@objectstack/spec 0.7.1 → 0.8.0

package/dist/permission/rls.zod.d.ts

@@ -99,7 +99,13 @@ import { z } from 'zod';
  * - **delete**: Controls which rows can be deleted (DELETE statements)
  * - **all**: Shorthand for all operations (equivalent to defining 4 separate policies)
  */
-export declare const RLSOperation: z.ZodEnum<["select", "insert", "update", "delete", "all"]>;
+export declare const RLSOperation: z.ZodEnum<{
+    select: "select";
+    insert: "insert";
+    update: "update";
+    delete: "delete";
+    all: "all";
+}>;
 export type RLSOperation = z.infer<typeof RLSOperation>;
 /**
  * Row-Level Security Policy Schema
@@ -195,206 +201,25 @@ export type RLSOperation = z.infer<typeof RLSOperation>;
  * }
  * ```
  */
-export declare const RowLevelSecurityPolicySchema: z.ZodEffects<z.ZodObject<{
-    /**
-     * Unique identifier for this policy.
-     * Must be unique within the object.
-     * Use snake_case following ObjectStack naming conventions.
-     *
-     * @example "tenant_isolation", "owner_access", "manager_team_view"
-     */
+export declare const RowLevelSecurityPolicySchema: z.ZodObject<{
     name: z.ZodString;
-    /**
-     * Human-readable label for the policy.
-     * Used in admin UI and logs.
-     *
-     * @example "Multi-Tenant Data Isolation", "Owner-Based Access"
-     */
     label: z.ZodOptional<z.ZodString>;
-    /**
-     * Description explaining what this policy does and why.
-     * Helps with governance and compliance.
-     *
-     * @example "Ensures users can only access records from their own tenant organization"
-     */
     description: z.ZodOptional<z.ZodString>;
-    /**
-     * Target object (table) this policy applies to.
-     * Must reference a valid ObjectStack object name.
-     *
-     * @example "account", "opportunity", "contact", "custom_object"
-     */
     object: z.ZodString;
-    /**
-     * Database operation(s) this policy applies to.
-     *
-     * - **select**: Controls read access (SELECT queries)
-     * - **insert**: Controls insert access (INSERT statements)
-     * - **update**: Controls update access (UPDATE statements)
-     * - **delete**: Controls delete access (DELETE statements)
-     * - **all**: Applies to all operations
-     *
-     * @example "select" - Most common, controls what users can view
-     * @example "all" - Apply same rule to all operations
-     */
-    operation: z.ZodEnum<["select", "insert", "update", "delete", "all"]>;
-    /**
-     * USING clause - Filter condition for SELECT/UPDATE/DELETE.
-     *
-     * This is a SQL-like expression evaluated for each row.
-     * Only rows where this expression returns TRUE are accessible.
-     *
-     * **Note**: For INSERT-only policies, USING is not required (only CHECK is needed).
-     * For SELECT/UPDATE/DELETE operations, USING is required.
-     *
-     * **Security Note**: RLS conditions are executed at the database level with
-     * parameterized queries. The implementation must use prepared statements
-     * to prevent SQL injection. Never concatenate user input directly into
-     * RLS conditions.
-     *
-     * **SQL Dialect**: Compatible with PostgreSQL SQL syntax. Implementations
-     * may adapt to other databases (MySQL, SQL Server, etc.) but should maintain
-     * semantic equivalence.
-     *
-     * Available context variables:
-     * - `current_user.id` - Current user's ID
-     * - `current_user.tenant_id` - Current user's tenant (maps to `tenantId` in RLSUserContext)
-     * - `current_user.role` - Current user's role
-     * - `current_user.department` - Current user's department
-     * - `current_user.*` - Any custom user field
-     * - `NOW()` - Current timestamp
-     * - `CURRENT_DATE` - Current date
-     * - `CURRENT_TIME` - Current time
-     *
-     * **Context Variable Mapping**: The RLSUserContext schema uses camelCase (e.g., `tenantId`),
-     * but expressions use snake_case with `current_user.` prefix (e.g., `current_user.tenant_id`).
-     * Implementations must handle this mapping.
-     *
-     * Supported operators:
-     * - Comparison: =, !=, <, >, <=, >=, <> (not equal)
-     * - Logical: AND, OR, NOT
-     * - NULL checks: IS NULL, IS NOT NULL
-     * - Set operations: IN, NOT IN
-     * - String: LIKE, NOT LIKE, ILIKE (case-insensitive)
-     * - Pattern matching: ~ (regex), !~ (not regex)
-     * - Subqueries: (SELECT ...)
-     * - Array operations: ANY, ALL
-     *
-     * **Prohibited**: Dynamic SQL, DDL statements, DML statements (INSERT/UPDATE/DELETE)
-     *
-     * @example "tenant_id = current_user.tenant_id"
-     * @example "owner_id = current_user.id OR created_by = current_user.id"
-     * @example "department IN (SELECT department FROM user_departments WHERE user_id = current_user.id)"
-     * @example "status = 'active' AND expiry_date > NOW()"
-     */
+    operation: z.ZodEnum<{
+        select: "select";
+        insert: "insert";
+        update: "update";
+        delete: "delete";
+        all: "all";
+    }>;
     using: z.ZodOptional<z.ZodString>;
-    /**
-     * CHECK clause - Validation for INSERT/UPDATE operations.
-     *
-     * Similar to USING but applies to new/modified rows.
-     * Prevents users from creating/updating rows they wouldn't be able to see.
-     *
-     * **Default Behavior**: If not specified, implementations should use the
-     * USING clause as the CHECK clause. This ensures data integrity by preventing
-     * users from creating records they cannot view.
-     *
-     * Use cases:
-     * - Prevent cross-tenant data creation
-     * - Enforce mandatory field values
-     * - Validate data integrity rules
-     * - Restrict certain operations (e.g., only allow creating "draft" status)
-     *
-     * @example "tenant_id = current_user.tenant_id"
-     * @example "status IN ('draft', 'pending')" - Only allow certain statuses
-     * @example "created_by = current_user.id" - Must be the creator
-     */
     check: z.ZodOptional<z.ZodString>;
-    /**
-     * Restrict this policy to specific roles.
-     * If specified, only users with these roles will have this policy applied.
-     * If omitted, policy applies to all users (except those with bypassRLS permission).
-     *
-     * Role names must match defined roles in the system.
-     *
-     * @example ["sales_rep", "account_manager"]
-     * @example ["employee"] - Apply to all employees
-     * @example ["guest"] - Special restrictions for guests
-     */
-    roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /**
-     * Whether this policy is currently active.
-     * Disabled policies are not evaluated.
-     * Useful for temporary policy changes without deletion.
-     *
-     * @default true
-     */
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     enabled: z.ZodDefault<z.ZodBoolean>;
-    /**
-     * Policy priority for conflict resolution.
-     * Higher numbers = higher priority.
-     * When multiple policies apply, the most permissive wins (OR logic).
-     * Priority is only used for ordering evaluation (performance).
-     *
-     * @default 0
-     */
     priority: z.ZodDefault<z.ZodNumber>;
-    /**
-     * Tags for policy categorization and reporting.
-     * Useful for governance, compliance, and auditing.
-     *
-     * @example ["compliance", "gdpr", "pci"]
-     * @example ["multi-tenant", "security"]
-     */
-    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, "strip", z.ZodTypeAny, {
-    object: string;
-    enabled: boolean;
-    name: string;
-    priority: number;
-    operation: "select" | "insert" | "update" | "delete" | "all";
-    roles?: string[] | undefined;
-    tags?: string[] | undefined;
-    label?: string | undefined;
-    description?: string | undefined;
-    using?: string | undefined;
-    check?: string | undefined;
-}, {
-    object: string;
-    name: string;
-    operation: "select" | "insert" | "update" | "delete" | "all";
-    enabled?: boolean | undefined;
-    roles?: string[] | undefined;
-    tags?: string[] | undefined;
-    label?: string | undefined;
-    description?: string | undefined;
-    priority?: number | undefined;
-    using?: string | undefined;
-    check?: string | undefined;
-}>, {
-    object: string;
-    enabled: boolean;
-    name: string;
-    priority: number;
-    operation: "select" | "insert" | "update" | "delete" | "all";
-    roles?: string[] | undefined;
-    tags?: string[] | undefined;
-    label?: string | undefined;
-    description?: string | undefined;
-    using?: string | undefined;
-    check?: string | undefined;
-}, {
-    object: string;
-    name: string;
-    operation: "select" | "insert" | "update" | "delete" | "all";
-    enabled?: boolean | undefined;
-    roles?: string[] | undefined;
-    tags?: string[] | undefined;
-    label?: string | undefined;
-    description?: string | undefined;
-    priority?: number | undefined;
-    using?: string | undefined;
-    check?: string | undefined;
-}>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
 /**
  * RLS Configuration Schema
  *
@@ -402,85 +227,18 @@ export declare const RowLevelSecurityPolicySchema: z.ZodEffects<z.ZodObject<{
  * Defines how RLS is enforced across the entire platform.
  */
 export declare const RLSConfigSchema: z.ZodObject<{
-    /**
-     * Global RLS enable/disable flag.
-     * When false, all RLS policies are ignored (use with caution!).
-     *
-     * @default true
-     */
     enabled: z.ZodDefault<z.ZodBoolean>;
-    /**
-     * Default behavior when no policies match.
-     *
-     * - **deny**: Deny access (secure default)
-     * - **allow**: Allow access (permissive mode, not recommended)
-     *
-     * @default "deny"
-     */
-    defaultPolicy: z.ZodDefault<z.ZodEnum<["deny", "allow"]>>;
-    /**
-     * Whether to allow superusers to bypass RLS.
-     * Superusers include system administrators and service accounts.
-     *
-     * @default true
-     */
+    defaultPolicy: z.ZodDefault<z.ZodEnum<{
+        deny: "deny";
+        allow: "allow";
+    }>>;
     allowSuperuserBypass: z.ZodDefault<z.ZodBoolean>;
-    /**
-     * List of roles that can bypass RLS.
-     * Users with these roles see all records regardless of policies.
-     *
-     * @example ["system_admin", "data_auditor"]
-     */
-    bypassRoles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /**
-     * Whether to log RLS policy evaluations.
-     * Useful for debugging and auditing.
-     * Can impact performance if enabled globally.
-     *
-     * @default false
-     */
+    bypassRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     logEvaluations: z.ZodDefault<z.ZodBoolean>;
-    /**
-     * Cache RLS policy evaluation results.
-     * Can improve performance for frequently accessed records.
-     * Cache is invalidated when policies change or user context changes.
-     *
-     * @default true
-     */
     cacheResults: z.ZodDefault<z.ZodBoolean>;
-    /**
-     * Cache TTL in seconds.
-     * How long to cache RLS evaluation results.
-     *
-     * @default 300 (5 minutes)
-     */
     cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
-    /**
-     * Performance optimization: Pre-fetch user context.
-     * Load user context once per request instead of per-query.
-     *
-     * @default true
-     */
     prefetchUserContext: z.ZodDefault<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    enabled: boolean;
-    defaultPolicy: "deny" | "allow";
-    allowSuperuserBypass: boolean;
-    logEvaluations: boolean;
-    cacheResults: boolean;
-    cacheTtlSeconds: number;
-    prefetchUserContext: boolean;
-    bypassRoles?: string[] | undefined;
-}, {
-    enabled?: boolean | undefined;
-    defaultPolicy?: "deny" | "allow" | undefined;
-    allowSuperuserBypass?: boolean | undefined;
-    bypassRoles?: string[] | undefined;
-    logEvaluations?: boolean | undefined;
-    cacheResults?: boolean | undefined;
-    cacheTtlSeconds?: number | undefined;
-    prefetchUserContext?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 /**
  * User Context Schema
  *
@@ -488,46 +246,13 @@ export declare const RLSConfigSchema: z.ZodObject<{
  * This data is used to evaluate USING and CHECK clauses.
  */
 export declare const RLSUserContextSchema: z.ZodObject<{
-    /**
-     * User ID
-     */
     id: z.ZodString;
-    /**
-     * User email
-     */
     email: z.ZodOptional<z.ZodString>;
-    /**
-     * Tenant/Organization ID
-     */
     tenantId: z.ZodOptional<z.ZodString>;
-    /**
-     * User role(s)
-     */
-    role: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
-    /**
-     * User department
-     */
+    role: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
     department: z.ZodOptional<z.ZodString>;
-    /**
-     * Additional custom attributes
-     * Can include any custom user fields for RLS evaluation
-     */
     attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-}, "strip", z.ZodTypeAny, {
-    id: string;
-    email?: string | undefined;
-    tenantId?: string | undefined;
-    role?: string | string[] | undefined;
-    department?: string | undefined;
-    attributes?: Record<string, any> | undefined;
-}, {
-    id: string;
-    email?: string | undefined;
-    tenantId?: string | undefined;
-    role?: string | string[] | undefined;
-    department?: string | undefined;
-    attributes?: Record<string, any> | undefined;
-}>;
+}, z.core.$strip>;
 /**
  * RLS Policy Evaluation Result
  *
@@ -535,45 +260,13 @@ export declare const RLSUserContextSchema: z.ZodObject<{
  * Used for debugging and audit logging.
  */
 export declare const RLSEvaluationResultSchema: z.ZodObject<{
-    /**
-     * Policy name that was evaluated
-     */
     policyName: z.ZodString;
-    /**
-     * Whether access was granted
-     */
     granted: z.ZodBoolean;
-    /**
-     * Evaluation duration in milliseconds
-     */
     durationMs: z.ZodOptional<z.ZodNumber>;
-    /**
-     * Error message if evaluation failed
-     */
     error: z.ZodOptional<z.ZodString>;
-    /**
-     * Evaluated USING clause result
-     */
     usingResult: z.ZodOptional<z.ZodBoolean>;
-    /**
-     * Evaluated CHECK clause result (for INSERT/UPDATE)
-     */
     checkResult: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    policyName: string;
-    granted: boolean;
-    error?: string | undefined;
-    durationMs?: number | undefined;
-    usingResult?: boolean | undefined;
-    checkResult?: boolean | undefined;
-}, {
-    policyName: string;
-    granted: boolean;
-    error?: string | undefined;
-    durationMs?: number | undefined;
-    usingResult?: boolean | undefined;
-    checkResult?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 /**
  * Type exports
  */

package/dist/permission/rls.zod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rls.zod.d.ts","sourceRoot":"","sources":["../../src/permission/rls.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,4DAA0D,CAAC;AAEpF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,eAAO,MAAM,4BAA4B;IACvC;;;;;;OAMG;;IAKH;;;;;OAKG;;IAKH;;;;;OAKG;;IAKH;;;;;OAKG;;IAIH;;;;;;;;;;;OAWG;;IAIH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;;IAKH;;;;;;;;;;;;;;;;;;;OAmBG;;IAKH;;;;;;;;;;OAUG;;IAKH;;;;;;OAMG;;IAKH;;;;;;;OAOG;;IAMH;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBH,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe;IAC1B;;;;;OAKG;;IAKH;;;;;;;OAOG;;IAKH;;;;;OAKG;;IAKH;;;;;OAKG;;IAKH;;;;;;OAMG;;IAKH;;;;;;OAMG;;IAKH;;;;;OAKG;;IAOH;;;;;OAKG;;;;;;;;;;;;;;;;;;;;EAIH,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;IAC/B;;OAEG;;IAIH;;OAEG;;IAMH;;OAEG;;IAKH;;OAEG;;IAQH;;OAEG;;IAKH;;;OAGG;;;;;;;;;;;;;;;;EAIH,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;IACpC;;OAEG;;IAIH;;OAEG;;IAIH;;OAEG;;IAKH;;OAEG;;IAKH;;OAEG;;IAKH;;OAEG;;;;;;;;;;;;;;;;EAIH,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;GAEG;AACH,eAAO,MAAM,GAAG;IACd;;OAEG;mCACmB,MAAM,eAAc,MAAM,KAAgB,sBAAsB;IAUtF;;OAEG;oCACoB,MAAM,gBAAe,MAAM,KAAiB,sBAAsB;IAWzF;;OAEG;kCACkB,MAAM,SAAS,MAAM,EAAE,aAAa,MAAM,KAAG,sBAAsB;IAWxF;;OAEG;sCACsB,MAAM,SAAS,MAAM,EAAE,KAAG,sBAAsB;CAUjE,CAAC"}
+{"version":3,"file":"rls.zod.d.ts","sourceRoot":"","sources":["../../src/permission/rls.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;;;EAA0D,CAAC;AAEpF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;iBAkMvC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;iBAsF1B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBA8C/B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAwCpC,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;GAEG;AACH,eAAO,MAAM,GAAG;IACd;;OAEG;mCACmB,MAAM,eAAc,MAAM,KAAgB,sBAAsB;IAUtF;;OAEG;oCACoB,MAAM,gBAAe,MAAM,KAAiB,sBAAsB;IAWzF;;OAEG;kCACkB,MAAM,SAAS,MAAM,EAAE,aAAa,MAAM,KAAG,sBAAsB;IAWxF;;OAEG;sCACsB,MAAM,SAAS,MAAM,EAAE,KAAG,sBAAsB;CAUjE,CAAC"}

package/dist/permission/rls.zod.js

@@ -511,7 +511,7 @@ exports.RLSUserContextSchema = zod_1.z.object({
      * Additional custom attributes
      * Can include any custom user fields for RLS evaluation
      */
-    attributes: zod_1.z.record(zod_1.z.any())
+    attributes: zod_1.z.record(zod_1.z.string(), zod_1.z.any())
         .optional()
         .describe('Additional custom user attributes'),
 });

package/dist/permission/sharing.zod.d.ts

@@ -3,22 +3,40 @@ import { z } from 'zod';
  * Organization-Wide Defaults (OWD)
  * The baseline security posture for an object.
  */
-export declare const OWDModel: z.ZodEnum<["private", "public_read", "public_read_write", "controlled_by_parent"]>;
+export declare const OWDModel: z.ZodEnum<{
+    private: "private";
+    public_read: "public_read";
+    public_read_write: "public_read_write";
+    controlled_by_parent: "controlled_by_parent";
+}>;
 /**
  * Sharing Rule Type
  * How is the data shared?
  */
-export declare const SharingRuleType: z.ZodEnum<["owner", "criteria"]>;
+export declare const SharingRuleType: z.ZodEnum<{
+    owner: "owner";
+    criteria: "criteria";
+}>;
 /**
  * Sharing Level
  * What access is granted?
  */
-export declare const SharingLevel: z.ZodEnum<["read", "edit", "full"]>;
+export declare const SharingLevel: z.ZodEnum<{
+    full: "full";
+    read: "read";
+    edit: "edit";
+}>;
 /**
  * Recipient Type
  * Who receives the access?
  */
-export declare const ShareRecipientType: z.ZodEnum<["user", "group", "role", "role_and_subordinates", "guest"]>;
+export declare const ShareRecipientType: z.ZodEnum<{
+    role: "role";
+    user: "user";
+    group: "group";
+    role_and_subordinates: "role_and_subordinates";
+    guest: "guest";
+}>;
 /**
  * 1. Criteria-Based Sharing Rule
  * Share records that meet specific field criteria.
@@ -29,47 +47,24 @@ export declare const CriteriaSharingRuleSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     object: z.ZodString;
     active: z.ZodDefault<z.ZodBoolean>;
-    accessLevel: z.ZodDefault<z.ZodEnum<["read", "edit", "full"]>>;
+    accessLevel: z.ZodDefault<z.ZodEnum<{
+        full: "full";
+        read: "read";
+        edit: "edit";
+    }>>;
     sharedWith: z.ZodObject<{
-        type: z.ZodEnum<["user", "group", "role", "role_and_subordinates", "guest"]>;
+        type: z.ZodEnum<{
+            role: "role";
+            user: "user";
+            group: "group";
+            role_and_subordinates: "role_and_subordinates";
+            guest: "guest";
+        }>;
         value: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    }, {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    }>;
-} & {
+    }, z.core.$strip>;
     type: z.ZodLiteral<"criteria">;
     condition: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    object: string;
-    type: "criteria";
-    name: string;
-    active: boolean;
-    condition: string;
-    sharedWith: {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    };
-    accessLevel: "full" | "read" | "edit";
-    label?: string | undefined;
-    description?: string | undefined;
-}, {
-    object: string;
-    type: "criteria";
-    name: string;
-    condition: string;
-    sharedWith: {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    };
-    label?: string | undefined;
-    description?: string | undefined;
-    active?: boolean | undefined;
-    accessLevel?: "full" | "read" | "edit" | undefined;
-}>;
+}, z.core.$strip>;
 /**
  * 2. Owner-Based Sharing Rule
  * Share records owned by a specific group of users.
@@ -80,62 +75,33 @@ export declare const OwnerSharingRuleSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     object: z.ZodString;
     active: z.ZodDefault<z.ZodBoolean>;
-    accessLevel: z.ZodDefault<z.ZodEnum<["read", "edit", "full"]>>;
+    accessLevel: z.ZodDefault<z.ZodEnum<{
+        full: "full";
+        read: "read";
+        edit: "edit";
+    }>>;
     sharedWith: z.ZodObject<{
-        type: z.ZodEnum<["user", "group", "role", "role_and_subordinates", "guest"]>;
+        type: z.ZodEnum<{
+            role: "role";
+            user: "user";
+            group: "group";
+            role_and_subordinates: "role_and_subordinates";
+            guest: "guest";
+        }>;
         value: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    }, {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    }>;
-} & {
+    }, z.core.$strip>;
     type: z.ZodLiteral<"owner">;
     ownedBy: z.ZodObject<{
-        type: z.ZodEnum<["user", "group", "role", "role_and_subordinates", "guest"]>;
+        type: z.ZodEnum<{
+            role: "role";
+            user: "user";
+            group: "group";
+            role_and_subordinates: "role_and_subordinates";
+            guest: "guest";
+        }>;
         value: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    }, {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    }>;
-}, "strip", z.ZodTypeAny, {
-    object: string;
-    type: "owner";
-    name: string;
-    active: boolean;
-    sharedWith: {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    };
-    accessLevel: "full" | "read" | "edit";
-    ownedBy: {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    };
-    label?: string | undefined;
-    description?: string | undefined;
-}, {
-    object: string;
-    type: "owner";
-    name: string;
-    sharedWith: {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    };
-    ownedBy: {
-        value: string;
-        type: "role" | "user" | "group" | "role_and_subordinates" | "guest";
-    };
-    label?: string | undefined;
-    description?: string | undefined;
-    active?: boolean | undefined;
-    accessLevel?: "full" | "read" | "edit" | undefined;
-}>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 /**
  * Master Sharing Rule Schema
  */

package/dist/permission/sharing.zod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharing.zod.d.ts","sourceRoot":"","sources":["../../src/permission/sharing.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,QAAQ,oFAKnB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe,kCAG1B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,qCAIvB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,wEAM7B,CAAC;AA0BH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGpC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAG3C,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"sharing.zod.d.ts","sourceRoot":"","sources":["../../src/permission/sharing.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,QAAQ;;;;;EAKnB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe;;;EAG1B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;EAIvB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;EAM7B,CAAC;AA0BH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;iBAGpC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAG3C,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}