@casual-simulation/aux-common 3.8.1 → 3.10.2

package/common/PolicyPermissions.d.ts

@@ -29,13 +29,16 @@ export declare const PACKAGE_RESOURCE_KIND = "package";
 export declare const PACKAGE_VERSION_RESOURCE_KIND = "package.version";
 export declare const SEARCH_RESOURCE_KIND = "search";
 export declare const DATABASE_RESOURCE_KIND = "database";
+export declare const PURCHASABLE_ITEM_RESOURCE_KIND = "purchasableItem";
+export declare const CONTRACT_RESOURCE_KIND = "contract";
+export declare const INVOICE_RESOURCE_KIND = "invoice";
 /**
  * The possible types of resources that can be affected by permissions.
  *
  * @dochash types/permissions
  * @docname ResourceKinds
  */
-export type ResourceKinds = 'data' | 'file' | 'event' | 'marker' | 'role' | 'inst' | 'webhook' | 'notification' | 'package' | 'package.version' | 'search' | 'loom' | 'ai.sloyd' | 'ai.hume' | 'ai.openai.realtime' | 'database';
+export type ResourceKinds = 'data' | 'file' | 'event' | 'marker' | 'role' | 'inst' | 'webhook' | 'notification' | 'package' | 'package.version' | 'search' | 'loom' | 'ai.sloyd' | 'ai.hume' | 'ai.openai.realtime' | 'database' | 'purchasableItem' | 'contract' | 'invoice';
 export declare const READ_ACTION = "read";
 export declare const CREATE_ACTION = "create";
 export declare const UPDATE_ACTION = "update";
@@ -56,13 +59,16 @@ export declare const SEND_ACTION = "send";
 export declare const SUBSCRIBE_ACTION = "subscribe";
 export declare const UNSUBSCRIBE_ACTION = "unsubscribe";
 export declare const LIST_SUBSCRIPTIONS_ACTION = "listSubscriptions";
+export declare const PURCHASE_ACTION = "purchase";
+export declare const APPROVE_ACTION = "approve";
+export declare const CANCEL_ACTION = "cancel";
 /**
  * The possible types of actions that can be performed on resources.
  *
  * @dochash types/permissions
  * @docname ActionKinds
  */
-export type ActionKinds = 'read' | 'create' | 'update' | 'delete' | 'assign' | 'unassign' | 'increment' | 'count' | 'list' | 'grantPermission' | 'revokePermission' | 'grant' | 'revoke' | 'sendAction' | 'updateData' | 'run' | 'send' | 'subscribe' | 'unsubscribe' | 'listSubscriptions';
+export type ActionKinds = 'read' | 'create' | 'update' | 'delete' | 'assign' | 'unassign' | 'increment' | 'count' | 'list' | 'grantPermission' | 'revokePermission' | 'grant' | 'revoke' | 'sendAction' | 'updateData' | 'run' | 'send' | 'subscribe' | 'unsubscribe' | 'listSubscriptions' | 'purchase' | 'approve' | 'cancel';
 /**
  * The possible types of actions that can be performed on data resources.
  *
@@ -175,6 +181,27 @@ export type SearchActionKinds = 'create' | 'read' | 'update' | 'delete' | 'list'
  * @docname DatabaseActionKinds
  */
 export type DatabaseActionKinds = 'create' | 'read' | 'update' | 'delete' | 'list';
+/**
+ * The possible types of actions that can be performed on purchasableItem resources.
+ *
+ * @dochash types/permissions
+ * @docname PurchasableItemActionKinds
+ */
+export type PurchasableItemActionKinds = 'read' | 'create' | 'update' | 'delete' | 'list' | 'purchase';
+/**
+ * The possible types of actions that can be performed on contract resources.
+ *
+ * @dochash types/permissions
+ * @docname ContractActionKinds
+ */
+export type ContractActionKinds = 'read' | 'create' | 'update' | 'delete' | 'list' | 'purchase' | 'cancel';
+/**
+ * The possible types of actions that can be performed on invoice resources.
+ *
+ * @dochash types/permissions
+ * @docname InvoiceActionKinds
+ */
+export type InvoiceActionKinds = 'read' | 'create' | 'update' | 'delete' | 'list' | 'approve' | 'cancel';
 /**
  * The possible types of permissions that can be added to policies.
  *
@@ -184,26 +211,188 @@ export type DatabaseActionKinds = 'create' | 'read' | 'update' | 'delete' | 'lis
  * @docdescription Types that represent permissions that control access to resources.
  * @docname AvailablePermissions
  */
-export type AvailablePermissions = DataPermission | FilePermission | EventPermission | MarkerPermission | RolePermission | InstPermission | LoomPermission | SloydPermission | HumePermission | OpenAIRealtimePermission | WebhookPermission | NotificationPermission | PackagePermission | PackageVersionPermission | SearchPermission | DatabasePermission;
-export declare const SUBJECT_TYPE_VALIDATION: z.ZodEnum<["user", "inst", "role"]>;
-export declare const DATA_ACTION_KINDS_VALIDATION: z.ZodEnum<["read", "create", "update", "delete", "list"]>;
-export declare const FILE_ACTION_KINDS_VALIDATION: z.ZodEnum<["read", "create", "update", "delete", "list"]>;
-export declare const EVENT_ACTION_KINDS_VALIDATION: z.ZodEnum<["increment", "count", "update", "list"]>;
-export declare const MARKER_ACTION_KINDS_VALIDATION: z.ZodEnum<["assign", "unassign", "grantPermission", "revokePermission", "read"]>;
-export declare const ROLE_ACTION_KINDS_VALIDATION: z.ZodEnum<["grant", "revoke", "read", "update", "list"]>;
-export declare const INST_ACTION_KINDS_VALIDATION: z.ZodEnum<["create", "read", "update", "updateData", "delete", "list", "sendAction"]>;
-export declare const LOOM_ACTION_KINDS_VALIDATION: z.ZodEnum<["create"]>;
-export declare const SLOYD_ACTION_KINDS_VALIDATION: z.ZodEnum<["create"]>;
-export declare const HUME_ACTION_KINDS_VALIDATION: z.ZodEnum<["create"]>;
-export declare const OPENAI_REALTIME_ACTION_KINDS_VALIDATION: z.ZodEnum<["create"]>;
-export declare const WEBHOOK_ACTION_KINDS_VALIDATION: z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>;
-export declare const NOTIFICATION_ACTION_KINDS_VALIDATION: z.ZodEnum<["create", "read", "update", "delete", "list", "send", "subscribe", "unsubscribe", "listSubscriptions"]>;
-export declare const PACKAGE_ACTION_KINDS_VALIDATION: z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>;
-export declare const PACKAGE_VERSION_ACTION_KINDS_VALIDATION: z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>;
-export declare const SEARCH_ACTION_KINDS_VALIDATION: z.ZodEnum<["create", "read", "update", "delete", "list"]>;
-export declare const DATABASE_ACTION_KINDS_VALIDATION: z.ZodEnum<["create", "read", "update", "delete", "list"]>;
-export declare const RESOURCE_KIND_VALIDATION: z.ZodEnum<["data", "file", "event", "marker", "role", "inst", "loom", "ai.sloyd", "ai.hume", "ai.openai.realtime", "webhook", "notification", "package", "package.version", "search", "database"]>;
-export declare const ACTION_KINDS_VALIDATION: z.ZodEnum<["create", "read", "update", "updateData", "delete", "list", "sendAction", "assign", "unassign", "grant", "revoke", "increment", "count", "grantPermission", "revokePermission", "run", "send", "subscribe", "unsubscribe", "listSubscriptions"]>;
+export type AvailablePermissions = DataPermission | FilePermission | EventPermission | MarkerPermission | RolePermission | InstPermission | PurchasableItemPermission | LoomPermission | SloydPermission | HumePermission | OpenAIRealtimePermission | WebhookPermission | NotificationPermission | PackagePermission | PackageVersionPermission | SearchPermission | DatabasePermission | ContractPermission | InvoicePermission;
+export declare const SUBJECT_TYPE_VALIDATION: z.ZodEnum<{
+    inst: "inst";
+    user: "user";
+    role: "role";
+}>;
+export declare const DATA_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+}>;
+export declare const FILE_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+}>;
+export declare const EVENT_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    update: "update";
+    increment: "increment";
+    count: "count";
+    list: "list";
+}>;
+export declare const MARKER_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    assign: "assign";
+    unassign: "unassign";
+    grantPermission: "grantPermission";
+    revokePermission: "revokePermission";
+}>;
+export declare const ROLE_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    update: "update";
+    list: "list";
+    grant: "grant";
+    revoke: "revoke";
+}>;
+export declare const INST_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+    sendAction: "sendAction";
+    updateData: "updateData";
+}>;
+export declare const LOOM_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    create: "create";
+}>;
+export declare const SLOYD_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    create: "create";
+}>;
+export declare const HUME_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    create: "create";
+}>;
+export declare const OPENAI_REALTIME_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    create: "create";
+}>;
+export declare const WEBHOOK_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    run: "run";
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+}>;
+export declare const NOTIFICATION_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+    send: "send";
+    subscribe: "subscribe";
+    unsubscribe: "unsubscribe";
+    listSubscriptions: "listSubscriptions";
+}>;
+export declare const PACKAGE_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    run: "run";
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+}>;
+export declare const PACKAGE_VERSION_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    run: "run";
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+}>;
+export declare const SEARCH_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+}>;
+export declare const DATABASE_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+}>;
+export declare const PURCHASABLE_ITEM_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+    purchase: "purchase";
+}>;
+export declare const CONTRACT_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+    purchase: "purchase";
+    cancel: "cancel";
+}>;
+export declare const INVOICE_ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    list: "list";
+    approve: "approve";
+    cancel: "cancel";
+}>;
+export declare const RESOURCE_KIND_VALIDATION: z.ZodEnum<{
+    search: "search";
+    inst: "inst";
+    file: "file";
+    event: "event";
+    role: "role";
+    data: "data";
+    marker: "marker";
+    loom: "loom";
+    "ai.sloyd": "ai.sloyd";
+    "ai.hume": "ai.hume";
+    "ai.openai.realtime": "ai.openai.realtime";
+    webhook: "webhook";
+    notification: "notification";
+    package: "package";
+    "package.version": "package.version";
+    database: "database";
+    purchasableItem: "purchasableItem";
+    contract: "contract";
+    invoice: "invoice";
+}>;
+export declare const ACTION_KINDS_VALIDATION: z.ZodEnum<{
+    run: "run";
+    read: "read";
+    create: "create";
+    update: "update";
+    delete: "delete";
+    assign: "assign";
+    unassign: "unassign";
+    increment: "increment";
+    count: "count";
+    list: "list";
+    grantPermission: "grantPermission";
+    revokePermission: "revokePermission";
+    grant: "grant";
+    revoke: "revoke";
+    sendAction: "sendAction";
+    updateData: "updateData";
+    send: "send";
+    subscribe: "subscribe";
+    unsubscribe: "unsubscribe";
+    listSubscriptions: "listSubscriptions";
+    purchase: "purchase";
+    approve: "approve";
+    cancel: "cancel";
+}>;
 /**
  * The scopes that can be used for requested entitlements.
  * This can be used to limit the entitlement to requesting a category of resources.
@@ -261,20 +450,42 @@ export interface Entitlement {
      */
     designatedRecords?: string[];
 }
-export declare const ENTITLEMENT_FEATURE_VALIDATION: z.ZodEnum<["data", "file", "event", "inst", "notification", "package", "permissions", "webhook", "ai", "search", "database"]>;
-export declare const ENTITLEMENT_VALIDATION: z.ZodObject<{
-    feature: z.ZodEnum<["data", "file", "event", "inst", "notification", "package", "permissions", "webhook", "ai", "search", "database"]>;
-    scope: z.ZodEnum<["personal", "owned", "studio", "shared", "designated"]>;
-    designatedRecords: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, "strip", z.ZodTypeAny, {
-    feature?: "search" | "inst" | "data" | "event" | "file" | "webhook" | "notification" | "package" | "database" | "permissions" | "ai";
-    scope?: "shared" | "personal" | "owned" | "studio" | "designated";
-    designatedRecords?: string[];
-}, {
-    feature?: "search" | "inst" | "data" | "event" | "file" | "webhook" | "notification" | "package" | "database" | "permissions" | "ai";
-    scope?: "shared" | "personal" | "owned" | "studio" | "designated";
-    designatedRecords?: string[];
+export declare const ENTITLEMENT_FEATURE_VALIDATION: z.ZodEnum<{
+    search: "search";
+    inst: "inst";
+    file: "file";
+    event: "event";
+    data: "data";
+    webhook: "webhook";
+    notification: "notification";
+    package: "package";
+    database: "database";
+    permissions: "permissions";
+    ai: "ai";
 }>;
+export declare const ENTITLEMENT_VALIDATION: z.ZodObject<{
+    feature: z.ZodEnum<{
+        search: "search";
+        inst: "inst";
+        file: "file";
+        event: "event";
+        data: "data";
+        webhook: "webhook";
+        notification: "notification";
+        package: "package";
+        database: "database";
+        permissions: "permissions";
+        ai: "ai";
+    }>;
+    scope: z.ZodEnum<{
+        shared: "shared";
+        personal: "personal";
+        owned: "owned";
+        studio: "studio";
+        designated: "designated";
+    }>;
+    designatedRecords: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions.
  */
@@ -312,24 +523,16 @@ export interface Permission {
     expireTimeMs: number | null;
 }
 export declare const PERMISSION_VALIDATION: z.ZodObject<{
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
     marker: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    marker?: string;
-}, {
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    marker?: string;
-}>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes the common options for all permissions that affect data records.
  *
@@ -348,30 +551,24 @@ export interface DataPermission extends Permission {
     action: DataActionKinds | null;
 }
 export declare const DATA_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"data">;
-    action: z.ZodNullable<z.ZodEnum<["read", "create", "update", "delete", "list"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "data";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "data";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>;
 /**
  * Options for file permissions.
  *
@@ -393,14 +590,8 @@ export interface FilePermissionOptions {
 }
 export declare const FILE_PERMISSION_OPTIONS_VALIDATION: z.ZodObject<{
     maxFileSizeInBytes: z.ZodOptional<z.ZodNumber>;
-    allowedMimeTypes: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<true>, z.ZodArray<z.ZodString, "many">]>>;
-}, "strip", z.ZodTypeAny, {
-    maxFileSizeInBytes?: number;
-    allowedMimeTypes?: true | string[];
-}, {
-    maxFileSizeInBytes?: number;
-    allowedMimeTypes?: true | string[];
-}>;
+    allowedMimeTypes: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes the common options for all permissions that affect file records.
  *
@@ -423,48 +614,28 @@ export interface FilePermission extends Permission {
     options: FilePermissionOptions;
 }
 export declare const FILE_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"file">;
-    action: z.ZodNullable<z.ZodEnum<["read", "create", "update", "delete", "list"]>>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
     options: z.ZodObject<{
         maxFileSizeInBytes: z.ZodOptional<z.ZodNumber>;
-        allowedMimeTypes: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<true>, z.ZodArray<z.ZodString, "many">]>>;
-    }, "strip", z.ZodTypeAny, {
-        maxFileSizeInBytes?: number;
-        allowedMimeTypes?: true | string[];
-    }, {
-        maxFileSizeInBytes?: number;
-        allowedMimeTypes?: true | string[];
-    }>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "file";
-    action?: "create" | "read" | "update" | "delete" | "list";
-    options?: {
-        maxFileSizeInBytes?: number;
-        allowedMimeTypes?: true | string[];
-    };
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "file";
-    action?: "create" | "read" | "update" | "delete" | "list";
-    options?: {
-        maxFileSizeInBytes?: number;
-        allowedMimeTypes?: true | string[];
-    };
-}>;
+        allowedMimeTypes: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes the common options for all permissions that affect event records.
  *
@@ -483,30 +654,23 @@ export interface EventPermission extends Permission {
     action: EventActionKinds | null;
 }
 export declare const EVENT_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"event">;
     resourceId: z.ZodNullable<z.ZodString>;
-    action: z.ZodNullable<z.ZodEnum<["increment", "count", "update", "list"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "event";
-    resourceId?: string;
-    action?: "update" | "increment" | "count" | "list";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "event";
-    resourceId?: string;
-    action?: "update" | "increment" | "count" | "list";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        update: "update";
+        increment: "increment";
+        count: "count";
+        list: "list";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes the common options for all permissions that affect markers.
  *
@@ -525,30 +689,24 @@ export interface MarkerPermission extends Permission {
     action: MarkerActionKinds | null;
 }
 export declare const MARKER_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"marker">;
-    action: z.ZodNullable<z.ZodEnum<["assign", "unassign", "grantPermission", "revokePermission", "read"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "marker";
-    action?: "read" | "assign" | "unassign" | "grantPermission" | "revokePermission";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "marker";
-    action?: "read" | "assign" | "unassign" | "grantPermission" | "revokePermission";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        assign: "assign";
+        unassign: "unassign";
+        grantPermission: "grantPermission";
+        revokePermission: "revokePermission";
+    }>>;
+}, z.core.$strip>;
 /**
  * Options for role permissions.
  *
@@ -564,11 +722,7 @@ export interface RolePermissionOptions {
 }
 export declare const ROLE_PERMISSION_OPTIONS_VALIDATION: z.ZodObject<{
     maxDurationMs: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    maxDurationMs?: number;
-}, {
-    maxDurationMs?: number;
-}>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes the common options for all permissions that affect roles.
  *
@@ -596,43 +750,27 @@ export interface RolePermission extends Permission {
     options: RolePermissionOptions;
 }
 export declare const ROLE_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"role">;
-    action: z.ZodNullable<z.ZodEnum<["grant", "revoke", "read", "update", "list"]>>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        update: "update";
+        list: "list";
+        grant: "grant";
+        revoke: "revoke";
+    }>>;
     options: z.ZodObject<{
         maxDurationMs: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        maxDurationMs?: number;
-    }, {
-        maxDurationMs?: number;
-    }>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "role";
-    action?: "read" | "update" | "list" | "grant" | "revoke";
-    options?: {
-        maxDurationMs?: number;
-    };
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "role";
-    action?: "read" | "update" | "list" | "grant" | "revoke";
-    options?: {
-        maxDurationMs?: number;
-    };
-}>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect insts.
  *
@@ -656,30 +794,26 @@ export interface InstPermission extends Permission {
     action: InstActionKinds | null;
 }
 export declare const INST_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"inst">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "updateData", "delete", "list", "sendAction"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "inst";
-    action?: "create" | "read" | "update" | "delete" | "list" | "sendAction" | "updateData";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "inst";
-    action?: "create" | "read" | "update" | "delete" | "list" | "sendAction" | "updateData";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        sendAction: "sendAction";
+        updateData: "updateData";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect loom resources.
  *
@@ -698,30 +832,20 @@ export interface LoomPermission extends Permission {
     action: LoomActionKinds | null;
 }
 export declare const LOOM_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"loom">;
-    action: z.ZodNullable<z.ZodEnum<["create"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "loom";
-    action?: "create";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "loom";
-    action?: "create";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        create: "create";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect ai.sloyd resources.
  *
@@ -740,30 +864,20 @@ export interface SloydPermission extends Permission {
     action: SloydActionKinds | null;
 }
 export declare const SLOYD_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"ai.sloyd">;
-    action: z.ZodNullable<z.ZodEnum<["create"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.sloyd";
-    action?: "create";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.sloyd";
-    action?: "create";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        create: "create";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect ai.hume resources.
  *
@@ -782,30 +896,20 @@ export interface HumePermission extends Permission {
     action: HumeActionKinds | null;
 }
 export declare const HUME_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"ai.hume">;
-    action: z.ZodNullable<z.ZodEnum<["create"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.hume";
-    action?: "create";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.hume";
-    action?: "create";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        create: "create";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect ai.openai.realtime resources.
  *
@@ -824,30 +928,20 @@ export interface OpenAIRealtimePermission extends Permission {
     action: OpenAIRealtimeActionKinds | null;
 }
 export declare const OPENAI_REALTIME_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"ai.openai.realtime">;
-    action: z.ZodNullable<z.ZodEnum<["create"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.openai.realtime";
-    action?: "create";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.openai.realtime";
-    action?: "create";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        create: "create";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect webhook resources.
  *
@@ -866,30 +960,25 @@ export interface WebhookPermission extends Permission {
     action: WebhookActionKinds | null;
 }
 export declare const WEBHOOK_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"webhook">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "webhook";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "webhook";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        run: "run";
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect notification resources.
  *
@@ -908,30 +997,28 @@ export interface NotificationPermission extends Permission {
     action: NotificationActionKinds | null;
 }
 export declare const NOTIFICATION_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"notification">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list", "send", "subscribe", "unsubscribe", "listSubscriptions"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "notification";
-    action?: "create" | "read" | "update" | "delete" | "list" | "send" | "subscribe" | "unsubscribe" | "listSubscriptions";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "notification";
-    action?: "create" | "read" | "update" | "delete" | "list" | "send" | "subscribe" | "unsubscribe" | "listSubscriptions";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        send: "send";
+        subscribe: "subscribe";
+        unsubscribe: "unsubscribe";
+        listSubscriptions: "listSubscriptions";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect package resources.
  *
@@ -950,30 +1037,25 @@ export interface PackagePermission extends Permission {
     action: PackageActionKinds | null;
 }
 export declare const PACKAGE_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"package">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "package";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "package";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        run: "run";
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect package.version resources.
  *
@@ -992,30 +1074,25 @@ export interface PackageVersionPermission extends Permission {
     action: PackageVersionActionKinds | null;
 }
 export declare const PACKAGE_VERSION_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"package.version">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "package.version";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "package.version";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        run: "run";
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect search resources.
  *
@@ -1034,30 +1111,24 @@ export interface SearchPermission extends Permission {
     action: SearchActionKinds | null;
 }
 export declare const SEARCH_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"search">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "search";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "search";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>;
 /**
  * Defines an interface that describes common options for all permissions that affect search resources.
  *
@@ -1076,446 +1147,487 @@ export interface DatabasePermission extends Permission {
     action: DatabaseActionKinds | null;
 }
 export declare const DATABASE_PERMISSION_VALIDATION: z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"database">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "database";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "database";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}>;
-export declare const AVAILABLE_PERMISSIONS_VALIDATION: z.ZodDiscriminatedUnion<"resourceKind", [z.ZodObject<{
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>;
+/**
+ * Defines an interface that describes common options for all purchasableItem permissions.
+ *
+ * @dochash types/permissions
+ * @docname PurchasableItemPermission
+ */
+export interface PurchasableItemPermission extends Permission {
+    /**
+     * The kind of the permission.
+     */
+    resourceKind: 'purchasableItem';
+    /**
+     * The ID of the resource that is allowed.
+     * If null, then all resources are allowed.
+     */
+    resourceId: string | null;
+    action: PurchasableItemActionKinds | null;
+}
+export declare const PURCHASABLE_ITEM_PERMISSION_VALIDATION: z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
+    subjectId: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    expireTimeMs: z.ZodNullable<z.ZodNumber>;
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"purchasableItem">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        purchase: "purchase";
+    }>>;
+}, z.core.$strip>;
+/**
+ * Defines an interface that describes common options for all contract permissions.
+ *
+ * @dochash types/permissions
+ * @docname ContractPermission
+ */
+export interface ContractPermission extends Permission {
+    /**
+     * The kind of the permission.
+     */
+    resourceKind: 'contract';
+    /**
+     * The ID of the resource that is allowed.
+     * If null, then all resources are allowed.
+     */
+    resourceId: string | null;
+    action: ContractActionKinds | null;
+}
+export declare const CONTRACT_PERMISSION_VALIDATION: z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
+    subjectId: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
+    resourceKind: z.ZodLiteral<"contract">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        purchase: "purchase";
+        cancel: "cancel";
+    }>>;
+}, z.core.$strip>;
+/**
+ * Defines an interface that describes common options for all invoice permissions.
+ *
+ * @dochash types/permissions
+ * @docname InvoicePermission
+ */
+export interface InvoicePermission extends Permission {
+    /**
+     * The kind of the permission.
+     */
+    resourceKind: 'invoice';
+    /**
+     * The ID of the resource that is allowed.
+     * If null, then all resources are allowed.
+     */
+    resourceId: string | null;
+    action: InvoiceActionKinds | null;
+}
+export declare const INVOICE_PERMISSION_VALIDATION: z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"data">;
-    action: z.ZodNullable<z.ZodEnum<["read", "create", "update", "delete", "list"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "data";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "data";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"invoice">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        approve: "approve";
+        cancel: "cancel";
+    }>>;
+}, z.core.$strip>;
+export declare const AVAILABLE_PERMISSIONS_VALIDATION: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
+    resourceKind: z.ZodLiteral<"data">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
+    subjectId: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"file">;
-    action: z.ZodNullable<z.ZodEnum<["read", "create", "update", "delete", "list"]>>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
     options: z.ZodObject<{
         maxFileSizeInBytes: z.ZodOptional<z.ZodNumber>;
-        allowedMimeTypes: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<true>, z.ZodArray<z.ZodString, "many">]>>;
-    }, "strip", z.ZodTypeAny, {
-        maxFileSizeInBytes?: number;
-        allowedMimeTypes?: true | string[];
-    }, {
-        maxFileSizeInBytes?: number;
-        allowedMimeTypes?: true | string[];
+        allowedMimeTypes: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
     }>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "file";
-    action?: "create" | "read" | "update" | "delete" | "list";
-    options?: {
-        maxFileSizeInBytes?: number;
-        allowedMimeTypes?: true | string[];
-    };
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "file";
-    action?: "create" | "read" | "update" | "delete" | "list";
-    options?: {
-        maxFileSizeInBytes?: number;
-        allowedMimeTypes?: true | string[];
-    };
-}>, z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
     subjectId: z.ZodString;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"event">;
     resourceId: z.ZodNullable<z.ZodString>;
-    action: z.ZodNullable<z.ZodEnum<["increment", "count", "update", "list"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "event";
-    resourceId?: string;
-    action?: "update" | "increment" | "count" | "list";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "event";
-    resourceId?: string;
-    action?: "update" | "increment" | "count" | "list";
-}>, z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    action: z.ZodNullable<z.ZodEnum<{
+        update: "update";
+        increment: "increment";
+        count: "count";
+        list: "list";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"marker">;
-    action: z.ZodNullable<z.ZodEnum<["assign", "unassign", "grantPermission", "revokePermission", "read"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "marker";
-    action?: "read" | "assign" | "unassign" | "grantPermission" | "revokePermission";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "marker";
-    action?: "read" | "assign" | "unassign" | "grantPermission" | "revokePermission";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"marker">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        assign: "assign";
+        unassign: "unassign";
+        grantPermission: "grantPermission";
+        revokePermission: "revokePermission";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"role">;
-    action: z.ZodNullable<z.ZodEnum<["grant", "revoke", "read", "update", "list"]>>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        update: "update";
+        list: "list";
+        grant: "grant";
+        revoke: "revoke";
+    }>>;
     options: z.ZodObject<{
         maxDurationMs: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        maxDurationMs?: number;
-    }, {
-        maxDurationMs?: number;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
     }>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "role";
-    action?: "read" | "update" | "list" | "grant" | "revoke";
-    options?: {
-        maxDurationMs?: number;
-    };
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "role";
-    action?: "read" | "update" | "list" | "grant" | "revoke";
-    options?: {
-        maxDurationMs?: number;
-    };
-}>, z.ZodObject<{
-    marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"inst">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "updateData", "delete", "list", "sendAction"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "inst";
-    action?: "create" | "read" | "update" | "delete" | "list" | "sendAction" | "updateData";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "inst";
-    action?: "create" | "read" | "update" | "delete" | "list" | "sendAction" | "updateData";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"inst">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        sendAction: "sendAction";
+        updateData: "updateData";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"loom">;
-    action: z.ZodNullable<z.ZodEnum<["create"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "loom";
-    action?: "create";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "loom";
-    action?: "create";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"loom">;
+    action: z.ZodNullable<z.ZodEnum<{
+        create: "create";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"ai.sloyd">;
-    action: z.ZodNullable<z.ZodEnum<["create"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.sloyd";
-    action?: "create";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.sloyd";
-    action?: "create";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"ai.sloyd">;
+    action: z.ZodNullable<z.ZodEnum<{
+        create: "create";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"ai.hume">;
-    action: z.ZodNullable<z.ZodEnum<["create"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.hume";
-    action?: "create";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.hume";
-    action?: "create";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"ai.hume">;
+    action: z.ZodNullable<z.ZodEnum<{
+        create: "create";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"ai.openai.realtime">;
-    action: z.ZodNullable<z.ZodEnum<["create"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.openai.realtime";
-    action?: "create";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "ai.openai.realtime";
-    action?: "create";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"ai.openai.realtime">;
+    action: z.ZodNullable<z.ZodEnum<{
+        create: "create";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"webhook">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "webhook";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "webhook";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"webhook">;
+    action: z.ZodNullable<z.ZodEnum<{
+        run: "run";
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"notification">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list", "send", "subscribe", "unsubscribe", "listSubscriptions"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "notification";
-    action?: "create" | "read" | "update" | "delete" | "list" | "send" | "subscribe" | "unsubscribe" | "listSubscriptions";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "notification";
-    action?: "create" | "read" | "update" | "delete" | "list" | "send" | "subscribe" | "unsubscribe" | "listSubscriptions";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"notification">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        send: "send";
+        subscribe: "subscribe";
+        unsubscribe: "unsubscribe";
+        listSubscriptions: "listSubscriptions";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"package">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "package";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "package";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"package">;
+    action: z.ZodNullable<z.ZodEnum<{
+        run: "run";
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"package.version">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list", "run"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "package.version";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "package.version";
-    action?: "create" | "read" | "update" | "delete" | "list" | "run";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"package.version">;
+    action: z.ZodNullable<z.ZodEnum<{
+        run: "run";
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
-    resourceKind: z.ZodLiteral<"search">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "search";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "search";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}>, z.ZodObject<{
     marker: z.ZodOptional<z.ZodString>;
-    subjectType: z.ZodEnum<["user", "inst", "role"]>;
+    resourceKind: z.ZodLiteral<"search">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
     subjectId: z.ZodString;
     resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
     resourceKind: z.ZodLiteral<"database">;
-    action: z.ZodNullable<z.ZodEnum<["create", "read", "update", "delete", "list"]>>;
-}, "strip", z.ZodTypeAny, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "database";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}, {
-    marker?: string;
-    subjectType?: "inst" | "user" | "role";
-    subjectId?: string;
-    resourceId?: string;
-    expireTimeMs?: number;
-    resourceKind?: "database";
-    action?: "create" | "read" | "update" | "delete" | "list";
-}>]>;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
+    subjectId: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
+    resourceKind: z.ZodLiteral<"purchasableItem">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        purchase: "purchase";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
+    subjectId: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
+    resourceKind: z.ZodLiteral<"contract">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        purchase: "purchase";
+        cancel: "cancel";
+    }>>;
+}, z.core.$strip>, z.ZodObject<{
+    subjectType: z.ZodEnum<{
+        inst: "inst";
+        user: "user";
+        role: "role";
+    }>;
+    subjectId: z.ZodString;
+    resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    expireTimeMs: z.ZodNullable<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
+    resourceKind: z.ZodLiteral<"invoice">;
+    action: z.ZodNullable<z.ZodEnum<{
+        read: "read";
+        create: "create";
+        update: "update";
+        delete: "delete";
+        list: "list";
+        approve: "approve";
+        cancel: "cancel";
+    }>>;
+}, z.core.$strip>], "resourceKind">;
 export type PermissionOptions = FilePermissionOptions | RolePermissionOptions;
 /**
  * The name of the admin role.