedirects: z.ZodOptional<z.ZodBoolean>;
+        maxRedirects: z.ZodOptional<z.ZodNumber>;
+        keepBodyOnRedirect: z.ZodOptional<z.ZodBoolean>;
+        encodeUrl: z.ZodOptional<z.ZodBoolean>;
+        trustInvalid: z.ZodOptional<z.ZodBoolean>;
+        sslKeystoreRef: z.ZodOptional<z.ZodString>;
+        bindAddress: z.ZodOptional<z.ZodString>;
+        maxSizeBytes: z.ZodOptional<z.ZodNumber>;
+        sendCookies: z.ZodOptional<z.ZodBoolean>;
+        escapeProperties: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    assertions: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"status">;
+        equals: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>]>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"soap-fault">;
+        expect: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            present: "present";
+        }>>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"match">;
+        language: z.ZodEnum<{
+            xpath: "xpath";
+            xquery: "xquery";
+            jsonpath: "jsonpath";
+        }>;
+        expression: z.ZodString;
+        namespaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        equals: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        matches: z.ZodOptional<z.ZodString>;
+        exists: z.ZodOptional<z.ZodBoolean>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"schema">;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"sla">;
+        maxMs: z.ZodNumber;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>], "type">>>;
+    orphaned: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/** `apis/<slug>/requests/[<folder>/…]folder.yaml`. */
+export declare const restFolderFileSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"inherit">;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        tokenRef: z.ZodOptional<z.ZodString>;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        scheme: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key">;
+        name: z.ZodString;
+        valueRef: z.ZodOptional<z.ZodString>;
+        valueEnv: z.ZodOptional<z.ZodString>;
+        in: z.ZodEnum<{
+            header: "header";
+            query: "query";
+        }>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        grant: z.ZodEnum<{
+            "client-credentials": "client-credentials";
+            "authorization-code": "authorization-code";
+        }>;
+        tokenUrl: z.ZodString;
+        authorizationUrl: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        clientSecretRef: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        audience: z.ZodOptional<z.ZodString>;
+        clientAuth: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            body: "body";
+        }>>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        refreshTokenRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>]>>;
+}, z.core.$loose>;
+/** `apis/<slug>/api.yaml`. */
+export declare const apiFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"rest">;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodString;
+    servers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        url: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"inherit">;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        tokenRef: z.ZodOptional<z.ZodString>;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        scheme: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key">;
+        name: z.ZodString;
+        valueRef: z.ZodOptional<z.ZodString>;
+        valueEnv: z.ZodOptional<z.ZodString>;
+        in: z.ZodEnum<{
+            header: "header";
+            query: "query";
+        }>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        grant: z.ZodEnum<{
+            "client-credentials": "client-credentials";
+            "authorization-code": "authorization-code";
+        }>;
+        tokenUrl: z.ZodString;
+        authorizationUrl: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        clientSecretRef: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        audience: z.ZodOptional<z.ZodString>;
+        clientAuth: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            body: "body";
+        }>>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        refreshTokenRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>]>>;
+    definition: z.ZodOptional<z.ZodObject<{
+        source: z.ZodString;
+        cache: z.ZodDefault<z.ZodBoolean>;
+        version: z.ZodDefault<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/** The four shapes a gRPC method can take. */
+export declare const grpcMethodKindSchema: z.ZodEnum<{
+    unary: "unary";
+    "server-streaming": "server-streaming";
+    "client-streaming": "client-streaming";
+    "bidi-streaming": "bidi-streaming";
+}>;
+/**
+ * `apis/<slug>/requests/[<folder>/…]<name>.request.yaml` for a gRPC request. The message text lives
+ * in the sibling file `message` names, validated as a path segment before it is read (ADR-0005),
+ * so a JSON message is a JSON file in git like a REST raw body.
+ */
+export declare const grpcRequestFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"grpc">;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    service: z.ZodString;
+    method: z.ZodString;
+    methodKind: z.ZodDefault<z.ZodEnum<{
+        unary: "unary";
+        "server-streaming": "server-streaming";
+        "client-streaming": "client-streaming";
+        "bidi-streaming": "bidi-streaming";
+    }>>;
+    metadata: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    message: z.ZodOptional<z.ZodString>;
+    auth: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"inherit">;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        tokenRef: z.ZodOptional<z.ZodString>;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        scheme: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key">;
+        name: z.ZodString;
+        valueRef: z.ZodOptional<z.ZodString>;
+        valueEnv: z.ZodOptional<z.ZodString>;
+        in: z.ZodEnum<{
+            header: "header";
+            query: "query";
+        }>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        grant: z.ZodEnum<{
+            "client-credentials": "client-credentials";
+            "authorization-code": "authorization-code";
+        }>;
+        tokenUrl: z.ZodString;
+        authorizationUrl: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        clientSecretRef: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        audience: z.ZodOptional<z.ZodString>;
+        clientAuth: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            body: "body";
+        }>>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        refreshTokenRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>]>>;
+    settings: z.ZodDefault<z.ZodObject<{
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        trustInvalid: z.ZodOptional<z.ZodBoolean>;
+        sslKeystoreRef: z.ZodOptional<z.ZodString>;
+        bindAddress: z.ZodOptional<z.ZodString>;
+        maxSizeBytes: z.ZodOptional<z.ZodNumber>;
+        escapeProperties: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    orphaned: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/** `apis/<slug>/api.yaml` for a gRPC API. */
+export declare const grpcApiFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"grpc">;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    target: z.ZodString;
+    tls: z.ZodDefault<z.ZodBoolean>;
+    metadata: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"inherit">;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        tokenRef: z.ZodOptional<z.ZodString>;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        scheme: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key">;
+        name: z.ZodString;
+        valueRef: z.ZodOptional<z.ZodString>;
+        valueEnv: z.ZodOptional<z.ZodString>;
+        in: z.ZodEnum<{
+            header: "header";
+            query: "query";
+        }>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        grant: z.ZodEnum<{
+            "client-credentials": "client-credentials";
+            "authorization-code": "authorization-code";
+        }>;
+        tokenUrl: z.ZodString;
+        authorizationUrl: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        clientSecretRef: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        audience: z.ZodOptional<z.ZodString>;
+        clientAuth: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            body: "body";
+        }>>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        refreshTokenRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>]>>;
+    definition: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodDefault<z.ZodEnum<{
+            proto: "proto";
+            reflection: "reflection";
+        }>>;
+        source: z.ZodString;
+        cache: z.ZodDefault<z.ZodBoolean>;
+        roots: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        reflectionVersion: z.ZodOptional<z.ZodEnum<{
+            auto: "auto";
+            v1: "v1";
+            v1alpha: "v1alpha";
+        }>>;
+        trustInvalid: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/**
+ * `apis/<slug>/requests/[<folder>/…]<name>.request.yaml` for a WebSocket request. Each saved
+ * message's own text lives in its own sibling file, so a JSON message is a JSON file in git.
+ */
+export declare const wsRequestFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"websocket">;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+    query: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    headers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    subprotocols: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    auth: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"inherit">;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        tokenRef: z.ZodOptional<z.ZodString>;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        scheme: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key">;
+        name: z.ZodString;
+        valueRef: z.ZodOptional<z.ZodString>;
+        valueEnv: z.ZodOptional<z.ZodString>;
+        in: z.ZodEnum<{
+            header: "header";
+            query: "query";
+        }>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        grant: z.ZodEnum<{
+            "client-credentials": "client-credentials";
+            "authorization-code": "authorization-code";
+        }>;
+        tokenUrl: z.ZodString;
+        authorizationUrl: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        clientSecretRef: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        audience: z.ZodOptional<z.ZodString>;
+        clientAuth: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            body: "body";
+        }>>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        refreshTokenRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>]>>;
+    settings: z.ZodDefault<z.ZodObject<{
+        handshakeTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        trustInvalid: z.ZodOptional<z.ZodBoolean>;
+        sslKeystoreRef: z.ZodOptional<z.ZodString>;
+        bindAddress: z.ZodOptional<z.ZodString>;
+        maxMessageBytes: z.ZodOptional<z.ZodNumber>;
+        escapeProperties: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    messages: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        format: z.ZodDefault<z.ZodEnum<{
+            text: "text";
+            binary: "binary";
+        }>>;
+        file: z.ZodString;
+    }, z.core.$loose>>>;
+}, z.core.$loose>;
+/** `apis/<slug>/api.yaml` for a WebSocket API. */
+export declare const wsApiFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"websocket">;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+    headers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodEnum<{
+            none: "none";
+            basic: "basic";
+            ntlm: "ntlm";
+        }>;
+        username: z.ZodOptional<z.ZodString>;
+        passwordRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        workstation: z.ZodOptional<z.ZodString>;
+        preemptive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"inherit">;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        tokenRef: z.ZodOptional<z.ZodString>;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        scheme: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key">;
+        name: z.ZodString;
+        valueRef: z.ZodOptional<z.ZodString>;
+        valueEnv: z.ZodOptional<z.ZodString>;
+        in: z.ZodEnum<{
+            header: "header";
+            query: "query";
+        }>;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth2">;
+        grant: z.ZodEnum<{
+            "client-credentials": "client-credentials";
+            "authorization-code": "authorization-code";
+        }>;
+        tokenUrl: z.ZodString;
+        authorizationUrl: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodString;
+        clientSecretRef: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        audience: z.ZodOptional<z.ZodString>;
+        clientAuth: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            body: "body";
+        }>>;
+        pkce: z.ZodDefault<z.ZodBoolean>;
+        refreshTokenRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>]>>;
+    definition: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodLiteral<"asyncapi">;
+        source: z.ZodString;
+        cache: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/**
+ * Refuses a document whose `kind` this build does not know how to honour — a protocol a later
+ * release adds, or a typo — before schema validation, so the error says what is actually wrong
+ * ("this build cannot open a graphql document") instead of "expected 'rest', received 'graphql'",
+ * and so a project written by a future build fails loudly rather than losing its requests to a
+ * dropped unknown key. `grpc` was the reserved name this guard existed for until the gRPC client
+ * arrived; it stays for whatever comes next.
+ *
+ * @throws ProjectError `project-kind-not-supported`
+ */
+export declare function assertSupportedKind(document: unknown, file: string): void;
+/** The `kind` of an `api.yaml`, read ahead of full validation so the loader knows which schema applies. */
+export declare function apiKindOf(document: unknown): 'rest' | 'grpc' | 'websocket';
+/** `environments/<slug>.yaml`. */
+export declare const environmentFileSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    endpoints: z.ZodRecord<z.ZodString, z.ZodString>;
+    properties: z.ZodRecord<z.ZodString, z.ZodString>;
+    disabled: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+/** One entry of an outgoing WS-Security configuration, as this build understands it. */
+export declare const wssEntrySchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"timestamp">;
+    timeToLiveSeconds: z.ZodNumber;
+    millisecondPrecision: z.ZodBoolean;
+}, z.core.$loose>, z.ZodObject<{
+    kind: z.ZodLiteral<"username-token">;
+    username: z.ZodString;
+    passwordRef: z.ZodOptional<z.ZodString>;
+    passwordType: z.ZodEnum<{
+        none: "none";
+        text: "text";
+        digest: "digest";
+    }>;
+    addNonce: z.ZodBoolean;
+    addCreated: z.ZodBoolean;
+}, z.core.$loose>, z.ZodObject<{
+    kind: z.ZodLiteral<"signature">;
+    keystoreRef: z.ZodDefault<z.ZodString>;
+    alias: z.ZodOptional<z.ZodString>;
+    keyPasswordRef: z.ZodOptional<z.ZodString>;
+    keyIdentifierType: z.ZodDefault<z.ZodEnum<{
+        BinarySecurityToken: "BinarySecurityToken";
+        IssuerSerial: "IssuerSerial";
+        SubjectKeyIdentifier: "SubjectKeyIdentifier";
+        X509KeyIdentifier: "X509KeyIdentifier";
+        Thumbprint: "Thumbprint";
+    }>>;
+    signatureAlgorithm: z.ZodDefault<z.ZodEnum<{
+        "rsa-sha256": "rsa-sha256";
+        "rsa-sha1": "rsa-sha1";
+    }>>;
+    digestAlgorithm: z.ZodDefault<z.ZodEnum<{
+        sha256: "sha256";
+        sha1: "sha1";
+    }>>;
+    canonicalization: z.ZodDefault<z.ZodLiteral<"exc-c14n">>;
+    useSingleCertificate: z.ZodDefault<z.ZodBoolean>;
+    parts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        namespace: z.ZodString;
+        encode: z.ZodEnum<{
+            Content: "Content";
+            Element: "Element";
+        }>;
+    }, z.core.$loose>>>;
+}, z.core.$loose>, z.ZodObject<{
+    kind: z.ZodLiteral<"encryption">;
+    keystoreRef: z.ZodDefault<z.ZodString>;
+    alias: z.ZodOptional<z.ZodString>;
+    keyIdentifierType: z.ZodDefault<z.ZodEnum<{
+        BinarySecurityToken: "BinarySecurityToken";
+        IssuerSerial: "IssuerSerial";
+        SubjectKeyIdentifier: "SubjectKeyIdentifier";
+        X509KeyIdentifier: "X509KeyIdentifier";
+        Thumbprint: "Thumbprint";
+    }>>;
+    symmetricAlgorithm: z.ZodDefault<z.ZodEnum<{
+        "aes128-cbc": "aes128-cbc";
+        "aes256-cbc": "aes256-cbc";
+        "aes128-gcm": "aes128-gcm";
+        "aes256-gcm": "aes256-gcm";
+    }>>;
+    keyTransportAlgorithm: z.ZodDefault<z.ZodEnum<{
+        "rsa-oaep": "rsa-oaep";
+        "rsa-1_5": "rsa-1_5";
+    }>>;
+    embedKey: z.ZodDefault<z.ZodBoolean>;
+    encryptSymmetricKey: z.ZodDefault<z.ZodBoolean>;
+    parts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        namespace: z.ZodString;
+        encode: z.ZodEnum<{
+            Content: "Content";
+            Element: "Element";
+        }>;
+    }, z.core.$loose>>>;
+}, z.core.$loose>]>;
+/** `wss/outgoing/<name>.yaml`. */
+export declare const wssOutgoingFileSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    defaultAlias: z.ZodOptional<z.ZodString>;
+    defaultPasswordRef: z.ZodOptional<z.ZodString>;
+    actor: z.ZodOptional<z.ZodString>;
+    mustUnderstand: z.ZodOptional<z.ZodBoolean>;
+    entries: z.ZodOptional<z.ZodArray<z.ZodObject<{}, z.core.$loose>>>;
+}, z.core.$loose>;
+/**
+ * `wss/incoming/<name>.yaml`. Tolerant in the same way the outgoing entries are: every field
+ * but `id`/`name` defaults, so a document written by an older build (which had only the two
+ * keystore refs) loads as a complete configuration rather than being rejected.
+ */
+export declare const wssIncomingFileSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    decryptKeystoreRef: z.ZodOptional<z.ZodString>;
+    decryptAlias: z.ZodOptional<z.ZodString>;
+    decryptKeyPasswordRef: z.ZodOptional<z.ZodString>;
+    signatureKeystoreRef: z.ZodOptional<z.ZodString>;
+    requireSignature: z.ZodOptional<z.ZodBoolean>;
+    requireTimestamp: z.ZodOptional<z.ZodBoolean>;
+    timestampSkewSeconds: z.ZodOptional<z.ZodNumber>;
+    verifyChain: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/**
+ * One `wss/keystores.yaml` entry: mirrors the engine's `KeystoreDef`. `looseObject` so a field
+ * a later build adds survives a load/save round trip through this one. Never a password — only
+ * a `secretRef` the host resolves through `safeStorage`.
+ */
+export declare const keystoreEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    path: z.ZodString;
+    type: z.ZodEnum<{
+        pkcs12: "pkcs12";
+        pem: "pem";
+    }>;
+    passwordSecretRef: z.ZodOptional<z.ZodString>;
+    passwordEnv: z.ZodOptional<z.ZodString>;
+    defaultAlias: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+/** `wss/keystores.yaml` — the project's client keystore registry. */
+export declare const keystoresFileSchema: z.ZodObject<{
+    keystores: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        path: z.ZodString;
+        type: z.ZodEnum<{
+            pkcs12: "pkcs12";
+            pem: "pem";
+        }>;
+        passwordSecretRef: z.ZodOptional<z.ZodString>;
+        passwordEnv: z.ZodOptional<z.ZodString>;
+        defaultAlias: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/** One document entry inside `interfaces/<slug>/definition/manifest.yaml`. */
+declare const definitionCacheDocumentSchema: z.ZodObject<{
+    file: z.ZodString;
+    location: z.ZodString;
+    requestedLocation: z.ZodOptional<z.ZodString>;
+    kind: z.ZodEnum<{
+        wsdl: "wsdl";
+        xsd: "xsd";
+    }>;
+    sha256: z.ZodString;
+    bytes: z.ZodNumber;
+    importedBy: z.ZodOptional<z.ZodString>;
+    namespace: z.ZodOptional<z.ZodString>;
+    chameleonFor: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+/** `interfaces/<slug>/definition/manifest.yaml`. */
+export declare const definitionCacheManifestSchema: z.ZodObject<{
+    formatVersion: z.ZodLiteral<1>;
+    rootLocation: z.ZodString;
+    fetchedAt: z.ZodString;
+    documents: z.ZodArray<z.ZodObject<{
+        file: z.ZodString;
+        location: z.ZodString;
+        requestedLocation: z.ZodOptional<z.ZodString>;
+        kind: z.ZodEnum<{
+            wsdl: "wsdl";
+            xsd: "xsd";
+        }>;
+        sha256: z.ZodString;
+        bytes: z.ZodNumber;
+        importedBy: z.ZodOptional<z.ZodString>;
+        namespace: z.ZodOptional<z.ZodString>;
+        chameleonFor: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/** One entry of `apis/<slug>/definition/manifest.yaml`. */
+declare const apiDefinitionCacheDocumentSchema: z.ZodObject<{
+    file: z.ZodString;
+    location: z.ZodString;
+    requestedLocation: z.ZodOptional<z.ZodString>;
+    sha256: z.ZodString;
+    bytes: z.ZodNumber;
+}, z.core.$loose>;
+/**
+ * `apis/<slug>/definition/manifest.yaml`. Its own schema rather than the WSDL one because an
+ * OpenAPI document has no `kind`, `namespace` or `importedBy` to record — a JSON or YAML file
+ * references its siblings by location and nothing else.
+ */
+export declare const apiDefinitionCacheManifestSchema: z.ZodObject<{
+    formatVersion: z.ZodLiteral<1>;
+    rootLocation: z.ZodString;
+    fetchedAt: z.ZodString;
+    declaredVersion: z.ZodOptional<z.ZodString>;
+    documents: z.ZodArray<z.ZodObject<{
+        file: z.ZodString;
+        location: z.ZodString;
+        requestedLocation: z.ZodOptional<z.ZodString>;
+        sha256: z.ZodString;
+        bytes: z.ZodNumber;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/**
+ * `apis/<slug>/definition/manifest.yaml` for a gRPC API: the `.proto` files an import was made of,
+ * each stored byte-exact under `protos/` at its import path so the set loads again exactly as the
+ * imports spell it. The `kind` tells a reader which of the two API manifests it has.
+ */
+export declare const protoDefinitionCacheManifestSchema: z.ZodObject<{
+    formatVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"proto">;
+    source: z.ZodString;
+    fetchedAt: z.ZodString;
+    roots: z.ZodArray<z.ZodString>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+        bytes: z.ZodNumber;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/** The proto definition cache manifest as persisted. */
+export type ProtoDefinitionCacheManifest = z.infer<typeof protoDefinitionCacheManifestSchema>;
+/**
+ * `apis/<slug>/definition/manifest.yaml` for a gRPC API discovered by server reflection: one binary
+ * `FileDescriptorSet` beside it, because a server describes itself in the compiler's own output and
+ * there is no `.proto` text to keep. The `kind` is what tells the two gRPC manifests apart.
+ */
+export declare const descriptorDefinitionCacheManifestSchema: z.ZodObject<{
+    formatVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"descriptors">;
+    source: z.ZodString;
+    fetchedAt: z.ZodString;
+    roots: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    reflectionVersion: z.ZodOptional<z.ZodEnum<{
+        v1: "v1";
+        v1alpha: "v1alpha";
+    }>>;
+    file: z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+        bytes: z.ZodNumber;
+    }, z.core.$loose>;
+}, z.core.$loose>;
+/** The descriptor definition cache manifest as persisted. */
+export type DescriptorDefinitionCacheManifest = z.infer<typeof descriptorDefinitionCacheManifestSchema>;
+/** The API definition cache manifest as persisted. */
+export type ApiDefinitionCacheManifest = z.infer<typeof apiDefinitionCacheManifestSchema>;
+/** One document of an API definition cache, as the manifest records it. */
+export type ApiDefinitionCacheDocument = z.infer<typeof apiDefinitionCacheDocumentSchema>;
+/** The definition cache manifest as persisted. */
+export type DefinitionCacheManifest = z.infer<typeof definitionCacheManifestSchema>;
+/** One document entry inside a definition cache manifest. */
+export type DefinitionCacheDocument = z.infer<typeof definitionCacheDocumentSchema>;
+/** The manifest document as persisted. */
+export type ManifestFile = z.infer<typeof manifestSchema>;
+/** An interface document as persisted. */
+export type InterfaceFile = z.infer<typeof interfaceFileSchema>;
+/** A request document as persisted (envelope excluded). */
+export type RequestFile = z.infer<typeof requestFileSchema>;
+/** An environment document as persisted. */
+export type EnvironmentFile = z.infer<typeof environmentFileSchema>;
+/** One table row as persisted (params, query, headers, form fields). */
+export type KeyValueEntryFile = z.infer<typeof keyValueEntrySchema>;
+/** An API document as persisted. */
+export type ApiFile = z.infer<typeof apiFileSchema>;
+/** A folder document as persisted. */
+export type RestFolderFile = z.infer<typeof restFolderFileSchema>;
+/** A REST request document as persisted (a raw body's text excluded). */
+export type RestRequestFile = z.infer<typeof restRequestFileSchema>;
+/** A gRPC `api.yaml` as parsed. */
+export type GrpcApiFile = z.infer<typeof grpcApiFileSchema>;
+/** A gRPC `*.request.yaml` as parsed. */
+export type GrpcRequestFile = z.infer<typeof grpcRequestFileSchema>;
+/** A WebSocket `api.yaml` as parsed. */
+export type WsApiFile = z.infer<typeof wsApiFileSchema>;
+/** A WebSocket `*.request.yaml` as parsed. */
+export type WsRequestFile = z.infer<typeof wsRequestFileSchema>;
+/**
+ * Validates `value` against `schema`, raising
+ * `ProjectError('project-file-invalid')` carrying the file path and the
+ * individual zod issues when it does not match.
+ */
+export declare function parseFile<T>(schema: z.ZodType<T>, value: unknown, file: string): T;
+export {};