@lucern/contracts 0.3.0-alpha.1 → 0.3.0-alpha.11

package/dist/schemas/tables/mc/runtime.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { T as TableContract } from '../../../defineTable-CBQ03FXl.js';
+import { T as TableContract } from '../../../defineTable-t1wr5wgn.js';
 import { C as ConvexIdSchema } from '../../../idOf-DR8tkhQS.js';
 
 declare const compatibilityShims: TableContract<{
@@ -41,6 +41,7 @@ declare const cutoverFlags: TableContract<{
 declare const tenantDeploymentCredentials: TableContract<{
     credentialRef: z.ZodString;
     tenantId: ConvexIdSchema<"tenants">;
+    workspaceId: z.ZodOptional<ConvexIdSchema<"workspaces">>;
     target: z.ZodEnum<["kernelDeployment", "appDeployment"]>;
     environment: z.ZodEnum<["dev", "staging", "prod"]>;
     encryptedDeployKey: z.ZodString;
@@ -57,9 +58,84 @@ declare const tenantDeploymentCredentials: TableContract<{
     createdAt: z.ZodNumber;
     updatedAt: z.ZodNumber;
 }>;
+declare const permitSyncStates: TableContract<{
+    syncKey: z.ZodString;
+    objectType: z.ZodEnum<["resource", "role", "resource_role", "resource_relation", "tenant", "workspace", "principal", "membership", "group", "resource_instance", "relationship_tuple", "role_assignment"]>;
+    objectId: z.ZodString;
+    tenantId: z.ZodOptional<ConvexIdSchema<"tenants">>;
+    workspaceId: z.ZodOptional<ConvexIdSchema<"workspaces">>;
+    principalId: z.ZodOptional<z.ZodString>;
+    permitTenantKey: z.ZodOptional<z.ZodString>;
+    permitResourceType: z.ZodOptional<z.ZodString>;
+    permitResourceKey: z.ZodOptional<z.ZodString>;
+    desiredPayload: z.ZodRecord<z.ZodString, z.ZodAny>;
+    lastAppliedPayloadHash: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<["pending", "synced", "error", "skipped"]>;
+    attemptCount: z.ZodNumber;
+    lastError: z.ZodOptional<z.ZodString>;
+    nextAttemptAt: z.ZodOptional<z.ZodNumber>;
+    lastSyncedAt: z.ZodOptional<z.ZodNumber>;
+    createdBy: z.ZodString;
+    updatedBy: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}>;
+declare const secretSyncDriftReports: TableContract<{
+    reportId: z.ZodString;
+    source: z.ZodEnum<["infisical_manifest", "manual", "ci"]>;
+    generatedAt: z.ZodNumber;
+    recordedAt: z.ZodNumber;
+    recordedBy: z.ZodString;
+    status: z.ZodEnum<["in_sync", "drift", "exception", "blocked", "not_observed"]>;
+    reportHash: z.ZodString;
+    manifestHash: z.ZodOptional<z.ZodString>;
+    dryRunReceiptId: z.ZodOptional<z.ZodString>;
+    appliedReceiptId: z.ZodOptional<z.ZodString>;
+    summary: z.ZodObject<{
+        totalPipelines: z.ZodNumber;
+        inSync: z.ZodNumber;
+        drift: z.ZodNumber;
+        exception: z.ZodNumber;
+        blocked: z.ZodNumber;
+        notObserved: z.ZodNumber;
+        missingKeys: z.ZodNumber;
+        valueDriftKeys: z.ZodNumber;
+        extraKeys: z.ZodNumber;
+        deniedConvexLeakage: z.ZodNumber;
+        approvedExceptions: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        blocked: number;
+        drift: number;
+        exception: number;
+        totalPipelines: number;
+        inSync: number;
+        notObserved: number;
+        missingKeys: number;
+        valueDriftKeys: number;
+        extraKeys: number;
+        deniedConvexLeakage: number;
+        approvedExceptions: number;
+    }, {
+        blocked: number;
+        drift: number;
+        exception: number;
+        totalPipelines: number;
+        inSync: number;
+        notObserved: number;
+        missingKeys: number;
+        valueDriftKeys: number;
+        extraKeys: number;
+        deniedConvexLeakage: number;
+        approvedExceptions: number;
+    }>;
+    redactedReport: z.ZodRecord<z.ZodString, z.ZodAny>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}>;
 declare const controlPlaneTenantModelSlotBindings: TableContract<{
     bindingId: z.ZodString;
     tenantId: ConvexIdSchema<"tenants">;
+    workspaceId: z.ZodOptional<ConvexIdSchema<"workspaces">>;
+    environment: z.ZodOptional<z.ZodEnum<["dev", "staging", "prod"]>>;
     providerId: z.ZodString;
     modelSlotId: z.ZodString;
     secretRef: z.ZodString;
@@ -75,9 +151,14 @@ declare const controlPlaneTenantModelSlotBindings: TableContract<{
 declare const controlPlaneTenantProviderSecrets: TableContract<{
     secretRef: z.ZodString;
     tenantId: ConvexIdSchema<"tenants">;
+    workspaceId: z.ZodOptional<ConvexIdSchema<"workspaces">>;
+    environment: z.ZodOptional<z.ZodEnum<["dev", "staging", "prod"]>>;
     providerId: z.ZodString;
     label: z.ZodOptional<z.ZodString>;
-    encryptedSecret: z.ZodString;
+    encryptedSecret: z.ZodOptional<z.ZodString>;
+    infisicalPath: z.ZodOptional<z.ZodString>;
+    infisicalSecretKey: z.ZodOptional<z.ZodString>;
+    infisicalProjectId: z.ZodOptional<z.ZodString>;
     encryptionVersion: z.ZodString;
     secretFingerprint: z.ZodString;
     keyHint: z.ZodString;
@@ -115,5 +196,30 @@ declare const controlPlaneTenantProxyGatewayUsage: TableContract<{
     createdAt: z.ZodNumber;
     updatedAt: z.ZodNumber;
 }>;
+declare const controlPlaneTenantProxyTokenLeases: TableContract<{
+    leaseId: z.ZodString;
+    proxyTokenId: z.ZodString;
+    tenantId: ConvexIdSchema<"tenants">;
+    workspaceId: z.ZodOptional<ConvexIdSchema<"workspaces">>;
+    environment: z.ZodEnum<["dev", "staging", "prod"]>;
+    providerId: z.ZodString;
+    modelSlotId: z.ZodString;
+    bindingId: z.ZodString;
+    secretRef: z.ZodString;
+    sessionId: z.ZodString;
+    principalId: z.ZodString;
+    agentSessionId: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<["active", "revoked"]>;
+    expiresAt: z.ZodNumber;
+    renewedAt: z.ZodOptional<z.ZodNumber>;
+    revokedAt: z.ZodOptional<z.ZodNumber>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    revokeReason: z.ZodOptional<z.ZodString>;
+    permitDecisionLogId: z.ZodOptional<ConvexIdSchema<"policyDecisionLogs">>;
+    permitTraceId: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}>;
 
-export { compatibilityShims, controlPlaneTenantModelSlotBindings, controlPlaneTenantProviderSecrets, controlPlaneTenantProxyGatewayUsage, cutoverFlags, tenantDeploymentCredentials };
+export { compatibilityShims, controlPlaneTenantModelSlotBindings, controlPlaneTenantProviderSecrets, controlPlaneTenantProxyGatewayUsage, controlPlaneTenantProxyTokenLeases, cutoverFlags, permitSyncStates, secretSyncDriftReports, tenantDeploymentCredentials };

package/dist/schemas/tables/mc/runtime.js

@@ -24,29 +24,37 @@ var compatibilityShims = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "shimId": z.string(),
-    "gateId": z.string(),
-    "removalDate": z.string(),
-    "removalPriority": z.enum(["P1", "P2", "P3"]),
-    "description": z.string(),
-    "owner": z.string(),
-    "createdAt": z.string(),
-    "status": z.enum(["active", "overdue", "removed"]),
-    "bridgeType": z.enum(["tool", "agent"]),
-    "bridgeTarget": z.object({
-      "type": z.enum(["tool", "agent"]),
-      "legacyPath": z.string(),
-      "harnessPath": z.string()
+    shimId: z.string(),
+    gateId: z.string(),
+    removalDate: z.string(),
+    removalPriority: z.enum(["P1", "P2", "P3"]),
+    description: z.string(),
+    owner: z.string(),
+    createdAt: z.string(),
+    status: z.enum(["active", "overdue", "removed"]),
+    bridgeType: z.enum(["tool", "agent"]),
+    bridgeTarget: z.object({
+      type: z.enum(["tool", "agent"]),
+      legacyPath: z.string(),
+      harnessPath: z.string()
     }),
-    "shimBehavior": z.enum(["passthrough_with_logging", "adapter", "feature_flag_gate"]),
-    "producesLedgerEntries": z.boolean(),
-    "lastAuditedAt": z.number(),
-    "metadata": z.record(z.any()).optional()
+    shimBehavior: z.enum([
+      "passthrough_with_logging",
+      "adapter",
+      "feature_flag_gate"
+    ]),
+    producesLedgerEntries: z.boolean(),
+    lastAuditedAt: z.number(),
+    metadata: z.record(z.any()).optional()
   }),
   indices: [
     { kind: "index", name: "by_shimId", columns: ["shimId"] },
     { kind: "index", name: "by_status", columns: ["status"] },
-    { kind: "index", name: "by_bridgeType_status", columns: ["bridgeType", "status"] }
+    {
+      kind: "index",
+      name: "by_bridgeType_status",
+      columns: ["bridgeType", "status"]
+    }
   ]
 });
 var cutoverFlags = defineTable({
@@ -54,12 +62,23 @@ var cutoverFlags = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "domain": z.enum(["graph", "schema", "identity", "policy", "audit", "admin", "agent", "tool", "prompt", "intelligence"]),
-    "state": z.enum(["legacy", "cutover", "disabled"]),
-    "metadata": z.record(z.any()).optional(),
-    "updatedBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    domain: z.enum([
+      "graph",
+      "schema",
+      "identity",
+      "policy",
+      "audit",
+      "admin",
+      "agent",
+      "tool",
+      "prompt",
+      "intelligence"
+    ]),
+    state: z.enum(["legacy", "cutover", "disabled"]),
+    metadata: z.record(z.any()).optional(),
+    updatedBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_domain", columns: ["domain"] },
@@ -71,57 +90,193 @@ var tenantDeploymentCredentials = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "credentialRef": z.string(),
-    "tenantId": idOf("tenants"),
-    "target": z.enum(["kernelDeployment", "appDeployment"]),
-    "environment": z.enum(["dev", "staging", "prod"]),
-    "encryptedDeployKey": z.string(),
-    "encryptionVersion": z.string(),
-    "keyFingerprint": z.string(),
-    "keyHint": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "rotatedFromCredentialRef": z.string().optional(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "lastUsedAt": z.number().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    credentialRef: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    target: z.enum(["kernelDeployment", "appDeployment"]),
+    environment: z.enum(["dev", "staging", "prod"]),
+    encryptedDeployKey: z.string(),
+    encryptionVersion: z.string(),
+    keyFingerprint: z.string(),
+    keyHint: z.string(),
+    status: z.enum(["active", "revoked"]),
+    rotatedFromCredentialRef: z.string().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    lastUsedAt: z.number().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_credentialRef", columns: ["credentialRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_target", columns: ["tenantId", "target"] },
-    { kind: "index", name: "by_tenant_target_environment", columns: ["tenantId", "target", "environment"] },
-    { kind: "index", name: "by_tenant_target_environment_status", columns: ["tenantId", "target", "environment", "status"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "target"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_environment",
+      columns: ["tenantId", "target", "environment"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_environment_status",
+      columns: ["tenantId", "target", "environment", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_workspace_target_environment_status",
+      columns: ["tenantId", "workspaceId", "target", "environment", "status"]
+    },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
+var permitSyncStates = defineTable({
+  name: "permitSyncStates",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: z.enum([
+      "resource",
+      "role",
+      "resource_role",
+      "resource_relation",
+      "tenant",
+      "workspace",
+      "principal",
+      "membership",
+      "group",
+      "resource_instance",
+      "relationship_tuple",
+      "role_assignment"
+    ]),
+    objectId: z.string(),
+    tenantId: idOf("tenants").optional(),
+    workspaceId: idOf("workspaces").optional(),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    desiredPayload: z.record(z.any()),
+    lastAppliedPayloadHash: z.string().optional(),
+    status: z.enum(["pending", "synced", "error", "skipped"]),
+    attemptCount: z.number(),
+    lastError: z.string().optional(),
+    nextAttemptAt: z.number().optional(),
+    lastSyncedAt: z.number().optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_principal_status",
+      columns: ["principalId", "status"]
+    }
+  ]
+});
+var secretSyncDriftReports = defineTable({
+  name: "secretSyncDriftReports",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    reportId: z.string(),
+    source: z.enum(["infisical_manifest", "manual", "ci"]),
+    generatedAt: z.number(),
+    recordedAt: z.number(),
+    recordedBy: z.string(),
+    status: z.enum([
+      "in_sync",
+      "drift",
+      "exception",
+      "blocked",
+      "not_observed"
+    ]),
+    reportHash: z.string(),
+    manifestHash: z.string().optional(),
+    dryRunReceiptId: z.string().optional(),
+    appliedReceiptId: z.string().optional(),
+    summary: z.object({
+      totalPipelines: z.number(),
+      inSync: z.number(),
+      drift: z.number(),
+      exception: z.number(),
+      blocked: z.number(),
+      notObserved: z.number(),
+      missingKeys: z.number(),
+      valueDriftKeys: z.number(),
+      extraKeys: z.number(),
+      deniedConvexLeakage: z.number(),
+      approvedExceptions: z.number()
+    }),
+    redactedReport: z.record(z.any()),
+    metadata: z.record(z.any()).optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_reportId", columns: ["reportId"] },
+    { kind: "index", name: "by_reportHash", columns: ["reportHash"] },
+    { kind: "index", name: "by_generatedAt", columns: ["generatedAt"] },
+    {
+      kind: "index",
+      name: "by_status_generatedAt",
+      columns: ["status", "generatedAt"]
+    }
+  ]
+});
 var controlPlaneTenantModelSlotBindings = defineTable({
   name: "controlPlaneTenantModelSlotBindings",
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "bindingId": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "modelSlotId": z.string(),
-    "secretRef": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "passThroughOnly": z.boolean(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    bindingId: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]).optional(),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    secretRef: z.string(),
+    status: z.enum(["active", "revoked"]),
+    passThroughOnly: z.boolean(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_bindingId", columns: ["bindingId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_slot", columns: ["tenantId", "modelSlotId"] },
-    { kind: "index", name: "by_tenant_provider_slot", columns: ["tenantId", "providerId", "modelSlotId"] },
+    {
+      kind: "index",
+      name: "by_tenant_slot",
+      columns: ["tenantId", "modelSlotId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_provider_slot",
+      columns: ["tenantId", "providerId", "modelSlotId"]
+    },
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
@@ -131,29 +286,42 @@ var controlPlaneTenantProviderSecrets = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "secretRef": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "label": z.string().optional(),
-    "encryptedSecret": z.string(),
-    "encryptionVersion": z.string(),
-    "secretFingerprint": z.string(),
-    "keyHint": z.string(),
-    "status": z.enum(["active", "revoked"]),
-    "rotatedFromSecretRef": z.string().optional(),
-    "revokedAt": z.number().optional(),
-    "revokedBy": z.string().optional(),
-    "lastUsedAt": z.number().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdBy": z.string(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    secretRef: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]).optional(),
+    providerId: z.string(),
+    label: z.string().optional(),
+    encryptedSecret: z.string().optional(),
+    infisicalPath: z.string().optional(),
+    infisicalSecretKey: z.string().optional(),
+    infisicalProjectId: z.string().optional(),
+    encryptionVersion: z.string(),
+    secretFingerprint: z.string(),
+    keyHint: z.string(),
+    status: z.enum(["active", "revoked"]),
+    rotatedFromSecretRef: z.string().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    lastUsedAt: z.number().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_secretRef", columns: ["secretRef"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId"] },
-    { kind: "index", name: "by_tenant_provider_status", columns: ["tenantId", "providerId", "status"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider",
+      columns: ["tenantId", "providerId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_provider_status",
+      columns: ["tenantId", "providerId", "status"]
+    },
     { kind: "index", name: "by_status", columns: ["status"] }
   ]
 });
@@ -162,38 +330,96 @@ var controlPlaneTenantProxyGatewayUsage = defineTable({
   component: "mc",
   category: "runtime",
   shape: z.object({
-    "usageId": z.string(),
-    "tenantId": idOf("tenants"),
-    "providerId": z.string(),
-    "modelSlotId": z.string(),
-    "secretRef": z.string(),
-    "proxyTokenId": z.string(),
-    "sessionId": z.string(),
-    "principalId": z.string(),
-    "workspaceId": z.string().optional(),
-    "modelId": z.string().optional(),
-    "requestPath": z.string(),
-    "status": z.enum(["success", "error"]),
-    "responseStatus": z.number().optional(),
-    "inputTokens": z.number().optional(),
-    "outputTokens": z.number().optional(),
-    "tokenCount": z.number().optional(),
-    "latencyMs": z.number(),
-    "estimatedCostUsd": z.number().optional(),
-    "failureCode": z.string().optional(),
-    "metadata": z.record(z.any()).optional(),
-    "createdAt": z.number(),
-    "updatedAt": z.number()
+    usageId: z.string(),
+    tenantId: idOf("tenants"),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    secretRef: z.string(),
+    proxyTokenId: z.string(),
+    sessionId: z.string(),
+    principalId: z.string(),
+    workspaceId: z.string().optional(),
+    modelId: z.string().optional(),
+    requestPath: z.string(),
+    status: z.enum(["success", "error"]),
+    responseStatus: z.number().optional(),
+    inputTokens: z.number().optional(),
+    outputTokens: z.number().optional(),
+    tokenCount: z.number().optional(),
+    latencyMs: z.number(),
+    estimatedCostUsd: z.number().optional(),
+    failureCode: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
   }),
   indices: [
     { kind: "index", name: "by_usageId", columns: ["usageId"] },
     { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
-    { kind: "index", name: "by_tenant_provider", columns: ["tenantId", "providerId", "createdAt"] },
-    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId", "createdAt"] },
-    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] }
+    {
+      kind: "index",
+      name: "by_tenant_provider",
+      columns: ["tenantId", "providerId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_proxyTokenId",
+      columns: ["proxyTokenId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_sessionId",
+      columns: ["sessionId", "createdAt"]
+    }
+  ]
+});
+var controlPlaneTenantProxyTokenLeases = defineTable({
+  name: "controlPlaneTenantProxyTokenLeases",
+  component: "mc",
+  category: "runtime",
+  shape: z.object({
+    leaseId: z.string(),
+    proxyTokenId: z.string(),
+    tenantId: idOf("tenants"),
+    workspaceId: idOf("workspaces").optional(),
+    environment: z.enum(["dev", "staging", "prod"]),
+    providerId: z.string(),
+    modelSlotId: z.string(),
+    bindingId: z.string(),
+    secretRef: z.string(),
+    sessionId: z.string(),
+    principalId: z.string(),
+    agentSessionId: z.string().optional(),
+    status: z.enum(["active", "revoked"]),
+    expiresAt: z.number(),
+    renewedAt: z.number().optional(),
+    revokedAt: z.number().optional(),
+    revokedBy: z.string().optional(),
+    revokeReason: z.string().optional(),
+    permitDecisionLogId: idOf("policyDecisionLogs").optional(),
+    permitTraceId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_leaseId", columns: ["leaseId"] },
+    { kind: "index", name: "by_proxyTokenId", columns: ["proxyTokenId"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId", "createdAt"] },
+    { kind: "index", name: "by_sessionId", columns: ["sessionId", "createdAt"] },
+    {
+      kind: "index",
+      name: "by_principalId",
+      columns: ["principalId", "createdAt"]
+    },
+    {
+      kind: "index",
+      name: "by_status_expiresAt",
+      columns: ["status", "expiresAt"]
+    }
   ]
 });
 
-export { compatibilityShims, controlPlaneTenantModelSlotBindings, controlPlaneTenantProviderSecrets, controlPlaneTenantProxyGatewayUsage, cutoverFlags, tenantDeploymentCredentials };
+export { compatibilityShims, controlPlaneTenantModelSlotBindings, controlPlaneTenantProviderSecrets, controlPlaneTenantProxyGatewayUsage, controlPlaneTenantProxyTokenLeases, cutoverFlags, permitSyncStates, secretSyncDriftReports, tenantDeploymentCredentials };
 //# sourceMappingURL=runtime.js.map
 //# sourceMappingURL=runtime.js.map