import { z } from 'zod';
import { type EntityHistoryInput, type EventCauseInput, type EventEffectsInput, type InvocationEventsInput, type DeadLettersInput, type EventFacetInput, type QueryScopeInput, type ReadScopeTableInput } from './introspection.js';
import type { DenialFilter } from './denial.js';
export declare const adminAction: z.ZodEnum<{
    activateScope: "activateScope";
    addMember: "addMember";
    admitVersion: "admitVersion";
    archiveScope: "archiveScope";
    assignRole: "assignRole";
    beginImpersonation: "beginImpersonation";
    bindHostname: "bindHostname";
    bindScopeVersion: "bindScopeVersion";
    createConnection: "createConnection";
    createOrg: "createOrg";
    createTenant: "createTenant";
    defineRole: "defineRole";
    deleteSnapshot: "deleteSnapshot";
    deleteVertical: "deleteVertical";
    drainAccessLog: "drainAccessLog";
    drainEvents: "drainEvents";
    endImpersonation: "endImpersonation";
    grant: "grant";
    grantEntitlement: "grantEntitlement";
    grantToConnection: "grantToConnection";
    grantToOrg: "grantToOrg";
    grantToSystem: "grantToSystem";
    importScope: "importScope";
    linkIdentity: "linkIdentity";
    markScopeProvisioned: "markScopeProvisioned";
    promoteVersion: "promoteVersion";
    provisionBlobStore: "provisionBlobStore";
    provisionScope: "provisionScope";
    provisionTenantStore: "provisionTenantStore";
    pruneAccessLog: "pruneAccessLog";
    publishVersion: "publishVersion";
    reapScope: "reapScope";
    reapTenant: "reapTenant";
    redrainEvents: "redrainEvents";
    registerIdentityPool: "registerIdentityPool";
    registerVertical: "registerVertical";
    rejectVersion: "rejectVersion";
    removeMember: "removeMember";
    requestPublish: "requestPublish";
    restoreDirectory: "restoreDirectory";
    restoreScope: "restoreScope";
    revokeConnection: "revokeConnection";
    revokeEntitlement: "revokeEntitlement";
    rewindScope: "rewindScope";
    setHostnameIssuance: "setHostnameIssuance";
    setHostnameStatus: "setHostnameStatus";
    setIssueStatus: "setIssueStatus";
    setScopeExpiresAt: "setScopeExpiresAt";
    setScopeServingRef: "setScopeServingRef";
    setTenantName: "setTenantName";
    setTenantStatus: "setTenantStatus";
    setVerticalEmailSender: "setVerticalEmailSender";
    setVerticalInstallsBlocked: "setVerticalInstallsBlocked";
    setVerticalListed: "setVerticalListed";
    setVerticalServing: "setVerticalServing";
    setVerticalTenantProvisioner: "setVerticalTenantProvisioner";
    shredSubject: "shredSubject";
    suspendScope: "suspendScope";
    unarchiveScope: "unarchiveScope";
    unassignRole: "unassignRole";
    unbindHostname: "unbindHostname";
    unlinkIdentity: "unlinkIdentity";
    unsuspendScope: "unsuspendScope";
    updateConnectionSecret: "updateConnectionSecret";
}>;
export type AdminAction = z.infer<typeof adminAction>;
/**
 * What a `shredSubject` did (#37) — the receipt a DSAR response is written from.
 *
 * Deliberately counts rather than ids: naming the events erased about a person would
 * rebuild, in the append-only admin log, a pointer to exactly what was supposed to
 * disappear. The counts are what proves the erasure ran; the `subjectId` (a ULID, already
 * pseudonymous) is what ties it to the request.
 */
export declare const subjectShredReceipt: z.ZodObject<{
    subjectId: z.ZodString;
    eventsRedacted: z.ZodNumber;
    keyDestroyed: z.ZodBoolean;
    tombstoned: z.ZodBoolean;
}, z.core.$strip>;
export type SubjectShredReceipt = z.infer<typeof subjectShredReceipt>;
/**
 * One entitlement grant, widened from a bare SKU flag to express a plan (#33):
 * quota, expiry, tier. The paying customer is the vertical builder (D-33), so
 * these fields describe the builder's subscription — the tenants underneath are
 * what the plan is measured in.
 *
 * `expiresAt` is the subscription boundary and the one field the kernel itself
 * enforces: an expired grant fails closed at the per-invoke gate, exactly as if
 * revoked — checked lazily at read like permission tuples, never swept. The row
 * stays visible in `listEntitlements` so a lapsed trial can be renewed.
 *
 * `quota` and `plan` are expression only: the store records "500 work orders/mo
 * on 'pro'" but counting usage against it is the consumer's job (the builder
 * portal, control-plane.md §5's meters). A null quota is today's boolean flag;
 * a null plan is an ungrouped key.
 */
export declare const entitlementGrant: z.ZodObject<{
    entitlementKey: z.ZodString;
    expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    quota: z.ZodNullable<z.ZodNumber>;
    plan: z.ZodNullable<z.ZodString>;
    grantedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    grantedBy: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">>;
}, z.core.$strip>;
export type EntitlementGrant = z.infer<typeof entitlementGrant>;
/**
 * What an operation handler reads through `ctx.entitlement(key)` / `ctx.entitlements()`
 * (#304) — the request-time, in-scope view of a grant. A deliberately narrower shape than
 * `entitlementGrant`: it drops the audit fields (`grantedAt`/`grantedBy`) a running vertical
 * has no business acting on, and it only ever names a **currently-held** entitlement —
 * expiry is applied at read (an expired grant is absent from the view, exactly as it is
 * absent from the gate), so a returned view is by construction live.
 *
 * `plan` and `quota` are carried but **not** enforced by the kernel (#33): the vertical
 * reads the number and enforces its own quota; the kernel enforces only presence + expiry.
 * On a hosted vertical this is read from the scope-local projection (scope-local-permissions.md),
 * never a control-plane binding.
 */
export declare const entitlementView: z.ZodObject<{
    key: z.ZodString;
    plan: z.ZodNullable<z.ZodString>;
    quota: z.ZodNullable<z.ZodNumber>;
    expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
}, z.core.$strip>;
export type EntitlementView = z.infer<typeof entitlementView>;
/**
 * The plan half of a grant call. PATCH semantics, deliberately: an omitted field
 * PRESERVES what the row already carries, an explicit null clears it. Re-granting
 * on an idempotent path (re-provisioning grants keys freely) must not silently
 * turn a trial perpetual by erasing its expiry.
 */
export declare const entitlementGrantInput: z.ZodObject<{
    expiresAt: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>>;
    quota: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    plan: z.ZodOptional<z.ZodNullable<z.ZodString>>;
}, z.core.$strip>;
export type EntitlementGrantInput = z.input<typeof entitlementGrantInput>;
/**
 * The neutral identity seam (D-16; control-plane.md §6 "principal derivation").
 * An auth adapter at the edge (Better Auth, an OIDC issuer, …) authenticates a
 * user and maps its external identity to a Substrat principal + home node. The
 * kernel never learns HOW a caller authenticated, only WHO they are — the
 * mechanism stays a swappable adapter. Authentication only: authorization is
 * roles/grants, and `provider` keeps N adapters (and OIDC upstreams) distinct.
 */
export declare const identityLink: z.ZodObject<{
    provider: z.ZodString;
    externalId: z.ZodString;
    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
}, z.core.$strip>;
export type IdentityLink = z.infer<typeof identityLink>;
/**
 * One tenant's identity link as it travels INTO a deployment (#406) — the shape the
 * platform delivers with provisioning/reconcile and the vertical projects into its
 * scope, alongside entitlements (#310). No `tenantId`: the payload is already scoped
 * to one tenant, and carrying it per-row would invite a mismatch with the address the
 * platform provisioned. The control plane stays the audited source of truth; a
 * projected link is a read-time copy, replaced wholesale on the next projection.
 */
export declare const projectedIdentityLink: z.ZodObject<{
    provider: z.ZodString;
    externalId: z.ZodString;
    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
    scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
}, z.core.$strip>;
export type ProjectedIdentityLink = z.infer<typeof projectedIdentityLink>;
/**
 * A hosted scope's OWNER SEAT as the platform sees it (#925). The seat is minted empty at
 * provision — the platform knows the principal it minted but not the login the tenant's
 * issuer will emit — and bound later by a verified subject. `unclaimed` is the state that
 * used to be invisible: an instance nobody has signed in to, reachable by whoever signs in
 * first. `firstSignIn` says whether that plain path is still open (it closes on a window
 * after provision); `claimLink` says whether a platform-minted claim link is outstanding.
 * `unknown` ⇒ the vertical keeps no record of this scope (never provisioned through its
 * directory). Read from the vertical's `/internal/owner-seat`, relayed to the dashboard.
 */
export declare const ownerSeat: z.ZodObject<{
    state: z.ZodEnum<{
        claimed: "claimed";
        unclaimed: "unclaimed";
        unknown: "unknown";
    }>;
    owner: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
    firstSignIn: z.ZodNullable<z.ZodObject<{
        open: z.ZodBoolean;
        until: z.ZodNullable<z.ZodString>;
    }, z.core.$strip>>;
    claimLink: z.ZodNullable<z.ZodObject<{
        expiresAt: z.ZodString;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type OwnerSeat = z.infer<typeof ownerSeat>;
/**
 * A freshly minted owner-claim link (#925): the URL the installer opens to bind their login
 * to the seat, and when it stops working. The token is IN the URL and nowhere else — the
 * vertical stores only its hash, and no caller persists this shape; it rides one exchange
 * from the vertical through the control plane to the dashboard's screen.
 */
export declare const ownerClaimLink: z.ZodObject<{
    claimUrl: z.ZodString;
    expiresAt: z.ZodString;
}, z.core.$strip>;
export type OwnerClaimLink = z.infer<typeof ownerClaimLink>;
/**
 * How an identity pool relates to tenants (K-23) — the fact that decides whether the
 * same `externalId` seen in two tenants is one human or two.
 *
 * `central`: one pool serving many tenants. The same external subject IS the same
 * person everywhere, which is what lets one login belong to several tenants (§4.3's
 * staff case, and a branded multi-tenant consumer product like RallyPoint).
 *
 * `tenant-bound`: one pool serving exactly one tenant. Subject ids are unique only
 * within it, so the same `externalId` in another tenant is a DIFFERENT person — the
 * white-label case, where a consumer of two shops is correctly two accounts.
 *
 * Topology, not audience. The audiences in §4.3 are descriptive; this is enforceable.
 */
export declare const poolTopology: z.ZodEnum<{
    central: "central";
    "tenant-bound": "tenant-bound";
}>;
export type PoolTopology = z.infer<typeof poolTopology>;
/**
 * A registered identity provider. `provider` names exactly one pool, so separate
 * per-tenant deployments take distinct provider strings (`oidc:<issuer>`) — which the
 * `identityLink` comment above already assumed.
 *
 * `tenantId` is non-null exactly when `topology` is `tenant-bound`: it is the one
 * tenant that pool may serve, and linking into any other is refused.
 */
export declare const identityPool: z.ZodObject<{
    provider: z.ZodString;
    topology: z.ZodEnum<{
        central: "central";
        "tenant-bound": "tenant-bound";
    }>;
    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
}, z.core.$strip>;
export type IdentityPool = z.infer<typeof identityPool>;
/**
 * What the directory knows about an authenticated external identity, once the caller
 * has said WHICH tenant's pool it came from.
 *
 * No `tenantId` here on purpose. The lookup takes the tenant as input (§4.3: with one
 * auth pool per white-label tenant, an external subject id is unique only *within* its
 * pool), so echoing it back would invite the very mental model this fixes — that the
 * directory derives the tenant from the identity. You tell it which tenant; it tells
 * you who.
 */
export declare const resolvedIdentity: z.ZodObject<{
    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
}, z.core.$strip>;
export type ResolvedIdentity = z.infer<typeof resolvedIdentity>;
/**
 * One tenant a central-pool login belongs to, with everything a team switcher and a
 * per-request resolve need beside it — so "which teams, who am I in each, and where do
 * I land" is ONE directory read instead of one per tenant.
 *
 * Unlike `resolvedIdentity` this DOES carry the tenant, and that is the point rather
 * than a contradiction of the note above: the read it rides is the cross-tenant one
 * (`listIdentityMemberships`), which exists only on a central pool, where the same
 * `externalId` is by declaration the same person in every tenant.
 *
 * The tenant arrives whole, `status` included, and non-active tenants are NOT filtered
 * out: whether a `deleting` team should still resolve is the caller's policy. `scope`
 * is the scope the link was made in, joined to its directory row so the caller can tell
 * which vertical it runs without a second read; null when the link named no scope or
 * the scope row is gone.
 */
export declare const identityMembership: z.ZodObject<{
    tenant: z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        slug: z.ZodString;
        name: z.ZodString;
        status: z.ZodEnum<{
            active: "active";
            deleting: "deleting";
            reaped: "reaped";
            suspended: "suspended";
        }>;
        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
        deletingAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        provisionedByTenant: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
    }, z.core.$strip>;
    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
    scope: z.ZodNullable<z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
        vertical: z.ZodNullable<z.ZodString>;
        status: z.ZodString;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type IdentityMembership = z.infer<typeof identityMembership>;
/**
 * One staff READ of the directory (K-24). Separate from `adminLogEntry` because a
 * mutation is permanent evidence and a read is operational history — one table would
 * force one retention policy on both.
 *
 * `resultCount` is what separates navigation from an incident: "called listScopes"
 * against "enumerated 4,000 tenants".
 *
 * `drainedAt` marks a row shipped to Tier 2. Only drained rows may be pruned —
 * expiring on age alone would destroy evidence while calling itself retention.
 */
export declare const accessLogEntry: z.ZodObject<{
    id: z.ZodString;
    actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
    method: z.ZodString;
    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    params: z.ZodNullable<z.ZodString>;
    resultCount: z.ZodNumber;
    drainedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
}, z.core.$strip>;
export type AccessLogEntry = z.infer<typeof accessLogEntry>;
/**
 * The scope reads a control plane may record on a vertical's behalf (#1357).
 *
 * A **closed set**, and that is the point rather than tidiness. Recording an access
 * entry from outside an adapter is a new power — until now only an adapter could add a
 * row — so the seam is built so it cannot be used to write an arbitrary one: the method
 * comes from here, and the actor comes from the request context, never from a body.
 *
 * Every member is the name the CO-LOCATED branch already logs for the same read, so an
 * auditor cannot tell which branch served a request from the row it left. That is the
 * whole objective: today a hosted vertical — which is every real deployment — leaves a
 * `getScopeRecord` entry and nothing saying what was read.
 */
export declare const delegatedReadMethod: z.ZodEnum<{
    deadLetters: "deadLetters";
    entityHistory: "entityHistory";
    eventCause: "eventCause";
    eventEffects: "eventEffects";
    facetEvents: "facetEvents";
    invocationEvents: "invocationEvents";
    listDenials: "listDenials";
    listScopeTables: "listScopeTables";
    queryScope: "queryScope";
    readScopeTable: "readScopeTable";
    summarizeDenials: "summarizeDenials";
}>;
export type DelegatedReadMethod = z.infer<typeof delegatedReadMethod>;
/** The route input each delegated read is made with — what `delegatedReadParams` projects. */
export interface DelegatedReadInput {
    readScopeTable: ReadScopeTableInput;
    listScopeTables: null;
    queryScope: QueryScopeInput;
    listDenials: DenialFilter | undefined;
    summarizeDenials: DenialFilter | undefined;
    entityHistory: EntityHistoryInput;
    facetEvents: EventFacetInput;
    eventCause: EventCauseInput;
    eventEffects: EventEffectsInput;
    invocationEvents: InvocationEventsInput;
    deadLetters: DeadLettersInput;
}
/**
 * What the K-24 row for each read carries as `params` — ONE definition, so a delegated
 * row and a co-located row for the same request are the same row.
 *
 * Each projection is exactly what the adapters' co-located branch logs for that method
 * today, and the two are deliberately not the same as "the whole input": a paged history
 * read logs the entity and not its `limit`/`cursor`, a cause walk logs the event and not
 * its `maxDepth`. Log the full input on one branch and the row would carry the paging
 * arguments only when a vertical served it — and an auditor could tell the branches
 * apart, which is the property the seam exists to deny. The API applies this on the
 * delegated path and a test drives every method both ways and compares the rows.
 */
export declare const delegatedReadParams: {
    [M in DelegatedReadMethod]: (input: DelegatedReadInput[M]) => unknown;
};
/**
 * What the control plane reports after a read it delegated to a vertical.
 *
 * Deliberately carries no `id` and no `at`: the adapter stamps both, so a caller cannot
 * backdate a row or collide one with another. `params` is the same argument object the
 * co-located branch logs, truncated by the adapter exactly as that path truncates it.
 */
export declare const delegatedReadRecord: z.ZodObject<{
    method: z.ZodEnum<{
        deadLetters: "deadLetters";
        entityHistory: "entityHistory";
        eventCause: "eventCause";
        eventEffects: "eventEffects";
        facetEvents: "facetEvents";
        invocationEvents: "invocationEvents";
        listDenials: "listDenials";
        listScopeTables: "listScopeTables";
        queryScope: "queryScope";
        readScopeTable: "readScopeTable";
        summarizeDenials: "summarizeDenials";
    }>;
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
    params: z.ZodUnknown;
    resultCount: z.ZodNumber;
}, z.core.$strip>;
export type DelegatedReadRecord = z.infer<typeof delegatedReadRecord>;
/**
 * One principal's membership of one org, as the directory holds it (K-21).
 *
 * `revokedAt` non-null is a **tombstone**: the tuple is still here and still
 * readable, and the permission walk skips it. Deletion is not an option — an
 * operated compliance product has to show both that access was revoked and the
 * trail proving it was once granted (D-32), and a deleted row shows neither.
 *
 * Listing defaults to live members only; revoked rows are the evidence view.
 */
export declare const orgMembership: z.ZodObject<{
    principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
    orgId: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
    revokedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
}, z.core.$strip>;
export type OrgMembership = z.infer<typeof orgMembership>;
/**
 * One recorded operational failure (#559) — the durable answer to "what broke, when,
 * and whose fault was it" that the 2026-08-08 preview-restore incident had nowhere
 * to live. Deliberately NOT the admin log: the audit spine answers "who changed
 * what", and a failure changed nothing — so this is a separate, RETENTION-BOUNDED
 * record (the admin log is the never-swept compliance witness; this is operational
 * telemetry, pruned after `OPS_FAILURE_RETENTION_DAYS` in the adapters).
 *
 * `reference` is the upstream provider's own trace handle when the message carried
 * one (Cloudflare's `internal error; reference = <id>`) — extracted into its own
 * column because it is the one identifier a support ticket needs and the one a
 * CI log hands the operator to search by.
 */
export declare const opsFailureEntry: z.ZodObject<{
    id: z.ZodString;
    actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
    operation: z.ZodString;
    stage: z.ZodNullable<z.ZodString>;
    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    vertical: z.ZodNullable<z.ZodString>;
    version: z.ZodNullable<z.ZodString>;
    status: z.ZodNullable<z.ZodNumber>;
    origin: z.ZodNullable<z.ZodEnum<{
        platform: "platform";
        provider: "provider";
        unknown: "unknown";
    }>>;
    code: z.ZodNullable<z.ZodEnum<{
        conflict: "conflict";
        forbidden: "forbidden";
        internal: "internal";
        not_found: "not_found";
        permission_denied: "permission_denied";
        precondition_failed: "precondition_failed";
        rate_limited: "rate_limited";
        unauthenticated: "unauthenticated";
        unavailable: "unavailable";
        validation_failed: "validation_failed";
    }>>;
    message: z.ZodString;
    reference: z.ZodNullable<z.ZodString>;
    fingerprint: z.ZodNullable<z.ZodString>;
    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
}, z.core.$strip>;
export type OpsFailureEntry = z.infer<typeof opsFailureEntry>;
/**
 * The grouping key for the Issues view (#1233): operation + stage + taxonomy code —
 * deliberately NEVER the message, which is free text full of ULIDs, provider prose
 * and `reference = <id>` handles, and would make every occurrence its own group.
 * U+001F (unit separator) joins the parts: unambiguous with no escaping dance, and
 * the key stays readable in a log line.
 */
export declare function opsFailureFingerprint(f: {
    operation: string;
    stage?: string | null;
    code?: string | null;
}): string;
/**
 * An issue's lifecycle (#1233, Sentry's shape): `new` on first sight; `resolved`
 * and `ignored` are staff verdicts; `regressed` is ingest's word only — a fresh
 * arrival on a resolved issue flips it back into attention, which is the
 * lifecycle's whole retention trick. A fresh arrival on an ignored issue changes
 * nothing: ignoring is a verdict about the future.
 */
export declare const issueStatus: z.ZodEnum<{
    ignored: "ignored";
    new: "new";
    regressed: "regressed";
    resolved: "resolved";
}>;
export type IssueStatus = z.infer<typeof issueStatus>;
/** What a staff verdict may SET — `regressed` is never an input. */
export declare const issueStatusInput: z.ZodEnum<{
    ignored: "ignored";
    new: "new";
    resolved: "resolved";
}>;
export type IssueStatusInput = z.infer<typeof issueStatusInput>;
/**
 * One fingerprint-grouped failure class (#1233). The row OWNS its counters:
 * `count`/`firstSeen` must survive the evidence beneath them, which self-prunes
 * at 90 days — so they are materialized at ingest, never derived by query.
 */
export declare const issueEntry: z.ZodObject<{
    fingerprint: z.ZodString;
    operation: z.ZodString;
    stage: z.ZodNullable<z.ZodString>;
    origin: z.ZodNullable<z.ZodEnum<{
        platform: "platform";
        provider: "provider";
        unknown: "unknown";
    }>>;
    code: z.ZodNullable<z.ZodEnum<{
        conflict: "conflict";
        forbidden: "forbidden";
        internal: "internal";
        not_found: "not_found";
        permission_denied: "permission_denied";
        precondition_failed: "precondition_failed";
        rate_limited: "rate_limited";
        unauthenticated: "unauthenticated";
        unavailable: "unavailable";
        validation_failed: "validation_failed";
    }>>;
    status: z.ZodEnum<{
        ignored: "ignored";
        new: "new";
        regressed: "regressed";
        resolved: "resolved";
    }>;
    count: z.ZodNumber;
    firstSeen: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    lastSeen: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    lastMessage: z.ZodString;
    lastVertical: z.ZodNullable<z.ZodString>;
    lastVersion: z.ZodNullable<z.ZodString>;
    resolvedVersion: z.ZodNullable<z.ZodString>;
    resolvedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
}, z.core.$strip>;
export type IssueEntry = z.infer<typeof issueEntry>;
/** What a sweep pass touched (#1232). More kinds arrive with the views that read them. */
export declare const sweepRunKind: z.ZodEnum<{
    connector: "connector";
    freshness: "freshness";
    schedule: "schedule";
}>;
export type SweepRunKind = z.infer<typeof sweepRunKind>;
/** `skipped` is a first-class outcome: "swept, nothing to do" and "bound but no
 *  sweeper registered" are the facts a freshness view needs most, and the ones
 *  nothing recorded before this table existed. */
export declare const sweepRunOutcome: z.ZodEnum<{
    failed: "failed";
    ok: "ok";
    skipped: "skipped";
}>;
export type SweepRunOutcome = z.infer<typeof sweepRunOutcome>;
/**
 * One unit outcome of one platform sweep pass (#1232) — the durable answer to
 * "when was this connection last swept, and how did it go", which the in-memory
 * `PlatformSweepReport` could never give once its log line rolled off. Per UNIT,
 * never a JSON report per pass: the view's questions ("last run per schedule",
 * "recent-runs strip per connection") are one indexed walk over these rows.
 *
 * Retention-bounded like ops failures, but shorter (`SWEEP_RUN_RETENTION_DAYS`):
 * this is high-frequency telemetry, and the strip plus an incident window is the
 * whole point of keeping it.
 *
 * Every dimension is nullable, and each null is structural, not lazy: a
 * CONNECTION row carries no scope (a connection spans scopes by construction,
 * connections.ts) and no version; a schedule row carries both. `unit` is the
 * identity swept — a connection id, or `<scopeId>:<operation>` for a schedule,
 * matching the id convention the sweep's error entries already use.
 */
export declare const sweepRunEntry: z.ZodObject<{
    id: z.ZodString;
    kind: z.ZodEnum<{
        connector: "connector";
        freshness: "freshness";
        schedule: "schedule";
    }>;
    unit: z.ZodString;
    outcome: z.ZodEnum<{
        failed: "failed";
        ok: "ok";
        skipped: "skipped";
    }>;
    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    vertical: z.ZodNullable<z.ZodString>;
    version: z.ZodNullable<z.ZodString>;
    operation: z.ZodNullable<z.ZodString>;
    eventType: z.ZodNullable<z.ZodString>;
    observedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    connectionId: z.ZodNullable<z.ZodString>;
    error: z.ZodNullable<z.ZodString>;
    elapsedMs: z.ZodNullable<z.ZodNumber>;
    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
}, z.core.$strip>;
export type SweepRunEntry = z.infer<typeof sweepRunEntry>;
/**
 * The CP-less pass's exit (#1232): a hosted vertical's scope sweeper runs its
 * schedules with no control plane in reach, so its outcomes travel as a platform
 * intent the drain lands into `_substrat_sweep_runs` — the model-usage road.
 */
export declare const SWEEP_RUNS_KIND = "sweep-runs";
/**
 * How many `sweep-runs` intents may sit pending in one scope before the sweeper
 * DROPS the next report instead of enqueuing it. Telemetry gets its own low
 * sub-cap so it can never starve the shared 32-slot journal a
 * `provision-sibling` needs — and a drop is silent by design: a pass must never
 * fail, or even slow, because its record could not be queued. The next drained
 * pass reports again, and the gap reads as exactly what it was.
 */
export declare const MAX_PENDING_SWEEP_RUNS = 8;
/**
 * How long a freshness verdict may go unrecorded before the evaluator writes a
 * heartbeat row even though nothing changed (#1232). Freshness writes on CHANGE,
 * not per pass — its steady state is `ok`, so per-pass rows would flood the strip
 * with green (the inverse of the schedule flood, and inside the strip's filter).
 * The heartbeat is what keeps "no rows" unambiguous: a missing hourly row is a
 * stopped evaluator, at exactly the resolution a 24-hour expectation needs.
 */
export declare const FRESHNESS_HEARTBEAT_MINUTES = 60;
/**
 * One scope's schedule outcomes for ONE pass, batched — a pass every couple of
 * minutes times N schedules against the 32-pending journal cap cannot be one
 * intent each. Deliberately carries NO tenant/scope/vertical: the drain proves
 * those from the scope the intent physically lives in (the model-usage rule),
 * so a payload cannot mislabel its origin. `at` is PASS time — the drain runs
 * up to a cron window later, and a freshness view must not be told drain time.
 */
export declare const sweepRunsPayload: z.ZodObject<{
    version: z.ZodNullable<z.ZodString>;
    entries: z.ZodArray<z.ZodObject<{
        kind: z.ZodDefault<z.ZodEnum<{
            connector: "connector";
            freshness: "freshness";
            schedule: "schedule";
        }>>;
        operation: z.ZodOptional<z.ZodString>;
        eventType: z.ZodOptional<z.ZodString>;
        outcome: z.ZodEnum<{
            failed: "failed";
            ok: "ok";
            skipped: "skipped";
        }>;
        at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
        observedAt: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>>;
        error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
        elapsedMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type SweepRunsPayload = z.infer<typeof sweepRunsPayload>;
/**
 * An append-only admin audit row (control-plane.md §4.4). Every field except
 * `before`/`after` is stamped platform-side — never supplied by the caller —
 * for the same reason the kernel is trusted at all (K-4): a surface that can act
 * without a durable record of who acted is worse than no surface.
 *
 * `target` is `(tenantId, scopeId?, vertical?)`. `scopeId`/`vertical` are null
 * for tenant-wide actions; `vertical` stays null until §4.2 lifecycle actions
 * (provision/suspend) that name one.
 */
export declare const adminLogEntry: z.ZodObject<{
    id: z.ZodString;
    actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
    action: z.ZodEnum<{
        activateScope: "activateScope";
        addMember: "addMember";
        admitVersion: "admitVersion";
        archiveScope: "archiveScope";
        assignRole: "assignRole";
        beginImpersonation: "beginImpersonation";
        bindHostname: "bindHostname";
        bindScopeVersion: "bindScopeVersion";
        createConnection: "createConnection";
        createOrg: "createOrg";
        createTenant: "createTenant";
        defineRole: "defineRole";
        deleteSnapshot: "deleteSnapshot";
        deleteVertical: "deleteVertical";
        drainAccessLog: "drainAccessLog";
        drainEvents: "drainEvents";
        endImpersonation: "endImpersonation";
        grant: "grant";
        grantEntitlement: "grantEntitlement";
        grantToConnection: "grantToConnection";
        grantToOrg: "grantToOrg";
        grantToSystem: "grantToSystem";
        importScope: "importScope";
        linkIdentity: "linkIdentity";
        markScopeProvisioned: "markScopeProvisioned";
        promoteVersion: "promoteVersion";
        provisionBlobStore: "provisionBlobStore";
        provisionScope: "provisionScope";
        provisionTenantStore: "provisionTenantStore";
        pruneAccessLog: "pruneAccessLog";
        publishVersion: "publishVersion";
        reapScope: "reapScope";
        reapTenant: "reapTenant";
        redrainEvents: "redrainEvents";
        registerIdentityPool: "registerIdentityPool";
        registerVertical: "registerVertical";
        rejectVersion: "rejectVersion";
        removeMember: "removeMember";
        requestPublish: "requestPublish";
        restoreDirectory: "restoreDirectory";
        restoreScope: "restoreScope";
        revokeConnection: "revokeConnection";
        revokeEntitlement: "revokeEntitlement";
        rewindScope: "rewindScope";
        setHostnameIssuance: "setHostnameIssuance";
        setHostnameStatus: "setHostnameStatus";
        setIssueStatus: "setIssueStatus";
        setScopeExpiresAt: "setScopeExpiresAt";
        setScopeServingRef: "setScopeServingRef";
        setTenantName: "setTenantName";
        setTenantStatus: "setTenantStatus";
        setVerticalEmailSender: "setVerticalEmailSender";
        setVerticalInstallsBlocked: "setVerticalInstallsBlocked";
        setVerticalListed: "setVerticalListed";
        setVerticalServing: "setVerticalServing";
        setVerticalTenantProvisioner: "setVerticalTenantProvisioner";
        shredSubject: "shredSubject";
        suspendScope: "suspendScope";
        unarchiveScope: "unarchiveScope";
        unassignRole: "unassignRole";
        unbindHostname: "unbindHostname";
        unlinkIdentity: "unlinkIdentity";
        unsuspendScope: "unsuspendScope";
        updateConnectionSecret: "updateConnectionSecret";
    }>;
    tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
    scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    vertical: z.ZodNullable<z.ZodString>;
    before: z.ZodNullable<z.ZodUnknown>;
    after: z.ZodNullable<z.ZodUnknown>;
    causedBy: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "EventId", "out">>;
    at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
}, z.core.$strip>;
export type AdminLogEntry = z.infer<typeof adminLogEntry>;
/**
 * The body a hosted vertical POSTs to the control plane's `/internal/email/send` relay (#303).
 * A vertical that holds the `emailSender` grant cannot bind `send_email` itself (WfP dispatch
 * scripts have no such binding and the §4 sandbox refuses it), so it hands the message here and
 * the platform sends it. `(tenantId, scopeId)` name the caller so the relay can resolve the
 * scope's vertical and check the grant against THAT vertical — holding the shared PLATFORM_SECRET
 * is not enough. The FROM address is the platform's onboarded sender, NEVER the vertical's choice;
 * `fromName` is only the display name. Both `html` and `text` are required — the transport port
 * enforces a text part so no provider can drop it.
 */
export declare const emailRelayRequest: z.ZodObject<{
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
    to: z.ZodString;
    subject: z.ZodString;
    html: z.ZodString;
    text: z.ZodString;
    fromName: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export type EmailRelayRequest = z.infer<typeof emailRelayRequest>;
/**
 * The body a hosted vertical POSTs to the control plane's `/internal/connections/upsert`
 * relay (connections.md §3.5.2). Connecting a provider is a TENANT ADMIN's act (§3.5, D-31):
 * the vertical proves it with its own `ctx.check` before the credential ever leaves the
 * operation, then hands the secret here so the platform can seal it into the connection
 * store — the one place plaintext is allowed to rest. Same trust posture as the email
 * relay: `(tenantId, scopeId)` name the caller, the relay re-derives the VERTICAL from the
 * platform's own scope record, and the shared PLATFORM_SECRET never gets to say which
 * vertical it is acting for — so the caller cannot plant a credential on a foreign
 * vertical, and grants cannot reach outside the connection's own (tenant, vertical).
 *
 * Upsert semantics keyed (tenant, vertical, provider, externalAccountRef): no live
 * connection → create; one live → rotate its secret in place (the connection id — and
 * with it every `grantToConnection` tuple — survives rotation). `createdBy` is the
 * authorizing tenant principal, recorded on the connection (create) and in the audit
 * metadata (rotate) — never the platform actor, which would launder the act (§3.5.1).
 */
export declare const connectionRelayRequest: z.ZodObject<{
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
    provider: z.ZodString;
    label: z.ZodOptional<z.ZodString>;
    externalAccountRef: z.ZodOptional<z.ZodString>;
    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
    expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    secret: z.ZodRecord<z.ZodString, z.ZodString>;
    grants: z.ZodDefault<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>>;
    createdBy: z.ZodString;
}, z.core.$strip>;
export type ConnectionRelayRequest = z.infer<typeof connectionRelayRequest>;
/** What the relay answers — metadata only, the secret is never echoed. */
export declare const connectionRelayResult: z.ZodObject<{
    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
    created: z.ZodBoolean;
    granted: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
    probe: z.ZodOptional<z.ZodObject<{
        ok: z.ZodBoolean;
        refused: z.ZodDefault<z.ZodBoolean>;
        accountRef: z.ZodNullable<z.ZodString>;
        accountLabel: z.ZodNullable<z.ZodString>;
        facts: z.ZodDefault<z.ZodArray<z.ZodObject<{
            label: z.ZodString;
            value: z.ZodString;
        }, z.core.$strip>>>;
        error: z.ZodNullable<z.ZodString>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type ConnectionRelayResult = z.infer<typeof connectionRelayResult>;
/**
 * The body a hosted vertical POSTs to `/internal/connections/connect-url` (connections.md
 * §3.5.3) — the OAuth half of the relay above.
 *
 * §3.5.2 covers the provider whose credential the tenant admin already HOLDS and can
 * paste. It cannot cover the provider that mints one only at the end of a browser consent
 * round, because the client credentials for that round are the platform's and the
 * `redirect_uri` is registered once, with the platform. So the vertical cannot run the
 * round — but it is the only place that knows WHICH of a bureau's client companies is
 * being connected, and its users have no dashboard account to run it from either.
 *
 * The division that follows: the vertical's operation is the authorizing act
 * (`ctx.check`, §3.5), this relay turns that act into a URL, and the platform's own
 * callback does everything that touches a credential. What crosses the seam is a link,
 * not an authority — the vertical never learns the client id, the consent code, or the
 * token, and holds nothing new when the round is over.
 *
 * Trust posture is the relay's, unchanged: PLATFORM_SECRET proves only that a platform
 * script is calling, and the VERTICAL is re-derived from this directory's record for the
 * named `(tenantId, scopeId)` — so a caller cannot mint a round that lands a credential
 * on a foreign vertical, and the callback re-derives it a second time from the scope in
 * the signed state.
 */
export declare const connectUrlRelayRequest: z.ZodObject<{
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
    provider: z.ZodString;
    createdBy: z.ZodString;
    returnUrl: z.ZodOptional<z.ZodString>;
    subjectRef: z.ZodOptional<z.ZodString>;
    ttlSeconds: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
export type ConnectUrlRelayRequest = z.infer<typeof connectUrlRelayRequest>;
/** What the connect-url relay answers. No credential exists yet; nothing here is secret. */
export declare const connectUrlRelayResult: z.ZodObject<{
    url: z.ZodString;
    expiresAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    vertical: z.ZodString;
}, z.core.$strip>;
export type ConnectUrlRelayResult = z.infer<typeof connectUrlRelayResult>;
/**
 * A whole tenant, exported (#36) — GDPR Art. 20 portability, and the escrow handover.
 *
 * Deliberately a DIFFERENT shape from `directoryDump` (#40), because they answer
 * different questions and one format cannot serve both honestly:
 *
 * - A **directory dump** is for RECOVERY. It is raw tables for one deployment's whole
 *   directory, complete and byte-faithful so it can be replayed back into a control
 *   plane. It is unreadable to a customer and useless as an answer to "give me my data".
 * - A **tenant export** is for PORTABILITY. It is one tenant's slice, in the platform's
 *   own documented vocabulary (`tenant`, `scope`, `org`, `role`, …) rather than in
 *   SQLite's, so the receiving party can read it without knowing the schema — plus each
 *   scope's data as a `scopeDump`, which is the one part that IS raw, because that is
 *   what makes it reloadable.
 *
 * It is assembled from the SANCTIONED reads (`listScopes`, `listOrgs`, `listRoles`,
 * `listEntitlements`, `listIdentityLinks`, `exportScope`, …), never from a back door
 * into the directory database — control-plane.md §7 forbids the control plane acquiring
 * one, and an export that quietly opened it would be exactly that.
 *
 * `masked` says which fidelity this file is. Masked is the default (the same posture as
 * `scope pull`), so a full-fidelity export is a deliberate, audited act — and an Art. 20
 * fulfilment is deliberate by definition.
 */
export declare const tenantExport: z.ZodObject<{
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    capturedAt: z.ZodString;
    masked: z.ZodBoolean;
    tenant: z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        slug: z.ZodString;
        name: z.ZodString;
        status: z.ZodEnum<{
            active: "active";
            deleting: "deleting";
            reaped: "reaped";
            suspended: "suspended";
        }>;
        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
        deletingAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        provisionedByTenant: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
    }, z.core.$strip>;
    scopes: z.ZodArray<z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        parentScopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
        slug: z.ZodString;
        kind: z.ZodString;
        name: z.ZodString;
        status: z.ZodEnum<{
            active: "active";
            archived: "archived";
            archiving: "archiving";
            provisioning: "provisioning";
            reaped: "reaped";
            suspended: "suspended";
        }>;
        storageShape: z.ZodEnum<{
            A: "A";
            B: "B";
        }>;
        jurisdiction: z.ZodEnum<{
            eu: "eu";
            global: "global";
            us: "us";
        }>;
        vertical: z.ZodNullable<z.ZodString>;
        verticalVersionId: z.ZodNullable<z.ZodString>;
        provisionedVersionId: z.ZodNullable<z.ZodString>;
        schemaVersion: z.ZodString;
        migrationFailure: z.ZodNullable<z.ZodObject<{
            version: z.ZodString;
            error: z.ZodString;
            attempts: z.ZodNumber;
            lastAttemptAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
        }, z.core.$strip>>;
        forkedFrom: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
        forkedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        servingRef: z.ZodOptional<z.ZodNullable<z.ZodString>>;
        archivedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    }, z.core.$strip>>;
    orgs: z.ZodArray<z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        slug: z.ZodString;
        name: z.ZodString;
        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    }, z.core.$strip>>;
    members: z.ZodArray<z.ZodObject<{
        principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
        orgId: z.core.$ZodBranded<z.ZodString, "OrgId", "out">;
        revokedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    }, z.core.$strip>>;
    roles: z.ZodArray<z.ZodObject<{
        key: z.ZodString;
        permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
        source: z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "ModuleId", "out">, z.ZodLiteral<"vertical">]>;
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    }, z.core.$strip>>;
    entitlements: z.ZodArray<z.ZodObject<{
        entitlementKey: z.ZodString;
        expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        quota: z.ZodNullable<z.ZodNumber>;
        plan: z.ZodNullable<z.ZodString>;
        grantedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        grantedBy: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">>;
    }, z.core.$strip>>;
    identityLinks: z.ZodArray<z.ZodObject<{
        provider: z.ZodString;
        externalId: z.ZodString;
        principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
    }, z.core.$strip>>;
    hostnames: z.ZodArray<z.ZodObject<{
        hostname: z.ZodString;
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
        verticalSlug: z.ZodNullable<z.ZodString>;
        surface: z.ZodString;
        region: z.ZodNullable<z.ZodEnum<{
            eu: "eu";
        }>>;
        status: z.ZodEnum<{
            active: "active";
            failed: "failed";
            pending: "pending";
            verifying: "verifying";
        }>;
        statusNote: z.ZodNullable<z.ZodString>;
        canonical: z.ZodBoolean;
        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
        customHostnameId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
        validationRecords: z.ZodDefault<z.ZodArray<z.ZodObject<{
            type: z.ZodEnum<{
                hostname: "hostname";
                txt: "txt";
            }>;
            name: z.ZodString;
            value: z.ZodString;
            status: z.ZodDefault<z.ZodNullable<z.ZodString>>;
        }, z.core.$strip>>>;
    }, z.core.$strip>>;
    stores: z.ZodArray<z.ZodObject<{
        kind: z.ZodEnum<{
            blob: "blob";
            relational: "relational";
        }>;
        vertical: z.ZodString;
        binding: z.ZodString;
        ref: z.ZodString;
        createdAt: z.ZodString;
    }, z.core.$strip>>;
    connections: z.ZodArray<z.ZodObject<{
        id: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        vertical: z.ZodString;
        provider: z.ZodString;
        label: z.ZodString;
        status: z.ZodEnum<{
            active: "active";
            error: "error";
            expired: "expired";
            revoked: "revoked";
        }>;
        externalAccountRef: z.ZodNullable<z.ZodString>;
        scopes: z.ZodArray<z.ZodString>;
        expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        lastOkAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        lastError: z.ZodNullable<z.ZodString>;
        lastErrorAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
        createdBy: z.ZodString;
        createdAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
        revokedAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
    }, z.core.$strip>>;
    adminLog: z.ZodNullable<z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        actor: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
        action: z.ZodEnum<{
            activateScope: "activateScope";
            addMember: "addMember";
            admitVersion: "admitVersion";
            archiveScope: "archiveScope";
            assignRole: "assignRole";
            beginImpersonation: "beginImpersonation";
            bindHostname: "bindHostname";
            bindScopeVersion: "bindScopeVersion";
            createConnection: "createConnection";
            createOrg: "createOrg";
            createTenant: "createTenant";
            defineRole: "defineRole";
            deleteSnapshot: "deleteSnapshot";
            deleteVertical: "deleteVertical";
            drainAccessLog: "drainAccessLog";
            drainEvents: "drainEvents";
            endImpersonation: "endImpersonation";
            grant: "grant";
            grantEntitlement: "grantEntitlement";
            grantToConnection: "grantToConnection";
            grantToOrg: "grantToOrg";
            grantToSystem: "grantToSystem";
            importScope: "importScope";
            linkIdentity: "linkIdentity";
            markScopeProvisioned: "markScopeProvisioned";
            promoteVersion: "promoteVersion";
            provisionBlobStore: "provisionBlobStore";
            provisionScope: "provisionScope";
            provisionTenantStore: "provisionTenantStore";
            pruneAccessLog: "pruneAccessLog";
            publishVersion: "publishVersion";
            reapScope: "reapScope";
            reapTenant: "reapTenant";
            redrainEvents: "redrainEvents";
            registerIdentityPool: "registerIdentityPool";
            registerVertical: "registerVertical";
            rejectVersion: "rejectVersion";
            removeMember: "removeMember";
            requestPublish: "requestPublish";
            restoreDirectory: "restoreDirectory";
            restoreScope: "restoreScope";
            revokeConnection: "revokeConnection";
            revokeEntitlement: "revokeEntitlement";
            rewindScope: "rewindScope";
            setHostnameIssuance: "setHostnameIssuance";
            setHostnameStatus: "setHostnameStatus";
            setIssueStatus: "setIssueStatus";
            setScopeExpiresAt: "setScopeExpiresAt";
            setScopeServingRef: "setScopeServingRef";
            setTenantName: "setTenantName";
            setTenantStatus: "setTenantStatus";
            setVerticalEmailSender: "setVerticalEmailSender";
            setVerticalInstallsBlocked: "setVerticalInstallsBlocked";
            setVerticalListed: "setVerticalListed";
            setVerticalServing: "setVerticalServing";
            setVerticalTenantProvisioner: "setVerticalTenantProvisioner";
            shredSubject: "shredSubject";
            suspendScope: "suspendScope";
            unarchiveScope: "unarchiveScope";
            unassignRole: "unassignRole";
            unbindHostname: "unbindHostname";
            unlinkIdentity: "unlinkIdentity";
            unsuspendScope: "unsuspendScope";
            updateConnectionSecret: "updateConnectionSecret";
        }>;
        tenantId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "TenantId", "out">>;
        scopeId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
        vertical: z.ZodNullable<z.ZodString>;
        before: z.ZodNullable<z.ZodUnknown>;
        after: z.ZodNullable<z.ZodUnknown>;
        causedBy: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "EventId", "out">>;
        at: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    }, z.core.$strip>>>;
    data: z.ZodArray<z.ZodObject<{
        tenantId: z.ZodString;
        scopeId: z.ZodString;
        capturedAt: z.ZodString;
        tables: z.ZodArray<z.ZodObject<{
            name: z.ZodString;
            ddl: z.ZodString;
            columns: z.ZodArray<z.ZodString>;
            rows: z.ZodArray<z.ZodArray<z.ZodUnknown>>;
        }, z.core.$strip>>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type TenantExport = z.infer<typeof tenantExport>;
/**
 * The meters (#38; control-plane.md §5) — and the shape is as narrow as it is on
 * purpose, because only two of §9's four are computable at all.
 *
 * **Meter 1** (base fee: per tenant + per active scope) is a `COUNT` over the directory.
 * **Meter 2** (per-engine licensing) is a `GROUP BY` over the entitlement store, whose
 * flags *are* the SKUs. Both are free, both come from the directory database, and
 * neither needs a data pipeline. **Meters 3 and 4 are absent from THIS reading by
 * construction**, not by omission: the outbox is per-scope-database with no cross-tenant
 * fan-in, reads emit nothing, and the cross-tenant order flow does not exist. A field here
 * would be a number we cannot compute — "a meter you cannot compute is not a pricing
 * decision, it is a data-pipeline project" (§5). The one slice of meter 3 that IS computable
 * — model usage, because every call is raised as a platform intent and drained into the
 * directory — has its own reading, `modelUsageSummary` (model-usage.ts, #1054).
 *
 * Two rules decide every number below, and they are the reason this is a server-side
 * aggregate rather than arithmetic over `listScopes`:
 *
 * 1. **Billable means EFFECTIVE, not stored.** Suspending a tenant does not touch its
 *    scopes' rows, but `getScope` fails closed for all of them (§4.1) — so a scope
 *    stored `active` under a non-active tenant is serving nobody and is counted
 *    suspended here, exactly as the console's `effectiveStatus` counts it. A meter that
 *    read stored status would bill a tenant-wide outage.
 * 2. **Expiry is evaluated at `readAt`.** An expired grant is gate-dead (#33), so it is
 *    not billable — but it stays visible as `expired` rather than vanishing, because a
 *    lapsed trial is a renewal, not an absence.
 */
export declare const meterScopeCounts: z.ZodObject<{
    total: z.ZodNumber;
    active: z.ZodNumber;
    suspended: z.ZodNumber;
    provisioning: z.ZodNumber;
    archived: z.ZodNumber;
    reaped: z.ZodNumber;
}, z.core.$strip>;
export type MeterScopeCounts = z.infer<typeof meterScopeCounts>;
/** Meter 1, per tenant: the scopes under it, and how many SKUs it holds. */
export declare const tenantMeterRow: z.ZodObject<{
    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
    slug: z.ZodString;
    status: z.ZodEnum<{
        active: "active";
        deleting: "deleting";
        reaped: "reaped";
        suspended: "suspended";
    }>;
    billable: z.ZodBoolean;
    scopes: z.ZodObject<{
        total: z.ZodNumber;
        active: z.ZodNumber;
        suspended: z.ZodNumber;
        provisioning: z.ZodNumber;
        archived: z.ZodNumber;
        reaped: z.ZodNumber;
    }, z.core.$strip>;
    entitlements: z.ZodObject<{
        live: z.ZodNumber;
        expired: z.ZodNumber;
    }, z.core.$strip>;
}, z.core.$strip>;
export type TenantMeterRow = z.infer<typeof tenantMeterRow>;
/**
 * Meter 2, one row per (SKU, tier): entitlement flags are the SKUs (§9), and `plan` is
 * what makes a tier data instead of operator convention (#33). Grouped rather than
 * summed so "how many tenants are on `pro` of this engine" is a read, not a re-derivation.
 *
 * Counts BILLABLE holders only — an active tenant with a live grant. A grant held by a
 * suspended tenant is not revenue, and counting it here would make the meter disagree
 * with the base fee beside it.
 */
export declare const entitlementMeterRow: z.ZodObject<{
    entitlementKey: z.ZodString;
    plan: z.ZodNullable<z.ZodString>;
    tenants: z.ZodNumber;
    expired: z.ZodNumber;
}, z.core.$strip>;
export type EntitlementMeterRow = z.infer<typeof entitlementMeterRow>;
/**
 * One reading of meters 1 and 2 — fleet-wide, or narrowed to a single tenant.
 *
 * A reading is a fact about an INSTANT, not a running total: nothing is stored, nothing
 * accumulates, and re-reading recomputes. That is deliberate — a stored meter is a
 * billing system's ledger, and D-30 says meter, do not bill. `readAt` is what makes the
 * number quotable ("42 active scopes at 09:00") without pretending it is invoiced.
 */
export declare const meterReading: z.ZodObject<{
    readAt: z.core.$ZodBranded<z.ZodString, "Instant", "out">;
    tenants: z.ZodObject<{
        total: z.ZodNumber;
        active: z.ZodNumber;
        suspended: z.ZodNumber;
        deleting: z.ZodNumber;
        reaped: z.ZodNumber;
    }, z.core.$strip>;
    scopes: z.ZodObject<{
        total: z.ZodNumber;
        active: z.ZodNumber;
        suspended: z.ZodNumber;
        provisioning: z.ZodNumber;
        archived: z.ZodNumber;
        reaped: z.ZodNumber;
    }, z.core.$strip>;
    entitlements: z.ZodArray<z.ZodObject<{
        entitlementKey: z.ZodString;
        plan: z.ZodNullable<z.ZodString>;
        tenants: z.ZodNumber;
        expired: z.ZodNumber;
    }, z.core.$strip>>;
    perTenant: z.ZodArray<z.ZodObject<{
        tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
        slug: z.ZodString;
        status: z.ZodEnum<{
            active: "active";
            deleting: "deleting";
            reaped: "reaped";
            suspended: "suspended";
        }>;
        billable: z.ZodBoolean;
        scopes: z.ZodObject<{
            total: z.ZodNumber;
            active: z.ZodNumber;
            suspended: z.ZodNumber;
            provisioning: z.ZodNumber;
            archived: z.ZodNumber;
            reaped: z.ZodNumber;
        }, z.core.$strip>;
        entitlements: z.ZodObject<{
            live: z.ZodNumber;
            expired: z.ZodNumber;
        }, z.core.$strip>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type MeterReading = z.infer<typeof meterReading>;
//# sourceMappingURL=control-plane.d.ts.map