@lucern/contracts 0.3.0-alpha.17 → 0.3.0-alpha.2

package/dist/schemas/tables/controlPlane/accessControl.js

@@ -1,658 +0,0 @@
-import { z } from 'zod';
-
-// src/schemas/tables/controlPlane/accessControl.ts
-
-// src/dsl/defineTable.ts
-function defineTable(spec) {
-  return spec;
-}
-
-// src/schemas/tables/controlPlane/accessControl.ts
-var permitActorType = z.enum([
-  "human",
-  "agent",
-  "service_principal",
-  "external_stakeholder",
-  "system"
-]);
-var permitMembershipStatus = z.enum([
-  "active",
-  "invited",
-  "revoked",
-  "suspended",
-  "disabled"
-]);
-var permitDecision = z.enum(["allow", "deny"]);
-var permitAccessReviewStatus = z.enum([
-  "open",
-  "in_progress",
-  "approved",
-  "denied",
-  "expired",
-  "cancelled"
-]);
-var permitReviewScope = z.enum([
-  "tenant",
-  "workspace",
-  "resource_instance",
-  "group",
-  "principal",
-  "api_key",
-  "admin_action"
-]);
-var permitRecordStatus = z.enum([
-  "queued",
-  "inflight",
-  "completed",
-  "failed",
-  "skipped",
-  "stale"
-]);
-var permitObjectType = z.enum([
-  "resource",
-  "role",
-  "resource_role",
-  "resource_relation",
-  "tenant",
-  "workspace",
-  "principal",
-  "membership",
-  "group",
-  "resource_instance",
-  "relationship_tuple",
-  "role_assignment",
-  "attribute_binding",
-  "policy_bundle"
-]);
-var permitOutboxOperation = z.enum([
-  "upsert",
-  "delete",
-  "sync",
-  "resync",
-  "delete_sync",
-  "noop"
-]);
-var permitPolicyBundleStatus = z.enum([
-  "draft",
-  "validated",
-  "enforced",
-  "archived"
-]);
-var permitSyncStatus = z.enum([
-  "pending",
-  "synced",
-  "error",
-  "skipped"
-]);
-var permitAccessReviewSubjectType = z.enum([
-  "principal",
-  "group",
-  "role_assignment",
-  "resource_instance"
-]);
-var permitAttributeType = z.enum([
-  "string",
-  "number",
-  "bool",
-  "json",
-  "time"
-]);
-var permitAttributeOperator = z.enum([
-  "eq",
-  "neq",
-  "in",
-  "not_in",
-  "gt",
-  "gte",
-  "lt",
-  "lte",
-  "contains",
-  "not_contains",
-  "matches"
-]);
-var permitRoleBindingTarget = z.enum([
-  "principal",
-  "group"
-]);
-var permitPrincipals = defineTable({
-  name: "permitPrincipals",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    principalId: z.string(),
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    principalType: permitActorType,
-    status: permitMembershipStatus,
-    displayName: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    updatedBy: z.string().optional(),
-    lastSeenAt: z.number().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    { kind: "index", name: "by_tenant_principalId", columns: ["tenantId", "principalId"] },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
-    {
-      kind: "index",
-      name: "by_tenant_principalType_status",
-      columns: ["tenantId", "principalType", "status"]
-    }
-  ]
-});
-var permitPrincipalAliases = defineTable({
-  name: "permitPrincipalAliases",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    principalId: z.string(),
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    provider: z.string(),
-    providerSubjectId: z.string(),
-    providerProjectId: z.string().optional(),
-    alias: z.string(),
-    aliasKind: z.string(),
-    status: permitMembershipStatus,
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    revokedBy: z.string().optional(),
-    revokedAt: z.number().optional(),
-    updatedBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_principalId", columns: ["principalId"] },
-    { kind: "index", name: "by_provider_subject", columns: ["provider", "providerSubjectId"] },
-    { kind: "index", name: "by_provider_project_subject", columns: ["provider", "providerProjectId", "providerSubjectId"] },
-    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
-    { kind: "index", name: "by_tenant_provider_project_subject", columns: ["tenantId", "provider", "providerProjectId", "providerSubjectId"] },
-    {
-      kind: "index",
-      name: "by_tenant_provider_alias",
-      columns: ["tenantId", "provider", "alias"]
-    },
-    { kind: "index", name: "by_tenant_alias", columns: ["tenantId", "alias"] },
-    {
-      kind: "index",
-      name: "by_tenant_provider_status",
-      columns: ["tenantId", "provider", "status"]
-    }
-  ]
-});
-var permitGroups = defineTable({
-  name: "permitGroups",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    groupId: z.string(),
-    groupKey: z.string(),
-    groupName: z.string(),
-    groupType: z.enum(["tenant", "workspace", "external", "system", "dynamic"]),
-    status: permitMembershipStatus,
-    description: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    updatedBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    { kind: "index", name: "by_tenant_groupId", columns: ["tenantId", "groupId"] },
-    { kind: "index", name: "by_tenant_groupKey", columns: ["tenantId", "groupKey"] },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
-  ]
-});
-var permitGroupMemberships = defineTable({
-  name: "permitGroupMemberships",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    groupId: z.string(),
-    memberType: z.enum(["principal", "group"]),
-    memberId: z.string(),
-    principalId: z.string().optional(),
-    childGroupId: z.string().optional(),
-    status: permitMembershipStatus,
-    addedBy: z.string().optional(),
-    revokedBy: z.string().optional(),
-    expiresAt: z.number().optional(),
-    revocationReason: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    updatedBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenant_principal", columns: ["tenantId", "principalId"] },
-    { kind: "index", name: "by_tenant_member", columns: ["tenantId", "memberType", "memberId"] },
-    {
-      kind: "index",
-      name: "by_tenant_member_group",
-      columns: ["tenantId", "memberType", "memberId", "groupId"]
-    },
-    { kind: "index", name: "by_tenant_group", columns: ["tenantId", "groupId"] },
-    { kind: "index", name: "by_member_group", columns: ["memberType", "memberId", "groupId"] },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
-    {
-      kind: "index",
-      name: "by_workspace_principal",
-      columns: ["workspaceId", "principalId"]
-    }
-  ]
-});
-var permitResourceInstances = defineTable({
-  name: "permitResourceInstances",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    resourceType: z.string(),
-    resourceKey: z.string(),
-    resourceId: z.string(),
-    status: z.enum(["active", "deleted", "archived"]),
-    attributes: z.record(z.any()).optional(),
-    ownerPrincipalId: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    updatedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    {
-      kind: "index",
-      name: "by_tenant_resource_type",
-      columns: ["tenantId", "resourceType"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_resource_key",
-      columns: ["tenantId", "resourceType", "resourceKey"]
-    },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_ownerPrincipalId",
-      columns: ["ownerPrincipalId"]
-    }
-  ]
-});
-var permitRoleAssignments = defineTable({
-  name: "permitRoleAssignments",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    role: z.string(),
-    targetType: permitRoleBindingTarget,
-    targetId: z.string(),
-    resourceType: z.string(),
-    resourceKey: z.string(),
-    resourceInstanceId: z.string().optional(),
-    status: permitMembershipStatus,
-    expiresAt: z.number().optional(),
-    attributes: z.record(z.any()).optional(),
-    grantedBy: z.string().optional(),
-    updatedBy: z.string().optional(),
-    revokedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    {
-      kind: "index",
-      name: "by_tenant_target",
-      columns: ["tenantId", "targetType", "targetId"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_resource",
-      columns: ["tenantId", "resourceType", "resourceKey"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_role",
-      columns: ["tenantId", "role", "status"]
-    },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    {
-      kind: "index",
-      name: "by_workspace_resource",
-      columns: ["workspaceId", "resourceType", "resourceKey"]
-    }
-  ]
-});
-var permitRelationshipTuples = defineTable({
-  name: "permitRelationshipTuples",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    relation: z.string(),
-    subject: z.string(),
-    object: z.string(),
-    resourceType: z.string().optional(),
-    resourceKey: z.string().optional(),
-    status: permitRecordStatus,
-    attributes: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    lastSeenAt: z.number().optional(),
-    updatedBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenant_subject", columns: ["tenantId", "subject"] },
-    { kind: "index", name: "by_tenant_object", columns: ["tenantId", "object"] },
-    { kind: "index", name: "by_tenant_relation", columns: ["tenantId", "relation"] },
-    {
-      kind: "index",
-      name: "by_tenant_relation_subject",
-      columns: ["tenantId", "relation", "subject"]
-    },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
-  ]
-});
-var permitAttributeBindings = defineTable({
-  name: "permitAttributeBindings",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    targetType: permitRoleBindingTarget,
-    targetId: z.string(),
-    attributeName: z.string(),
-    attributeType: permitAttributeType,
-    attributeOperator: permitAttributeOperator,
-    attributeValue: z.any(),
-    status: permitRecordStatus,
-    source: z.string().optional(),
-    sourceRef: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    createdBy: z.string(),
-    updatedBy: z.string().optional(),
-    expiresAt: z.number().optional()
-  }),
-  indices: [
-    {
-      kind: "index",
-      name: "by_tenant_target",
-      columns: ["tenantId", "targetType", "targetId"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_target_attribute",
-      columns: ["tenantId", "targetType", "targetId", "attributeName"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_name",
-      columns: ["tenantId", "attributeName"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    }
-  ]
-});
-var permitPolicyBundles = defineTable({
-  name: "permitPolicyBundles",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    bundleKey: z.string(),
-    version: z.number(),
-    status: permitPolicyBundleStatus,
-    policyHash: z.string().optional(),
-    policyPayload: z.record(z.any()),
-    metadata: z.record(z.any()).optional(),
-    createdBy: z.string(),
-    reviewedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    retiredAt: z.number().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
-    {
-      kind: "index",
-      name: "by_tenant_bundleKey",
-      columns: ["tenantId", "bundleKey"]
-    },
-    {
-      kind: "index",
-      name: "by_tenant_bundle_version",
-      columns: ["tenantId", "bundleKey", "version"]
-    },
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
-  ]
-});
-var permitProjectionOutbox = defineTable({
-  name: "permitProjectionOutbox",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    syncKey: z.string(),
-    objectType: permitObjectType,
-    objectId: z.string(),
-    operation: permitOutboxOperation,
-    payload: z.record(z.any()),
-    status: permitRecordStatus,
-    attemptCount: z.number(),
-    nextAttemptAt: z.number().optional(),
-    lastError: z.string().optional(),
-    tenantId: z.string().optional(),
-    workspaceId: z.optional(z.string()),
-    principalId: z.string().optional(),
-    permitTenantKey: z.string().optional(),
-    permitResourceType: z.string().optional(),
-    permitResourceKey: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number(),
-    lastHandledAt: z.number().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_objectType",
-      columns: ["objectType", "status"]
-    }
-  ]
-});
-var tenantPermitSyncStates = defineTable({
-  name: "tenantPermitSyncStates",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    syncKey: z.string(),
-    objectType: permitObjectType,
-    objectId: z.string(),
-    tenantId: z.string().optional(),
-    workspaceId: z.string().optional(),
-    principalId: z.string().optional(),
-    permitTenantKey: z.string().optional(),
-    permitResourceType: z.string().optional(),
-    permitResourceKey: z.string().optional(),
-    desiredPayload: z.record(z.any()),
-    lastAppliedPayloadHash: z.string().optional(),
-    status: permitSyncStatus,
-    attemptCount: z.number(),
-    lastError: z.string().optional(),
-    nextAttemptAt: z.number().optional(),
-    lastSyncedAt: z.number().optional(),
-    createdBy: z.string(),
-    updatedBy: z.string().optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
-    { kind: "index", name: "by_status", columns: ["status"] },
-    {
-      kind: "index",
-      name: "by_tenant_status",
-      columns: ["tenantId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_workspace_status",
-      columns: ["workspaceId", "status"]
-    },
-    {
-      kind: "index",
-      name: "by_principal_status",
-      columns: ["principalId", "status"]
-    }
-  ]
-});
-var permitPolicyDecisionReceipts = defineTable({
-  name: "permitPolicyDecisionReceipts",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string().optional(),
-    workspaceId: z.string().optional(),
-    principalId: z.string(),
-    subjectType: permitAccessReviewSubjectType.optional(),
-    subjectId: z.string().optional(),
-    resourceType: z.string(),
-    resourceId: z.string(),
-    action: z.string(),
-    decision: permitDecision,
-    reasonCode: z.string(),
-    policyBundleId: z.string().optional(),
-    policyVersion: z.string(),
-    traceId: z.string().optional(),
-    requestId: z.string().optional(),
-    audienceMode: z.string().optional(),
-    audienceKey: z.string().optional(),
-    audienceClass: z.enum(["internal", "restricted_external", "public"]).optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    expiresAt: z.number().optional(),
-    createdBy: z.string().optional()
-  }),
-  indices: [
-    { kind: "index", name: "by_principal_createdAt", columns: ["principalId", "createdAt"] },
-    { kind: "index", name: "by_tenant_createdAt", columns: ["tenantId", "createdAt"] },
-    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId"] },
-    { kind: "index", name: "by_decision_createdAt", columns: ["decision", "createdAt"] },
-    { kind: "index", name: "by_traceId", columns: ["traceId"] },
-    { kind: "index", name: "by_action", columns: ["action"] }
-  ]
-});
-var permitAccessReviews = defineTable({
-  name: "permitAccessReviews",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    tenantId: z.string(),
-    workspaceId: z.optional(z.string()),
-    reviewKey: z.string(),
-    scope: permitReviewScope,
-    status: permitAccessReviewStatus,
-    subjectType: permitAccessReviewSubjectType,
-    subjectId: z.string(),
-    resourceType: z.string().optional(),
-    resourceKey: z.string().optional(),
-    outcome: z.enum(["allow", "deny"]).optional(),
-    requestedBy: z.string(),
-    reviewedBy: z.string().optional(),
-    requestedAt: z.number(),
-    reviewedAt: z.number().optional(),
-    dueAt: z.number().optional(),
-    justification: z.string().optional(),
-    rationale: z.string().optional(),
-    policyBundleId: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
-    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
-    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
-    {
-      kind: "index",
-      name: "by_tenant_subject",
-      columns: ["tenantId", "subjectType", "subjectId"]
-    },
-    { kind: "index", name: "by_outcome", columns: ["outcome"] },
-    {
-      kind: "index",
-      name: "by_workspace_status",
-      columns: ["workspaceId", "status"]
-    }
-  ]
-});
-var permitAccessReviewItems = defineTable({
-  name: "permitAccessReviewItems",
-  component: "control-plane",
-  category: "access-control",
-  shape: z.object({
-    reviewKey: z.string(),
-    itemKey: z.string(),
-    tenantId: z.string(),
-    workspaceId: z.string().optional(),
-    subjectType: permitAccessReviewSubjectType,
-    subjectId: z.string(),
-    resourceType: z.string().optional(),
-    resourceKey: z.string().optional(),
-    role: z.string().optional(),
-    relation: z.string().optional(),
-    status: z.enum(["open", "approved", "revoked", "changed", "deferred"]),
-    reviewerId: z.string().optional(),
-    decisionAt: z.number().optional(),
-    rationale: z.string().optional(),
-    metadata: z.record(z.any()).optional(),
-    createdAt: z.number(),
-    updatedAt: z.number()
-  }),
-  indices: [
-    { kind: "index", name: "by_reviewKey", columns: ["reviewKey"] },
-    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
-    { kind: "index", name: "by_tenant_itemKey", columns: ["tenantId", "itemKey"] },
-    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
-    { kind: "index", name: "by_status", columns: ["status"] }
-  ]
-});
-
-export { permitAccessReviewItems, permitAccessReviews, permitAttributeBindings, permitGroupMemberships, permitGroups, permitPolicyBundles, permitPolicyDecisionReceipts, permitPrincipalAliases, permitPrincipals, permitProjectionOutbox, permitRelationshipTuples, permitResourceInstances, permitRoleAssignments, tenantPermitSyncStates };
-//# sourceMappingURL=accessControl.js.map
-//# sourceMappingURL=accessControl.js.map