import { z } from 'zod';
export declare const connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
export type ConnectionId = z.infer<typeof connectionId>;
/** Vertical vocabulary, like `scope.vertical`: 'scrive', 'fortnox', 'visma'. */
export declare const connectionProvider: z.ZodString;
export declare const connectionStatus: z.ZodEnum<{
    active: "active";
    error: "error";
    expired: "expired";
    revoked: "revoked";
}>;
export type ConnectionStatus = z.infer<typeof connectionStatus>;
/**
 * A connection as the directory holds it.
 *
 * Keyed on **(tenant, vertical, provider, account)** rather than tenant alone
 * (connections.md §3.1.1): a vertical is a blast-radius boundary (D-30) and
 * verticals are built by different companies (D-33), so one vendor's host code
 * must not reach a credential another vendor connected. It also matches how
 * OAuth issues clients — two vendors acting for one tenant hold two clients.
 * The account leg is `externalAccountRef` (Vercel's "Git namespace" shape): one
 * tenant may hold the SAME provider under several external accounts — two
 * GitHub orgs, say — and each is its own connection. Providers that never set
 * an account ref collapse back to one live connection per (tenant, vertical,
 * provider), the pre-#101-widening behavior.
 */
export declare const connection: z.ZodObject<{
    id: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    vertical: z.ZodString;
    provider: z.ZodString;
    label: z.ZodString;
    status: z.ZodEnum<{
        active: "active";
        error: "error";
        expired: "expired";
        revoked: "revoked";
    }>;
    externalAccountRef: z.ZodNullable<z.ZodString>;
    scopes: z.ZodArray<z.ZodString>;
    expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    lastOkAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    lastError: z.ZodNullable<z.ZodString>;
    lastErrorAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    createdBy: z.ZodString;
    createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    revokedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
}, z.core.$strip>;
export type Connection = z.infer<typeof connection>;
/**
 * The credential, as the caller supplies it.
 *
 * Deliberately an opaque string map rather than a typed OAuth shape: an API-token
 * provider carries `{ token }`, OAuth2 carries `{ accessToken, refreshToken }`,
 * and mTLS carries something else again. The hub seals the whole map and never
 * interprets it — interpreting it is the connector's job, and a typed union here
 * would make the kernel learn each provider, which is precisely the coupling
 * D-18's triage rule keeps out.
 */
export declare const connectionSecret: z.ZodRecord<z.ZodString, z.ZodString>;
export type ConnectionSecret = z.infer<typeof connectionSecret>;
export declare const createConnectionInput: z.ZodObject<{
    id: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    vertical: z.ZodString;
    provider: z.ZodString;
    label: z.ZodString;
    externalAccountRef: z.ZodOptional<z.ZodString>;
    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
    expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    secret: z.ZodRecord<z.ZodString, z.ZodString>;
    createdBy: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export type CreateConnectionInput = z.input<typeof createConnectionInput>;
export declare const connectionFilter: z.ZodObject<{
    tenantId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
    vertical: z.ZodOptional<z.ZodString>;
    provider: z.ZodOptional<z.ZodString>;
    externalAccountRef: z.ZodOptional<z.ZodString>;
    includeRevoked: z.ZodOptional<z.ZodBoolean>;
}, z.core.$strip>;
export type ConnectionFilter = z.infer<typeof connectionFilter>;
/**
 * A connection with its credential opened — what a connector receives, and the
 * only shape in the system that carries plaintext.
 *
 * Never returned by an audited `HostAdmin` read, never logged, never serialized
 * into an event. It exists for the duration of one connector call.
 */
export interface OpenConnection {
    id: ConnectionId;
    tenantId: string;
    vertical: string;
    provider: string;
    secret: ConnectionSecret;
    expiresAt: string | null;
}
/**
 * One provider-named fact about a connection — the readable half of a probe or an
 * activity row. A pair, not a typed union, deliberately: the platform must be able to
 * show 'Company: Nordljus AB' or 'BankID to sign: disabled' without learning what
 * either means. The provider decides what is worth saying; the console renders it.
 */
export declare const connectionFact: z.ZodObject<{
    label: z.ZodString;
    value: z.ZodString;
}, z.core.$strip>;
export type ConnectionFact = z.infer<typeof connectionFact>;
/**
 * What a **probe** answers (#605): did this credential just work, and whose account is
 * it? A connection's health (§3.7) is written by whatever call happened last, which
 * means a freshly connected credential has no health at all until the first real
 * dispatch — possibly days later, and possibly a legal document sent to real
 * signatories. A probe is the cheap read that turns "stored" into "verified" on the
 * spot, and it rides the sanctioned `fetch`, so it refreshes health as a side effect.
 *
 * Provider-agnostic on purpose: `control-plane-api` holds no connector and learns no
 * provider's vocabulary. A connector supplies the probe; this is the shape it must
 * answer in.
 */
export declare const connectionProbe: z.ZodObject<{
    ok: z.ZodBoolean;
    refused: z.ZodDefault<z.ZodBoolean>;
    accountRef: z.ZodNullable<z.ZodString>;
    accountLabel: z.ZodNullable<z.ZodString>;
    facts: z.ZodDefault<z.ZodArray<z.ZodObject<{
        label: z.ZodString;
        value: z.ZodString;
    }, z.core.$strip>>>;
    error: z.ZodNullable<z.ZodString>;
}, z.core.$strip>;
export type ConnectionProbe = z.infer<typeof connectionProbe>;
/**
 * One thing a connection **did** (#605) — a projection of the connector's own dispatch
 * ledger (`listConnectorState`), which is the only durable record that an outbound call
 * ever happened. The audit log deliberately holds none of this (`openConnection` is
 * unaudited: one row per outbound HTTP call would drown the log that matters), and
 * health keeps exactly one line, last-write-wins.
 *
 * **Projected by the connector, never read raw.** A ledger row is opaque connector
 * bookkeeping and may hold secrets — Scrive's rows carry the callback capability token —
 * so the platform never serves them as-is. The provider maps its own rows into this
 * declared shape, which is how redaction becomes structural rather than remembered.
 */
export declare const connectionActivityEntry: z.ZodObject<{
    key: z.ZodString;
    title: z.ZodString;
    reference: z.ZodNullable<z.ZodString>;
    status: z.ZodString;
    at: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    facts: z.ZodDefault<z.ZodArray<z.ZodObject<{
        label: z.ZodString;
        value: z.ZodString;
    }, z.core.$strip>>>;
}, z.core.$strip>;
export type ConnectionActivityEntry = z.infer<typeof connectionActivityEntry>;
/**
 * Where a set of activity entries came from (#605). Two genuinely different questions,
 * and a console that answers one while the operator asked the other is worse than one
 * that answers neither:
 *
 * - `ledger` — what THIS platform sent through this connection. Complete for our own
 *   traffic, blind to everything else in the provider account.
 * - `provider` — what the provider currently holds, listed from its own API. Includes
 *   documents nobody here created (someone using Scrive's own UI), and is bounded by
 *   whatever page the connector asked for.
 */
export declare const connectionActivitySource: z.ZodEnum<{
    ledger: "ledger";
    provider: "provider";
}>;
export type ConnectionActivitySource = z.infer<typeof connectionActivitySource>;
export declare const connectionActivity: z.ZodObject<{
    source: z.ZodDefault<z.ZodEnum<{
        ledger: "ledger";
        provider: "provider";
    }>>;
    entries: z.ZodArray<z.ZodObject<{
        key: z.ZodString;
        title: z.ZodString;
        reference: z.ZodNullable<z.ZodString>;
        status: z.ZodString;
        at: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        facts: z.ZodDefault<z.ZodArray<z.ZodObject<{
            label: z.ZodString;
            value: z.ZodString;
        }, z.core.$strip>>>;
    }, z.core.$strip>>;
    live: z.ZodBoolean;
}, z.core.$strip>;
export type ConnectionActivity = z.infer<typeof connectionActivity>;
/**
 * One stored credential field, as a console may see it (#605).
 *
 * The store's rule is that a credential goes in and never comes out: `Connection` cannot
 * carry a secret (contract-tested), and no route returns `connectionSecret`. That rule
 * stands. What it left, though, was a screen where "connected" and "connected with the
 * wrong keys" looked identical, and the only repair offered was to paste all four fields
 * again blind.
 *
 * So this is a deliberate, bounded disclosure with two rules:
 *
 * 1. **Only the connector may produce it.** It knows which of its fields are IDENTIFIERS
 *    (Scrive's `clientId`/`tokenId` — the labels its own UI calls "credentials
 *    identifier") and which are secrets. The platform cannot guess, and must not.
 * 2. **A secret field is never returned whole.** `masked: true` means the value has been
 *    reduced — the shipped rule is a bullet run plus the last four characters, enough to
 *    tell two credentials apart by eye and not enough to use. A short value is masked
 *    entirely rather than mostly revealed.
 */
export declare const connectionCredentialField: z.ZodObject<{
    key: z.ZodString;
    label: z.ZodString;
    value: z.ZodString;
    masked: z.ZodBoolean;
}, z.core.$strip>;
export type ConnectionCredentialField = z.infer<typeof connectionCredentialField>;
export declare const connectionCredential: z.ZodObject<{
    fields: z.ZodArray<z.ZodObject<{
        key: z.ZodString;
        label: z.ZodString;
        value: z.ZodString;
        masked: z.ZodBoolean;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type ConnectionCredential = z.infer<typeof connectionCredential>;
/**
 * A cell sealed to a recipient's public key (#687) — the shape a
 * `SealedSecret` takes when it travels as DATA rather than as a kernel type.
 *
 * Structurally identical to the kernel's `SealedSecret`, and declared here for
 * the reason every other travelling shape is: an engine and a connector both
 * have to parse it at their own boundary ("parse, don't trust"), and neither may
 * depend on the other. `ciphertext` is opaque to everything but the holder of
 * the named private half — the console, the timeline and every future consumer
 * of a payload carrying one read it as bytes and nothing more.
 *
 * `keyId` is not decoration: a cell that cannot name its key can only ever have
 * one key, and rotating retroactively becomes impossible the day a second exists
 * (signature-contact-carrier.md D-4).
 */
export declare const sealedCell: z.ZodObject<{
    keyId: z.ZodString;
    ciphertext: z.ZodString;
}, z.core.$strip>;
export type SealedCell = z.infer<typeof sealedCell>;
/**
 * A connection's PUBLIC sealing key as it travels into a deployment (#687) —
 * delivered with provision/reconcile exactly as entitlements (#310), identity
 * links (#406) and connection grants (#592) are, and projected into the scope so
 * module code can seal a value TO the connector before emitting it.
 *
 * **The private half is never here and can never be.** Projecting a secret key
 * into a scope is precisely the failure kernel-design §13.1 names — a key
 * restored by the same dump that restores its ciphertext reverses every erasure
 * the restore rolled past. §2 of the carrier design closes that door; it says
 * nothing about a public key, and that gap is the whole mechanism. Projecting
 * this leaks nothing: it lets a scope WRITE to the connector, never read.
 *
 * Keyed by `provider` as well as `connectionId` because that is what module code
 * knows. An engine emitting `method: 'scrive'` has no connection id and must not
 * acquire one — connection identity is the host's business.
 */
export declare const projectedConnectionKey: z.ZodObject<{
    connectionId: z.ZodString;
    provider: z.ZodString;
    keyId: z.ZodString;
    publicKey: z.ZodString;
}, z.core.$strip>;
export type ProjectedConnectionKey = z.infer<typeof projectedConnectionKey>;
//# sourceMappingURL=connections.d.ts.map