@lucern/contracts 0.3.0-alpha.9 → 1.0.0

package/dist/schemas/tables/controlPlane/accessControl.d.ts

@@ -0,0 +1,260 @@
+import { z } from 'zod';
+import { T as TableContract } from '../../../defineTable-t1wr5wgn.js';
+
+declare const permitPrincipals: TableContract<{
+    principalId: z.ZodString;
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    principalType: z.ZodEnum<["human", "agent", "service_principal", "external_stakeholder", "system"]>;
+    status: z.ZodEnum<["active", "invited", "revoked", "suspended", "disabled"]>;
+    displayName: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdBy: z.ZodString;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    updatedBy: z.ZodOptional<z.ZodString>;
+    lastSeenAt: z.ZodOptional<z.ZodNumber>;
+}>;
+declare const permitPrincipalAliases: TableContract<{
+    principalId: z.ZodString;
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    provider: z.ZodString;
+    providerSubjectId: z.ZodString;
+    providerProjectId: z.ZodOptional<z.ZodString>;
+    alias: z.ZodString;
+    aliasKind: z.ZodString;
+    status: z.ZodEnum<["active", "invited", "revoked", "suspended", "disabled"]>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdBy: z.ZodString;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    revokedAt: z.ZodOptional<z.ZodNumber>;
+    updatedBy: z.ZodOptional<z.ZodString>;
+}>;
+declare const permitGroups: TableContract<{
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    groupId: z.ZodString;
+    groupKey: z.ZodString;
+    groupName: z.ZodString;
+    groupType: z.ZodEnum<["tenant", "workspace", "external", "system", "dynamic"]>;
+    status: z.ZodEnum<["active", "invited", "revoked", "suspended", "disabled"]>;
+    description: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdBy: z.ZodString;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    updatedBy: z.ZodOptional<z.ZodString>;
+}>;
+declare const permitGroupMemberships: TableContract<{
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    groupId: z.ZodString;
+    memberType: z.ZodEnum<["principal", "group"]>;
+    memberId: z.ZodString;
+    principalId: z.ZodOptional<z.ZodString>;
+    childGroupId: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<["active", "invited", "revoked", "suspended", "disabled"]>;
+    addedBy: z.ZodOptional<z.ZodString>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    revocationReason: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    updatedBy: z.ZodOptional<z.ZodString>;
+}>;
+declare const permitResourceInstances: TableContract<{
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    resourceType: z.ZodString;
+    resourceKey: z.ZodString;
+    resourceId: z.ZodString;
+    status: z.ZodEnum<["active", "deleted", "archived"]>;
+    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    ownerPrincipalId: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdBy: z.ZodString;
+    updatedBy: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}>;
+declare const permitRoleAssignments: TableContract<{
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    role: z.ZodString;
+    targetType: z.ZodEnum<["principal", "group"]>;
+    targetId: z.ZodString;
+    resourceType: z.ZodString;
+    resourceKey: z.ZodString;
+    resourceInstanceId: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<["active", "invited", "revoked", "suspended", "disabled"]>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    grantedBy: z.ZodOptional<z.ZodString>;
+    updatedBy: z.ZodOptional<z.ZodString>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}>;
+declare const permitRelationshipTuples: TableContract<{
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    relation: z.ZodString;
+    subject: z.ZodString;
+    object: z.ZodString;
+    resourceType: z.ZodOptional<z.ZodString>;
+    resourceKey: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<["queued", "inflight", "completed", "failed", "skipped", "stale"]>;
+    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdBy: z.ZodString;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    lastSeenAt: z.ZodOptional<z.ZodNumber>;
+    updatedBy: z.ZodOptional<z.ZodString>;
+}>;
+declare const permitAttributeBindings: TableContract<{
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    targetType: z.ZodEnum<["principal", "group"]>;
+    targetId: z.ZodString;
+    attributeName: z.ZodString;
+    attributeType: z.ZodEnum<["string", "number", "bool", "json", "time"]>;
+    attributeOperator: z.ZodEnum<["eq", "neq", "in", "not_in", "gt", "gte", "lt", "lte", "contains", "not_contains", "matches"]>;
+    attributeValue: z.ZodAny;
+    status: z.ZodEnum<["queued", "inflight", "completed", "failed", "skipped", "stale"]>;
+    source: z.ZodOptional<z.ZodString>;
+    sourceRef: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    createdBy: z.ZodString;
+    updatedBy: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+}>;
+declare const permitPolicyBundles: TableContract<{
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    bundleKey: z.ZodString;
+    version: z.ZodNumber;
+    status: z.ZodEnum<["draft", "validated", "enforced", "archived"]>;
+    policyHash: z.ZodOptional<z.ZodString>;
+    policyPayload: z.ZodRecord<z.ZodString, z.ZodAny>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdBy: z.ZodString;
+    reviewedBy: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    retiredAt: z.ZodOptional<z.ZodNumber>;
+}>;
+declare const permitProjectionOutbox: TableContract<{
+    syncKey: z.ZodString;
+    objectType: z.ZodEnum<["resource", "role", "resource_role", "resource_relation", "tenant", "workspace", "principal", "membership", "group", "resource_instance", "relationship_tuple", "role_assignment", "attribute_binding", "policy_bundle"]>;
+    objectId: z.ZodString;
+    operation: z.ZodEnum<["upsert", "delete", "sync", "resync", "delete_sync", "noop"]>;
+    payload: z.ZodRecord<z.ZodString, z.ZodAny>;
+    status: z.ZodEnum<["queued", "inflight", "completed", "failed", "skipped", "stale"]>;
+    attemptCount: z.ZodNumber;
+    nextAttemptAt: z.ZodOptional<z.ZodNumber>;
+    lastError: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    principalId: z.ZodOptional<z.ZodString>;
+    permitTenantKey: z.ZodOptional<z.ZodString>;
+    permitResourceType: z.ZodOptional<z.ZodString>;
+    permitResourceKey: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    lastHandledAt: z.ZodOptional<z.ZodNumber>;
+}>;
+declare const tenantPermitSyncStates: TableContract<{
+    syncKey: z.ZodString;
+    objectType: z.ZodEnum<["resource", "role", "resource_role", "resource_relation", "tenant", "workspace", "principal", "membership", "group", "resource_instance", "relationship_tuple", "role_assignment", "attribute_binding", "policy_bundle"]>;
+    objectId: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    principalId: z.ZodOptional<z.ZodString>;
+    permitTenantKey: z.ZodOptional<z.ZodString>;
+    permitResourceType: z.ZodOptional<z.ZodString>;
+    permitResourceKey: z.ZodOptional<z.ZodString>;
+    desiredPayload: z.ZodRecord<z.ZodString, z.ZodAny>;
+    lastAppliedPayloadHash: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<["pending", "synced", "error", "skipped"]>;
+    attemptCount: z.ZodNumber;
+    lastError: z.ZodOptional<z.ZodString>;
+    nextAttemptAt: z.ZodOptional<z.ZodNumber>;
+    lastSyncedAt: z.ZodOptional<z.ZodNumber>;
+    createdBy: z.ZodString;
+    updatedBy: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}>;
+declare const permitPolicyDecisionReceipts: TableContract<{
+    tenantId: z.ZodOptional<z.ZodString>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    principalId: z.ZodString;
+    subjectType: z.ZodOptional<z.ZodEnum<["principal", "group", "role_assignment", "resource_instance"]>>;
+    subjectId: z.ZodOptional<z.ZodString>;
+    resourceType: z.ZodString;
+    resourceId: z.ZodString;
+    action: z.ZodString;
+    decision: z.ZodEnum<["allow", "deny"]>;
+    reasonCode: z.ZodString;
+    policyBundleId: z.ZodOptional<z.ZodString>;
+    policyVersion: z.ZodString;
+    traceId: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    audienceMode: z.ZodOptional<z.ZodString>;
+    audienceKey: z.ZodOptional<z.ZodString>;
+    audienceClass: z.ZodOptional<z.ZodEnum<["internal", "restricted_external", "public"]>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdAt: z.ZodNumber;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    createdBy: z.ZodOptional<z.ZodString>;
+}>;
+declare const permitAccessReviews: TableContract<{
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    reviewKey: z.ZodString;
+    scope: z.ZodEnum<["tenant", "workspace", "resource_instance", "group", "principal", "api_key", "admin_action"]>;
+    status: z.ZodEnum<["open", "in_progress", "approved", "denied", "expired", "cancelled"]>;
+    subjectType: z.ZodEnum<["principal", "group", "role_assignment", "resource_instance"]>;
+    subjectId: z.ZodString;
+    resourceType: z.ZodOptional<z.ZodString>;
+    resourceKey: z.ZodOptional<z.ZodString>;
+    outcome: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+    requestedBy: z.ZodString;
+    reviewedBy: z.ZodOptional<z.ZodString>;
+    requestedAt: z.ZodNumber;
+    reviewedAt: z.ZodOptional<z.ZodNumber>;
+    dueAt: z.ZodOptional<z.ZodNumber>;
+    justification: z.ZodOptional<z.ZodString>;
+    rationale: z.ZodOptional<z.ZodString>;
+    policyBundleId: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}>;
+declare const permitAccessReviewItems: TableContract<{
+    reviewKey: z.ZodString;
+    itemKey: z.ZodString;
+    tenantId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    subjectType: z.ZodEnum<["principal", "group", "role_assignment", "resource_instance"]>;
+    subjectId: z.ZodString;
+    resourceType: z.ZodOptional<z.ZodString>;
+    resourceKey: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodString>;
+    relation: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<["open", "approved", "revoked", "changed", "deferred"]>;
+    reviewerId: z.ZodOptional<z.ZodString>;
+    decisionAt: z.ZodOptional<z.ZodNumber>;
+    rationale: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}>;
+
+export { permitAccessReviewItems, permitAccessReviews, permitAttributeBindings, permitGroupMemberships, permitGroups, permitPolicyBundles, permitPolicyDecisionReceipts, permitPrincipalAliases, permitPrincipals, permitProjectionOutbox, permitRelationshipTuples, permitResourceInstances, permitRoleAssignments, tenantPermitSyncStates };