@runfile-ai/schemas 0.1.0

package/dist/vault.d.ts

@@ -0,0 +1,459 @@
+import { z } from 'zod';
+export declare const ClassificationEnum: z.ZodEnum<["person_name", "email", "phone", "address", "dob", "tax_id_partial", "account_id", "user_handle", "other_identifier"]>;
+export type Classification = z.infer<typeof ClassificationEnum>;
+export declare const TokenizeRequestSchema: z.ZodObject<{
+    value: z.ZodString;
+    classification: z.ZodEnum<["person_name", "email", "phone", "address", "dob", "tax_id_partial", "account_id", "user_handle", "other_identifier"]>;
+    context: z.ZodOptional<z.ZodObject<{
+        normalize: z.ZodDefault<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        normalize: boolean;
+    }, {
+        normalize?: boolean | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    classification: "email" | "person_name" | "phone" | "address" | "dob" | "tax_id_partial" | "account_id" | "user_handle" | "other_identifier";
+    context?: {
+        normalize: boolean;
+    } | undefined;
+}, {
+    value: string;
+    classification: "email" | "person_name" | "phone" | "address" | "dob" | "tax_id_partial" | "account_id" | "user_handle" | "other_identifier";
+    context?: {
+        normalize?: boolean | undefined;
+    } | undefined;
+}>;
+export type TokenizeRequest = z.infer<typeof TokenizeRequestSchema>;
+export declare const TokenizeResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    created: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    token: string;
+    created: boolean;
+}, {
+    token: string;
+    created: boolean;
+}>;
+export type TokenizeResponse = z.infer<typeof TokenizeResponseSchema>;
+export declare const TokenizeBatchRequestSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        value: z.ZodString;
+        classification: z.ZodEnum<["person_name", "email", "phone", "address", "dob", "tax_id_partial", "account_id", "user_handle", "other_identifier"]>;
+        context: z.ZodOptional<z.ZodObject<{
+            normalize: z.ZodDefault<z.ZodBoolean>;
+        }, "strict", z.ZodTypeAny, {
+            normalize: boolean;
+        }, {
+            normalize?: boolean | undefined;
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        classification: "email" | "person_name" | "phone" | "address" | "dob" | "tax_id_partial" | "account_id" | "user_handle" | "other_identifier";
+        context?: {
+            normalize: boolean;
+        } | undefined;
+    }, {
+        value: string;
+        classification: "email" | "person_name" | "phone" | "address" | "dob" | "tax_id_partial" | "account_id" | "user_handle" | "other_identifier";
+        context?: {
+            normalize?: boolean | undefined;
+        } | undefined;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    items: {
+        value: string;
+        classification: "email" | "person_name" | "phone" | "address" | "dob" | "tax_id_partial" | "account_id" | "user_handle" | "other_identifier";
+        context?: {
+            normalize: boolean;
+        } | undefined;
+    }[];
+}, {
+    items: {
+        value: string;
+        classification: "email" | "person_name" | "phone" | "address" | "dob" | "tax_id_partial" | "account_id" | "user_handle" | "other_identifier";
+        context?: {
+            normalize?: boolean | undefined;
+        } | undefined;
+    }[];
+}>;
+export type TokenizeBatchRequest = z.infer<typeof TokenizeBatchRequestSchema>;
+export declare const TokenizeBatchResponseSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        token: z.ZodString;
+        created: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        token: string;
+        created: boolean;
+    }, {
+        token: string;
+        created: boolean;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    results: {
+        token: string;
+        created: boolean;
+    }[];
+}, {
+    results: {
+        token: string;
+        created: boolean;
+    }[];
+}>;
+export type TokenizeBatchResponse = z.infer<typeof TokenizeBatchResponseSchema>;
+export declare const RequesterRoleEnum: z.ZodEnum<["compliance_officer", "internal_auditor", "external_auditor", "workspace_admin", "workspace_owner"]>;
+export declare const RequesterContextSchema: z.ZodObject<{
+    tenant_id: z.ZodString;
+    member_id: z.ZodString;
+    role: z.ZodEnum<["compliance_officer", "internal_auditor", "external_auditor", "workspace_admin", "workspace_owner"]>;
+    session_id: z.ZodString;
+    mfa_age_seconds: z.ZodNumber;
+    ip_address: z.ZodOptional<z.ZodString>;
+    user_agent: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    tenant_id: string;
+    member_id: string;
+    role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+    session_id: string;
+    mfa_age_seconds: number;
+    ip_address?: string | undefined;
+    user_agent?: string | undefined;
+}, {
+    tenant_id: string;
+    member_id: string;
+    role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+    session_id: string;
+    mfa_age_seconds: number;
+    ip_address?: string | undefined;
+    user_agent?: string | undefined;
+}>;
+export type RequesterContext = z.infer<typeof RequesterContextSchema>;
+export declare const ReasonCodeEnum: z.ZodEnum<["sample_review", "finding_investigation", "escalation_workflow", "rtbf_processing", "regulatory_inquiry", "other"]>;
+export declare const JustificationSchema: z.ZodObject<{
+    engagement_id: z.ZodString;
+    reason_code: z.ZodEnum<["sample_review", "finding_investigation", "escalation_workflow", "rtbf_processing", "regulatory_inquiry", "other"]>;
+    free_text: z.ZodString;
+    approver_member_id: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    engagement_id: string;
+    reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+    free_text: string;
+    approver_member_id?: string | undefined;
+}, {
+    engagement_id: string;
+    reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+    free_text: string;
+    approver_member_id?: string | undefined;
+}>;
+export type Justification = z.infer<typeof JustificationSchema>;
+export declare const ResolveRequestSchema: z.ZodObject<{
+    token: z.ZodString;
+    requester: z.ZodObject<{
+        tenant_id: z.ZodString;
+        member_id: z.ZodString;
+        role: z.ZodEnum<["compliance_officer", "internal_auditor", "external_auditor", "workspace_admin", "workspace_owner"]>;
+        session_id: z.ZodString;
+        mfa_age_seconds: z.ZodNumber;
+        ip_address: z.ZodOptional<z.ZodString>;
+        user_agent: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tenant_id: string;
+        member_id: string;
+        role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+        session_id: string;
+        mfa_age_seconds: number;
+        ip_address?: string | undefined;
+        user_agent?: string | undefined;
+    }, {
+        tenant_id: string;
+        member_id: string;
+        role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+        session_id: string;
+        mfa_age_seconds: number;
+        ip_address?: string | undefined;
+        user_agent?: string | undefined;
+    }>;
+    justification: z.ZodObject<{
+        engagement_id: z.ZodString;
+        reason_code: z.ZodEnum<["sample_review", "finding_investigation", "escalation_workflow", "rtbf_processing", "regulatory_inquiry", "other"]>;
+        free_text: z.ZodString;
+        approver_member_id: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        engagement_id: string;
+        reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+        free_text: string;
+        approver_member_id?: string | undefined;
+    }, {
+        engagement_id: string;
+        reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+        free_text: string;
+        approver_member_id?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    token: string;
+    requester: {
+        tenant_id: string;
+        member_id: string;
+        role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+        session_id: string;
+        mfa_age_seconds: number;
+        ip_address?: string | undefined;
+        user_agent?: string | undefined;
+    };
+    justification: {
+        engagement_id: string;
+        reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+        free_text: string;
+        approver_member_id?: string | undefined;
+    };
+}, {
+    token: string;
+    requester: {
+        tenant_id: string;
+        member_id: string;
+        role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+        session_id: string;
+        mfa_age_seconds: number;
+        ip_address?: string | undefined;
+        user_agent?: string | undefined;
+    };
+    justification: {
+        engagement_id: string;
+        reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+        free_text: string;
+        approver_member_id?: string | undefined;
+    };
+}>;
+export type ResolveRequest = z.infer<typeof ResolveRequestSchema>;
+export declare const ResolveResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    value: z.ZodString;
+    classification: z.ZodString;
+    created_at: z.ZodOptional<z.ZodString>;
+    audit_event_id: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    classification: string;
+    token: string;
+    audit_event_id: string;
+    created_at?: string | undefined;
+}, {
+    value: string;
+    classification: string;
+    token: string;
+    audit_event_id: string;
+    created_at?: string | undefined;
+}>;
+export type ResolveResponse = z.infer<typeof ResolveResponseSchema>;
+export declare const ResolveBatchRequestSchema: z.ZodObject<{
+    tokens: z.ZodArray<z.ZodString, "many">;
+    requester: z.ZodObject<{
+        tenant_id: z.ZodString;
+        member_id: z.ZodString;
+        role: z.ZodEnum<["compliance_officer", "internal_auditor", "external_auditor", "workspace_admin", "workspace_owner"]>;
+        session_id: z.ZodString;
+        mfa_age_seconds: z.ZodNumber;
+        ip_address: z.ZodOptional<z.ZodString>;
+        user_agent: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        tenant_id: string;
+        member_id: string;
+        role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+        session_id: string;
+        mfa_age_seconds: number;
+        ip_address?: string | undefined;
+        user_agent?: string | undefined;
+    }, {
+        tenant_id: string;
+        member_id: string;
+        role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+        session_id: string;
+        mfa_age_seconds: number;
+        ip_address?: string | undefined;
+        user_agent?: string | undefined;
+    }>;
+    justification: z.ZodObject<{
+        engagement_id: z.ZodString;
+        reason_code: z.ZodEnum<["sample_review", "finding_investigation", "escalation_workflow", "rtbf_processing", "regulatory_inquiry", "other"]>;
+        free_text: z.ZodString;
+        approver_member_id: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        engagement_id: string;
+        reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+        free_text: string;
+        approver_member_id?: string | undefined;
+    }, {
+        engagement_id: string;
+        reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+        free_text: string;
+        approver_member_id?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    requester: {
+        tenant_id: string;
+        member_id: string;
+        role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+        session_id: string;
+        mfa_age_seconds: number;
+        ip_address?: string | undefined;
+        user_agent?: string | undefined;
+    };
+    justification: {
+        engagement_id: string;
+        reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+        free_text: string;
+        approver_member_id?: string | undefined;
+    };
+    tokens: string[];
+}, {
+    requester: {
+        tenant_id: string;
+        member_id: string;
+        role: "compliance_officer" | "internal_auditor" | "external_auditor" | "workspace_admin" | "workspace_owner";
+        session_id: string;
+        mfa_age_seconds: number;
+        ip_address?: string | undefined;
+        user_agent?: string | undefined;
+    };
+    justification: {
+        engagement_id: string;
+        reason_code: "other" | "sample_review" | "finding_investigation" | "escalation_workflow" | "rtbf_processing" | "regulatory_inquiry";
+        free_text: string;
+        approver_member_id?: string | undefined;
+    };
+    tokens: string[];
+}>;
+export type ResolveBatchRequest = z.infer<typeof ResolveBatchRequestSchema>;
+export declare const ResolveBatchResultStatusEnum: z.ZodEnum<["resolved", "not_found", "tombstoned", "denied"]>;
+export declare const TombstoneReasonEnum: z.ZodEnum<["retention_expired", "rtbf_processed", "tenant_offboarded"]>;
+export declare const ResolveBatchResultSchema: z.ZodObject<{
+    token: z.ZodString;
+    status: z.ZodEnum<["resolved", "not_found", "tombstoned", "denied"]>;
+    value: z.ZodOptional<z.ZodString>;
+    tombstone_reason: z.ZodOptional<z.ZodEnum<["retention_expired", "rtbf_processed", "tenant_offboarded"]>>;
+    denial_reason: z.ZodOptional<z.ZodString>;
+    audit_event_id: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "denied" | "resolved" | "not_found" | "tombstoned";
+    token: string;
+    value?: string | undefined;
+    audit_event_id?: string | undefined;
+    tombstone_reason?: "retention_expired" | "rtbf_processed" | "tenant_offboarded" | undefined;
+    denial_reason?: string | undefined;
+}, {
+    status: "denied" | "resolved" | "not_found" | "tombstoned";
+    token: string;
+    value?: string | undefined;
+    audit_event_id?: string | undefined;
+    tombstone_reason?: "retention_expired" | "rtbf_processed" | "tenant_offboarded" | undefined;
+    denial_reason?: string | undefined;
+}>;
+export type ResolveBatchResult = z.infer<typeof ResolveBatchResultSchema>;
+export declare const ResolveBatchResponseSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        token: z.ZodString;
+        status: z.ZodEnum<["resolved", "not_found", "tombstoned", "denied"]>;
+        value: z.ZodOptional<z.ZodString>;
+        tombstone_reason: z.ZodOptional<z.ZodEnum<["retention_expired", "rtbf_processed", "tenant_offboarded"]>>;
+        denial_reason: z.ZodOptional<z.ZodString>;
+        audit_event_id: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        status: "denied" | "resolved" | "not_found" | "tombstoned";
+        token: string;
+        value?: string | undefined;
+        audit_event_id?: string | undefined;
+        tombstone_reason?: "retention_expired" | "rtbf_processed" | "tenant_offboarded" | undefined;
+        denial_reason?: string | undefined;
+    }, {
+        status: "denied" | "resolved" | "not_found" | "tombstoned";
+        token: string;
+        value?: string | undefined;
+        audit_event_id?: string | undefined;
+        tombstone_reason?: "retention_expired" | "rtbf_processed" | "tenant_offboarded" | undefined;
+        denial_reason?: string | undefined;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    results: {
+        status: "denied" | "resolved" | "not_found" | "tombstoned";
+        token: string;
+        value?: string | undefined;
+        audit_event_id?: string | undefined;
+        tombstone_reason?: "retention_expired" | "rtbf_processed" | "tenant_offboarded" | undefined;
+        denial_reason?: string | undefined;
+    }[];
+}, {
+    results: {
+        status: "denied" | "resolved" | "not_found" | "tombstoned";
+        token: string;
+        value?: string | undefined;
+        audit_event_id?: string | undefined;
+        tombstone_reason?: "retention_expired" | "rtbf_processed" | "tenant_offboarded" | undefined;
+        denial_reason?: string | undefined;
+    }[];
+}>;
+export type ResolveBatchResponse = z.infer<typeof ResolveBatchResponseSchema>;
+export declare const LifecycleActionEnum: z.ZodEnum<["tombstone_immediately", "tombstone_at", "place_on_legal_hold", "release_legal_hold"]>;
+export declare const LifecycleRequestSchema: z.ZodEffects<z.ZodObject<{
+    action: z.ZodEnum<["tombstone_immediately", "tombstone_at", "place_on_legal_hold", "release_legal_hold"]>;
+    scheduled_at: z.ZodOptional<z.ZodString>;
+    reason: z.ZodString;
+    approver_member_id: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    action: "tombstone_immediately" | "tombstone_at" | "place_on_legal_hold" | "release_legal_hold";
+    reason: string;
+    approver_member_id?: string | undefined;
+    scheduled_at?: string | undefined;
+}, {
+    action: "tombstone_immediately" | "tombstone_at" | "place_on_legal_hold" | "release_legal_hold";
+    reason: string;
+    approver_member_id?: string | undefined;
+    scheduled_at?: string | undefined;
+}>, {
+    action: "tombstone_immediately" | "tombstone_at" | "place_on_legal_hold" | "release_legal_hold";
+    reason: string;
+    approver_member_id?: string | undefined;
+    scheduled_at?: string | undefined;
+}, {
+    action: "tombstone_immediately" | "tombstone_at" | "place_on_legal_hold" | "release_legal_hold";
+    reason: string;
+    approver_member_id?: string | undefined;
+    scheduled_at?: string | undefined;
+}>;
+export type LifecycleRequest = z.infer<typeof LifecycleRequestSchema>;
+export declare const TokenStateEnum: z.ZodEnum<["active", "scheduled_for_tombstone", "tombstoned", "on_legal_hold"]>;
+export declare const LifecycleResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    new_state: z.ZodEnum<["active", "scheduled_for_tombstone", "tombstoned", "on_legal_hold"]>;
+    scheduled_at: z.ZodOptional<z.ZodString>;
+    audit_event_id: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    token: string;
+    audit_event_id: string;
+    new_state: "tombstoned" | "active" | "scheduled_for_tombstone" | "on_legal_hold";
+    scheduled_at?: string | undefined;
+}, {
+    token: string;
+    audit_event_id: string;
+    new_state: "tombstoned" | "active" | "scheduled_for_tombstone" | "on_legal_hold";
+    scheduled_at?: string | undefined;
+}>;
+export type LifecycleResponse = z.infer<typeof LifecycleResponseSchema>;
+export declare const VaultErrorCodeEnum: z.ZodEnum<["unauthorized", "forbidden", "classification_not_vaultable", "invalid_value", "invalid_classification", "rate_limited", "mfa_too_old", "engagement_not_active", "engagement_scope_violation", "approval_required", "approval_invalid", "token_not_found", "token_tombstoned", "lifecycle_conflict", "internal_error"]>;
+export declare const VaultErrorSchema: z.ZodObject<{
+    error_code: z.ZodEnum<["unauthorized", "forbidden", "classification_not_vaultable", "invalid_value", "invalid_classification", "rate_limited", "mfa_too_old", "engagement_not_active", "engagement_scope_violation", "approval_required", "approval_invalid", "token_not_found", "token_tombstoned", "lifecycle_conflict", "internal_error"]>;
+    error_message: z.ZodString;
+    request_id: z.ZodOptional<z.ZodString>;
+    retry_after_seconds: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    error_code: "unauthorized" | "forbidden" | "rate_limited" | "internal_error" | "classification_not_vaultable" | "invalid_value" | "invalid_classification" | "mfa_too_old" | "engagement_not_active" | "engagement_scope_violation" | "approval_required" | "approval_invalid" | "token_not_found" | "token_tombstoned" | "lifecycle_conflict";
+    error_message: string;
+    retry_after_seconds?: number | undefined;
+    request_id?: string | undefined;
+}, {
+    error_code: "unauthorized" | "forbidden" | "rate_limited" | "internal_error" | "classification_not_vaultable" | "invalid_value" | "invalid_classification" | "mfa_too_old" | "engagement_not_active" | "engagement_scope_violation" | "approval_required" | "approval_invalid" | "token_not_found" | "token_tombstoned" | "lifecycle_conflict";
+    error_message: string;
+    retry_after_seconds?: number | undefined;
+    request_id?: string | undefined;
+}>;
+export type VaultError = z.infer<typeof VaultErrorSchema>;
+//# sourceMappingURL=vault.d.ts.map

package/dist/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,kBAAkB,mIAU7B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;EAWvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB;;;;;;;;;EAKxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;EAI7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB,iHAM5B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;EAUxB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,cAAc,gIAOzB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAOrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAQvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B,8DAKvC,CAAC;AACH,eAAO,MAAM,mBAAmB,yEAI9B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;EAS1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,mBAAmB,mGAK9B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;EAgB/B,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,cAAc,iFAKzB,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAOzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,kBAAkB,mUAgB7B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;EAOlB,CAAC;AACZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/vault.js

@@ -0,0 +1,188 @@
+import { z } from 'zod';
+const ulid = z.string().regex(/^[0-9A-HJKMNP-TV-Z]{26}$/);
+const vaultToken = z.string().regex(/^tok_[A-Za-z0-9]{24}$/);
+export const ClassificationEnum = z.enum([
+    'person_name',
+    'email',
+    'phone',
+    'address',
+    'dob',
+    'tax_id_partial',
+    'account_id',
+    'user_handle',
+    'other_identifier',
+]);
+export const TokenizeRequestSchema = z
+    .object({
+    value: z.string().min(1).max(4096),
+    classification: ClassificationEnum,
+    context: z
+        .object({
+        normalize: z.boolean().default(true),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+export const TokenizeResponseSchema = z
+    .object({
+    token: vaultToken,
+    created: z.boolean(),
+})
+    .strict();
+export const TokenizeBatchRequestSchema = z
+    .object({
+    items: z.array(TokenizeRequestSchema).min(1).max(100),
+})
+    .strict();
+export const TokenizeBatchResponseSchema = z
+    .object({
+    results: z.array(TokenizeResponseSchema),
+})
+    .strict();
+export const RequesterRoleEnum = z.enum([
+    'compliance_officer',
+    'internal_auditor',
+    'external_auditor',
+    'workspace_admin',
+    'workspace_owner',
+]);
+export const RequesterContextSchema = z
+    .object({
+    tenant_id: z.string().regex(/^tnt_[0-9a-z]{12}$/),
+    member_id: z.string(),
+    role: RequesterRoleEnum,
+    session_id: z.string(),
+    mfa_age_seconds: z.number().int().nonnegative(),
+    ip_address: z.string().optional(),
+    user_agent: z.string().max(512).optional(),
+})
+    .strict();
+export const ReasonCodeEnum = z.enum([
+    'sample_review',
+    'finding_investigation',
+    'escalation_workflow',
+    'rtbf_processing',
+    'regulatory_inquiry',
+    'other',
+]);
+export const JustificationSchema = z
+    .object({
+    engagement_id: z.string().regex(/^eng_[0-9A-HJKMNP-TV-Z]{26}$/),
+    reason_code: ReasonCodeEnum,
+    free_text: z.string().min(8).max(1024),
+    approver_member_id: z.string().optional(),
+})
+    .strict();
+export const ResolveRequestSchema = z
+    .object({
+    token: vaultToken,
+    requester: RequesterContextSchema,
+    justification: JustificationSchema,
+})
+    .strict();
+export const ResolveResponseSchema = z
+    .object({
+    token: vaultToken,
+    value: z.string(),
+    classification: z.string(),
+    created_at: z.string().datetime().optional(),
+    audit_event_id: ulid,
+})
+    .strict();
+export const ResolveBatchRequestSchema = z
+    .object({
+    tokens: z.array(vaultToken).min(1).max(100),
+    requester: RequesterContextSchema,
+    justification: JustificationSchema,
+})
+    .strict();
+export const ResolveBatchResultStatusEnum = z.enum([
+    'resolved',
+    'not_found',
+    'tombstoned',
+    'denied',
+]);
+export const TombstoneReasonEnum = z.enum([
+    'retention_expired',
+    'rtbf_processed',
+    'tenant_offboarded',
+]);
+export const ResolveBatchResultSchema = z
+    .object({
+    token: vaultToken,
+    status: ResolveBatchResultStatusEnum,
+    value: z.string().optional(),
+    tombstone_reason: TombstoneReasonEnum.optional(),
+    denial_reason: z.string().optional(),
+    audit_event_id: ulid.optional(),
+})
+    .strict();
+export const ResolveBatchResponseSchema = z
+    .object({
+    results: z.array(ResolveBatchResultSchema),
+})
+    .strict();
+export const LifecycleActionEnum = z.enum([
+    'tombstone_immediately',
+    'tombstone_at',
+    'place_on_legal_hold',
+    'release_legal_hold',
+]);
+export const LifecycleRequestSchema = z
+    .object({
+    action: LifecycleActionEnum,
+    scheduled_at: z.string().datetime().optional(),
+    reason: z.string().min(8).max(1024),
+    approver_member_id: z.string().optional(),
+})
+    .strict()
+    .superRefine((data, ctx) => {
+    if (data.action === 'tombstone_at' && !data.scheduled_at) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'scheduled_at is required when action=tombstone_at',
+            path: ['scheduled_at'],
+        });
+    }
+});
+export const TokenStateEnum = z.enum([
+    'active',
+    'scheduled_for_tombstone',
+    'tombstoned',
+    'on_legal_hold',
+]);
+export const LifecycleResponseSchema = z
+    .object({
+    token: vaultToken,
+    new_state: TokenStateEnum,
+    scheduled_at: z.string().datetime().optional(),
+    audit_event_id: ulid,
+})
+    .strict();
+export const VaultErrorCodeEnum = z.enum([
+    'unauthorized',
+    'forbidden',
+    'classification_not_vaultable',
+    'invalid_value',
+    'invalid_classification',
+    'rate_limited',
+    'mfa_too_old',
+    'engagement_not_active',
+    'engagement_scope_violation',
+    'approval_required',
+    'approval_invalid',
+    'token_not_found',
+    'token_tombstoned',
+    'lifecycle_conflict',
+    'internal_error',
+]);
+export const VaultErrorSchema = z
+    .object({
+    error_code: VaultErrorCodeEnum,
+    error_message: z.string().max(1024),
+    request_id: z.string().optional(),
+    retry_after_seconds: z.number().int().nonnegative().optional(),
+})
+    .strict();
+//# sourceMappingURL=vault.js.map

package/dist/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAC1D,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,aAAa;IACb,OAAO;IACP,OAAO;IACP,SAAS;IACT,KAAK;IACL,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,kBAAkB;CACnB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAClC,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACrC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,KAAK,EAAE,UAAU;IACjB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACtD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,oBAAoB;IACpB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,iBAAiB;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,eAAe;IACf,uBAAuB;IACvB,qBAAqB;IACrB,iBAAiB;IACjB,oBAAoB;IACpB,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC;IAC/D,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACtC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,KAAK,EAAE,UAAU;IACjB,SAAS,EAAE,sBAAsB;IACjC,aAAa,EAAE,mBAAmB;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,SAAS,EAAE,sBAAsB;IACjC,aAAa,EAAE,mBAAmB;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,UAAU;IACV,WAAW;IACX,YAAY;IACZ,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACxC,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,4BAA4B;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACxC,uBAAuB;IACvB,cAAc;IACd,qBAAqB;IACrB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,mBAAmB;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,cAAc,CAAC;SACvB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,QAAQ;IACR,yBAAyB;IACzB,YAAY;IACZ,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,KAAK,EAAE,UAAU;IACjB,SAAS,EAAE,cAAc;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,cAAc,EAAE,IAAI;CACrB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,cAAc;IACd,WAAW;IACX,8BAA8B;IAC9B,eAAe;IACf,wBAAwB;IACxB,cAAc;IACd,aAAa;IACb,uBAAuB;IACvB,4BAA4B;IAC5B,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,UAAU,EAAE,kBAAkB;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC/D,CAAC;KACD,MAAM,EAAE,CAAC"}