diff --git a/packages/core/src/config/baseSchema.ts b/packages/core/src/config/baseSchema.ts
new file mode 100644
index 0000000..177355c
--- /dev/null
+++ b/packages/core/src/config/baseSchema.ts
@@ -0,0 +1,37 @@
+import * as z from 'zod'
+
+export const sshConfigSchema = z
+    .object({
+        host: z.string().min(1),
+        port: z.number().int().positive().default(22),
+        user: z.string().min(1),
+        password: z.string().optional(),
+        privateKey: z.string().optional(),
+        privateKeyPath: z.string().optional(),
+        passphrase: z.string().optional(),
+        agent: z.boolean().optional()
+    })
+    .strict()
+
+export type SshConfig = z.infer<typeof sshConfigSchema>
+
+// Fields shared by every backend. Leaf packages spread this, add `type` and
+// engine-specific fields, then call `.strict()`. `user` is required here to
+// match dbmole exactly; esmole overrides it to optional.
+export const baseConnectionShape = {
+    name: z.string().regex(/^[a-zA-Z0-9_-]+$/, 'name must match [a-zA-Z0-9_-]+'),
+    host: z.string().min(1),
+    port: z.number().int().positive().optional(),
+    user: z.string().min(1),
+    password: z.string().optional(),
+    readonly: z.boolean().default(false),
+    ssh: sshConfigSchema.optional()
+} as const
+
+export type ConnectionSource = 'env' | 'config' | 'store'
+
+export type ResolvedConnection<TConfig> = {
+    config: TConfig
+    source: ConnectionSource
+    hash: string
+}
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 336ce12..27f70e3 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -1 +1,2 @@
-export {}
+export type { ConnectionSource, ResolvedConnection, SshConfig } from './config/baseSchema.js'
+export { baseConnectionShape, sshConfigSchema } from './config/baseSchema.js'