@spacefast/common 0.0.11 → 0.0.13

package/dist/contracts/grants.d.ts

@@ -0,0 +1,1158 @@
+import { z } from "zod";
+export declare const GRANT_CAPABILITIES: readonly ["page.view", "comments.read", "comments.write", "content.publish", "access.manage"];
+export declare const grantCapabilitySchema: z.ZodEnum<{
+    "page.view": "page.view";
+    "comments.read": "comments.read";
+    "comments.write": "comments.write";
+    "content.publish": "content.publish";
+    "access.manage": "access.manage";
+}>;
+export type GrantCapability = z.infer<typeof grantCapabilitySchema>;
+export declare const GRANT_CAPABILITY_PRESETS: readonly ["view", "comment", "publish", "manage"];
+export type GrantCapabilityPreset = (typeof GRANT_CAPABILITY_PRESETS)[number];
+export declare const GRANT_PRESET_CAPABILITIES: Record<GrantCapabilityPreset, GrantCapability[]>;
+export declare const GRANT_AUDIENCE_KINDS: readonly ["public", "team", "person", "link", "password", "machine", "external"];
+export declare const grantAudienceKindSchema: z.ZodEnum<{
+    link: "link";
+    team: "team";
+    external: "external";
+    public: "public";
+    person: "person";
+    password: "password";
+    machine: "machine";
+}>;
+export type GrantAudienceKind = z.infer<typeof grantAudienceKindSchema>;
+export declare const grantAudienceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"public">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"team">;
+    teamId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"person">;
+    personId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"link">;
+    linkId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"password">;
+    credentialId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"machine">;
+    machineId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"external">;
+    issuer: z.ZodString;
+    subject: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type GrantAudience = z.infer<typeof grantAudienceSchema>;
+/**
+ * Canonical resource-pattern syntax shared by config compilation and evaluation.
+ * `*` matches one path segment and `**` matches zero or more segments. Wildcards
+ * are whole segments so a pattern can never disguise an encoded separator.
+ *
+ * Unlike URL-route canonicalization, resource patterns retain a terminal
+ * `index.html`: Grants can constrain the visitor-facing route and the artifact
+ * it resolves to independently.
+ */
+export declare function normalizeGrantResourcePattern(input: string): string;
+export declare const grantResourcePatternSchema: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+export type GrantResourcePattern = z.infer<typeof grantResourcePatternSchema>;
+export declare const GRANT_RESOURCE_PATTERN_LIMIT = 100;
+export declare const grantResourceSetSchema: z.ZodObject<{
+    include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+}, z.core.$strict>;
+export type GrantResourceSet = z.infer<typeof grantResourceSetSchema>;
+export declare const GRANT_TARGET_KINDS: readonly ["live", "version", "branch", "all_versions"];
+export declare const grantTargetKindSchema: z.ZodEnum<{
+    live: "live";
+    version: "version";
+    branch: "branch";
+    all_versions: "all_versions";
+}>;
+export type GrantTargetKind = z.infer<typeof grantTargetKindSchema>;
+export declare const grantTargetSelectorSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"live">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"version">;
+    versionId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"branch">;
+    branch: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"all_versions">;
+}, z.core.$strict>], "kind">;
+export type GrantTargetSelector = z.infer<typeof grantTargetSelectorSchema>;
+export declare function normalizeGrantNetworkCidr(input: string): string;
+export declare function grantNetworkCidrMatches(cidr: string, ipAddress: string): boolean;
+export declare const grantConstraintsSchema: z.ZodObject<{
+    notBefore: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    maxUses: z.ZodOptional<z.ZodNumber>;
+    requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+    network: z.ZodOptional<z.ZodObject<{
+        ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+        countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+        excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+        excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type GrantConstraints = z.infer<typeof grantConstraintsSchema>;
+export declare const GRANT_SOURCE_KINDS: readonly ["config", "managed", "system"];
+export declare const grantSourceKindSchema: z.ZodEnum<{
+    config: "config";
+    system: "system";
+    managed: "managed";
+}>;
+export type GrantSourceKind = z.infer<typeof grantSourceKindSchema>;
+export declare const PRECLAIM_OPEN_GRANT_SOURCE_REFERENCE = "open:preclaim-author";
+export declare const OWNING_TEAM_MANAGEMENT_GRANT_SOURCE_REFERENCE = "ownership:team";
+export declare const OWNING_TEAM_VERSION_GRANT_SOURCE_REFERENCE = "ownership:team:versions";
+export declare const OWNING_EXTERNAL_MANAGEMENT_GRANT_SOURCE_REFERENCE = "ownership:external";
+export declare const OWNING_EXTERNAL_VERSION_GRANT_SOURCE_REFERENCE = "ownership:external:versions";
+export declare const CONFIG_PUBLIC_GRANT_SOURCE_REFERENCE = "sf.jsonc#$.access.public";
+export declare const grantSourceSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        config: "config";
+        system: "system";
+        managed: "managed";
+    }>;
+    reference: z.ZodString;
+}, z.core.$strict>;
+export type GrantSource = z.infer<typeof grantSourceSchema>;
+export declare const grantSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"public">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"team">;
+        teamId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"person">;
+        personId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"link">;
+        linkId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"password">;
+        credentialId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"machine">;
+        machineId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"external">;
+        issuer: z.ZodString;
+        subject: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+        "content.publish": "content.publish";
+        "access.manage": "access.manage";
+    }>>;
+    constraints: z.ZodDefault<z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+    id: z.ZodString;
+    source: z.ZodObject<{
+        kind: z.ZodEnum<{
+            config: "config";
+            system: "system";
+            managed: "managed";
+        }>;
+        reference: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type Grant = z.infer<typeof grantSchema>;
+export declare const managedGrantWriteSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"public">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"team">;
+        teamId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"person">;
+        personId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"link">;
+        linkId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"password">;
+        credentialId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"machine">;
+        machineId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"external">;
+        issuer: z.ZodString;
+        subject: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+        "content.publish": "content.publish";
+        "access.manage": "access.manage";
+    }>>;
+    constraints: z.ZodDefault<z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export type ManagedGrantWrite = z.infer<typeof managedGrantWriteSchema>;
+export declare const directManagedGrantWriteSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"public">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"team">;
+        teamId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"person">;
+        personId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"link">;
+        linkId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"password">;
+        credentialId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"machine">;
+        machineId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"external">;
+        issuer: z.ZodString;
+        subject: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+        "content.publish": "content.publish";
+        "access.manage": "access.manage";
+    }>>;
+    constraints: z.ZodDefault<z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export type DirectManagedGrantWrite = z.infer<typeof directManagedGrantWriteSchema>;
+export declare const grantSourceExplanationSchema: z.ZodObject<{
+    editable: z.ZodBoolean;
+    label: z.ZodString;
+    detail: z.ZodString;
+}, z.core.$strict>;
+export type GrantSourceExplanation = z.infer<typeof grantSourceExplanationSchema>;
+export declare const spaceGrantSchema: z.ZodObject<{
+    grant: z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"public">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"team">;
+            teamId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"person">;
+            personId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"link">;
+            linkId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"password">;
+            credentialId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"machine">;
+            machineId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"external">;
+            issuer: z.ZodString;
+            subject: z.ZodString;
+        }, z.core.$strict>], "kind">;
+        resources: z.ZodObject<{
+            include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodEnum<{
+            "page.view": "page.view";
+            "comments.read": "comments.read";
+            "comments.write": "comments.write";
+            "content.publish": "content.publish";
+            "access.manage": "access.manage";
+        }>>;
+        constraints: z.ZodDefault<z.ZodObject<{
+            notBefore: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodOptional<z.ZodString>;
+            maxUses: z.ZodOptional<z.ZodNumber>;
+            requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+            network: z.ZodOptional<z.ZodObject<{
+                ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"live">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"version">;
+            versionId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"branch">;
+            branch: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"all_versions">;
+        }, z.core.$strict>], "kind">;
+        source: z.ZodObject<{
+            kind: z.ZodEnum<{
+                config: "config";
+                system: "system";
+                managed: "managed";
+            }>;
+            reference: z.ZodString;
+        }, z.core.$strict>;
+        id: z.ZodCustom<`grt_${string}`, `grt_${string}`>;
+    }, z.core.$strict>;
+    generation: z.ZodNumber;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        scheduled: "scheduled";
+    }>;
+    sourceExplanation: z.ZodObject<{
+        editable: z.ZodBoolean;
+        label: z.ZodString;
+        detail: z.ZodString;
+    }, z.core.$strict>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export type SpaceGrant = z.infer<typeof spaceGrantSchema>;
+export declare const grantCheckQuerySchema: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+    target: z.ZodDefault<z.ZodEnum<{
+        live: "live";
+        version: "version";
+        branch: "branch";
+    }>>;
+    targetId: z.ZodOptional<z.ZodString>;
+    audience: z.ZodDefault<z.ZodEnum<{
+        link: "link";
+        team: "team";
+        external: "external";
+        public: "public";
+        person: "person";
+        password: "password";
+        machine: "machine";
+    }>>;
+    personId: z.ZodOptional<z.ZodString>;
+    linkId: z.ZodOptional<z.ZodString>;
+    passwordCredentialId: z.ZodOptional<z.ZodString>;
+    machineId: z.ZodOptional<z.ZodString>;
+    issuer: z.ZodOptional<z.ZodString>;
+    subject: z.ZodOptional<z.ZodString>;
+    verifiedEmail: z.ZodOptional<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type GrantCheckQuery = z.infer<typeof grantCheckQuerySchema>;
+export declare const GRANT_CHECK_FAILURES: readonly ["space_unclaimed_config", "audience", "target", "invalid_time", "not_before", "expired", "max_uses", "verified_email", "network", "resource_not_included", "resource_excluded"];
+export declare const grantCheckFailureSchema: z.ZodEnum<{
+    network: "network";
+    target: "target";
+    expired: "expired";
+    audience: "audience";
+    space_unclaimed_config: "space_unclaimed_config";
+    invalid_time: "invalid_time";
+    not_before: "not_before";
+    max_uses: "max_uses";
+    verified_email: "verified_email";
+    resource_not_included: "resource_not_included";
+    resource_excluded: "resource_excluded";
+}>;
+export type GrantCheckFailure = z.infer<typeof grantCheckFailureSchema>;
+export declare const grantCheckSchema: z.ZodObject<{
+    path: z.ZodString;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    simulatedAudience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"public">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"team">;
+        teamId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"person">;
+        personId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"link">;
+        linkId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"password">;
+        credentialId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"machine">;
+        machineId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"external">;
+        issuer: z.ZodString;
+        subject: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+        "content.publish": "content.publish";
+        "access.manage": "access.manage";
+    }>>;
+    matchingGrants: z.ZodArray<z.ZodObject<{
+        grant: z.ZodObject<{
+            grant: z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"public">;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"team">;
+                    teamId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"person">;
+                    personId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"link">;
+                    linkId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"password">;
+                    credentialId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"machine">;
+                    machineId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"external">;
+                    issuer: z.ZodString;
+                    subject: z.ZodString;
+                }, z.core.$strict>], "kind">;
+                resources: z.ZodObject<{
+                    include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+                    exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                }, z.core.$strict>;
+                capabilities: z.ZodArray<z.ZodEnum<{
+                    "page.view": "page.view";
+                    "comments.read": "comments.read";
+                    "comments.write": "comments.write";
+                    "content.publish": "content.publish";
+                    "access.manage": "access.manage";
+                }>>;
+                constraints: z.ZodDefault<z.ZodObject<{
+                    notBefore: z.ZodOptional<z.ZodString>;
+                    expiresAt: z.ZodOptional<z.ZodString>;
+                    maxUses: z.ZodOptional<z.ZodNumber>;
+                    requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+                    network: z.ZodOptional<z.ZodObject<{
+                        ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+                target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"live">;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"version">;
+                    versionId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"branch">;
+                    branch: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"all_versions">;
+                }, z.core.$strict>], "kind">;
+                source: z.ZodObject<{
+                    kind: z.ZodEnum<{
+                        config: "config";
+                        system: "system";
+                        managed: "managed";
+                    }>;
+                    reference: z.ZodString;
+                }, z.core.$strict>;
+                id: z.ZodCustom<`grt_${string}`, `grt_${string}`>;
+            }, z.core.$strict>;
+            generation: z.ZodNumber;
+            status: z.ZodEnum<{
+                active: "active";
+                expired: "expired";
+                scheduled: "scheduled";
+            }>;
+            sourceExplanation: z.ZodObject<{
+                editable: z.ZodBoolean;
+                label: z.ZodString;
+                detail: z.ZodString;
+            }, z.core.$strict>;
+            createdAt: z.ZodString;
+            updatedAt: z.ZodString;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodEnum<{
+            "page.view": "page.view";
+            "comments.read": "comments.read";
+            "comments.write": "comments.write";
+            "content.publish": "content.publish";
+            "access.manage": "access.manage";
+        }>>;
+    }, z.core.$strict>>;
+    evaluatedGrants: z.ZodArray<z.ZodObject<{
+        grant: z.ZodObject<{
+            grant: z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"public">;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"team">;
+                    teamId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"person">;
+                    personId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"link">;
+                    linkId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"password">;
+                    credentialId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"machine">;
+                    machineId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"external">;
+                    issuer: z.ZodString;
+                    subject: z.ZodString;
+                }, z.core.$strict>], "kind">;
+                resources: z.ZodObject<{
+                    include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+                    exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                }, z.core.$strict>;
+                capabilities: z.ZodArray<z.ZodEnum<{
+                    "page.view": "page.view";
+                    "comments.read": "comments.read";
+                    "comments.write": "comments.write";
+                    "content.publish": "content.publish";
+                    "access.manage": "access.manage";
+                }>>;
+                constraints: z.ZodDefault<z.ZodObject<{
+                    notBefore: z.ZodOptional<z.ZodString>;
+                    expiresAt: z.ZodOptional<z.ZodString>;
+                    maxUses: z.ZodOptional<z.ZodNumber>;
+                    requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+                    network: z.ZodOptional<z.ZodObject<{
+                        ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+                target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"live">;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"version">;
+                    versionId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"branch">;
+                    branch: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"all_versions">;
+                }, z.core.$strict>], "kind">;
+                source: z.ZodObject<{
+                    kind: z.ZodEnum<{
+                        config: "config";
+                        system: "system";
+                        managed: "managed";
+                    }>;
+                    reference: z.ZodString;
+                }, z.core.$strict>;
+                id: z.ZodCustom<`grt_${string}`, `grt_${string}`>;
+            }, z.core.$strict>;
+            generation: z.ZodNumber;
+            status: z.ZodEnum<{
+                active: "active";
+                expired: "expired";
+                scheduled: "scheduled";
+            }>;
+            sourceExplanation: z.ZodObject<{
+                editable: z.ZodBoolean;
+                label: z.ZodString;
+                detail: z.ZodString;
+            }, z.core.$strict>;
+            createdAt: z.ZodString;
+            updatedAt: z.ZodString;
+        }, z.core.$strict>;
+        failures: z.ZodArray<z.ZodEnum<{
+            network: "network";
+            target: "target";
+            expired: "expired";
+            audience: "audience";
+            space_unclaimed_config: "space_unclaimed_config";
+            invalid_time: "invalid_time";
+            not_before: "not_before";
+            max_uses: "max_uses";
+            verified_email: "verified_email";
+            resource_not_included: "resource_not_included";
+            resource_excluded: "resource_excluded";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type GrantCheck = z.infer<typeof grantCheckSchema>;
+export declare const passwordCredentialCreateSchema: z.ZodObject<{
+    password: z.ZodString;
+    name: z.ZodString;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+        "content.publish": "content.publish";
+        "access.manage": "access.manage";
+    }>>;
+    constraints: z.ZodDefault<z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export type PasswordCredentialCreate = z.infer<typeof passwordCredentialCreateSchema>;
+export declare const passwordCredentialRotateSchema: z.ZodObject<{
+    password: z.ZodString;
+}, z.core.$strict>;
+export type PasswordCredentialRotate = z.infer<typeof passwordCredentialRotateSchema>;
+export declare const machineCredentialCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+        "content.publish": "content.publish";
+        "access.manage": "access.manage";
+    }>>;
+    constraints: z.ZodDefault<z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export type MachineCredentialCreate = z.infer<typeof machineCredentialCreateSchema>;
+export declare const passwordCredentialSchema: z.ZodObject<{
+    id: z.ZodCustom<`pwd_${string}`, `pwd_${string}`>;
+    grant: z.ZodObject<{
+        grant: z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"public">;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"team">;
+                teamId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"person">;
+                personId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"link">;
+                linkId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"password">;
+                credentialId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"machine">;
+                machineId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"external">;
+                issuer: z.ZodString;
+                subject: z.ZodString;
+            }, z.core.$strict>], "kind">;
+            resources: z.ZodObject<{
+                include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+                exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            }, z.core.$strict>;
+            capabilities: z.ZodArray<z.ZodEnum<{
+                "page.view": "page.view";
+                "comments.read": "comments.read";
+                "comments.write": "comments.write";
+                "content.publish": "content.publish";
+                "access.manage": "access.manage";
+            }>>;
+            constraints: z.ZodDefault<z.ZodObject<{
+                notBefore: z.ZodOptional<z.ZodString>;
+                expiresAt: z.ZodOptional<z.ZodString>;
+                maxUses: z.ZodOptional<z.ZodNumber>;
+                requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+                network: z.ZodOptional<z.ZodObject<{
+                    ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                    countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                    excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                    excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"live">;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"version">;
+                versionId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"branch">;
+                branch: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"all_versions">;
+            }, z.core.$strict>], "kind">;
+            source: z.ZodObject<{
+                kind: z.ZodEnum<{
+                    config: "config";
+                    system: "system";
+                    managed: "managed";
+                }>;
+                reference: z.ZodString;
+            }, z.core.$strict>;
+            id: z.ZodCustom<`grt_${string}`, `grt_${string}`>;
+        }, z.core.$strict>;
+        generation: z.ZodNumber;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            scheduled: "scheduled";
+        }>;
+        sourceExplanation: z.ZodObject<{
+            editable: z.ZodBoolean;
+            label: z.ZodString;
+            detail: z.ZodString;
+        }, z.core.$strict>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>;
+    rotatedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type PasswordCredential = z.infer<typeof passwordCredentialSchema>;
+export declare const machineCredentialSchema: z.ZodObject<{
+    id: z.ZodCustom<`mch_${string}`, `mch_${string}`>;
+    grant: z.ZodObject<{
+        grant: z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"public">;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"team">;
+                teamId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"person">;
+                personId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"link">;
+                linkId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"password">;
+                credentialId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"machine">;
+                machineId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"external">;
+                issuer: z.ZodString;
+                subject: z.ZodString;
+            }, z.core.$strict>], "kind">;
+            resources: z.ZodObject<{
+                include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+                exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            }, z.core.$strict>;
+            capabilities: z.ZodArray<z.ZodEnum<{
+                "page.view": "page.view";
+                "comments.read": "comments.read";
+                "comments.write": "comments.write";
+                "content.publish": "content.publish";
+                "access.manage": "access.manage";
+            }>>;
+            constraints: z.ZodDefault<z.ZodObject<{
+                notBefore: z.ZodOptional<z.ZodString>;
+                expiresAt: z.ZodOptional<z.ZodString>;
+                maxUses: z.ZodOptional<z.ZodNumber>;
+                requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+                network: z.ZodOptional<z.ZodObject<{
+                    ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                    countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                    excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                    excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"live">;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"version">;
+                versionId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"branch">;
+                branch: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"all_versions">;
+            }, z.core.$strict>], "kind">;
+            source: z.ZodObject<{
+                kind: z.ZodEnum<{
+                    config: "config";
+                    system: "system";
+                    managed: "managed";
+                }>;
+                reference: z.ZodString;
+            }, z.core.$strict>;
+            id: z.ZodCustom<`grt_${string}`, `grt_${string}`>;
+        }, z.core.$strict>;
+        generation: z.ZodNumber;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            scheduled: "scheduled";
+        }>;
+        sourceExplanation: z.ZodObject<{
+            editable: z.ZodBoolean;
+            label: z.ZodString;
+            detail: z.ZodString;
+        }, z.core.$strict>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>;
+    tokenHint: z.ZodString;
+    rotatedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type MachineCredential = z.infer<typeof machineCredentialSchema>;
+export declare const machineCredentialSecretSchema: z.ZodObject<{
+    credential: z.ZodObject<{
+        id: z.ZodCustom<`mch_${string}`, `mch_${string}`>;
+        grant: z.ZodObject<{
+            grant: z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                audience: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"public">;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"team">;
+                    teamId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"person">;
+                    personId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"link">;
+                    linkId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"password">;
+                    credentialId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"machine">;
+                    machineId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"external">;
+                    issuer: z.ZodString;
+                    subject: z.ZodString;
+                }, z.core.$strict>], "kind">;
+                resources: z.ZodObject<{
+                    include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+                    exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                }, z.core.$strict>;
+                capabilities: z.ZodArray<z.ZodEnum<{
+                    "page.view": "page.view";
+                    "comments.read": "comments.read";
+                    "comments.write": "comments.write";
+                    "content.publish": "content.publish";
+                    "access.manage": "access.manage";
+                }>>;
+                constraints: z.ZodDefault<z.ZodObject<{
+                    notBefore: z.ZodOptional<z.ZodString>;
+                    expiresAt: z.ZodOptional<z.ZodString>;
+                    maxUses: z.ZodOptional<z.ZodNumber>;
+                    requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+                    network: z.ZodOptional<z.ZodObject<{
+                        ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+                        excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+                target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"live">;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"version">;
+                    versionId: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"branch">;
+                    branch: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"all_versions">;
+                }, z.core.$strict>], "kind">;
+                source: z.ZodObject<{
+                    kind: z.ZodEnum<{
+                        config: "config";
+                        system: "system";
+                        managed: "managed";
+                    }>;
+                    reference: z.ZodString;
+                }, z.core.$strict>;
+                id: z.ZodCustom<`grt_${string}`, `grt_${string}`>;
+            }, z.core.$strict>;
+            generation: z.ZodNumber;
+            status: z.ZodEnum<{
+                active: "active";
+                expired: "expired";
+                scheduled: "scheduled";
+            }>;
+            sourceExplanation: z.ZodObject<{
+                editable: z.ZodBoolean;
+                label: z.ZodString;
+                detail: z.ZodString;
+            }, z.core.$strict>;
+            createdAt: z.ZodString;
+            updatedAt: z.ZodString;
+        }, z.core.$strict>;
+        tokenHint: z.ZodString;
+        rotatedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    token: z.ZodString;
+}, z.core.$strict>;
+export type MachineCredentialSecret = z.infer<typeof machineCredentialSecretSchema>;
+export declare const machineCredentialExchangeRequestSchema: z.ZodObject<{
+    spaceId: z.ZodCustom<`spc_${string}`, `spc_${string}`>;
+    host: z.ZodString;
+    resource: z.ZodString;
+    target: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>;
+export type MachineCredentialExchangeRequest = z.infer<typeof machineCredentialExchangeRequestSchema>;
+export declare const machineCredentialExchangeResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+export declare const credentialRevocationSchema: z.ZodObject<{
+    grantId: z.ZodCustom<`grt_${string}`, `grt_${string}`>;
+    revoked: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare const IDENTITY_CONNECTION_DEFAULT_TTL_SECONDS: number;
+export declare const EXTERNAL_IDENTITY_MAX_TTL_SECONDS: number;
+export declare const identityConnectionPublicKeySchema: z.ZodObject<{
+    kid: z.ZodString;
+    publicKey: z.ZodString;
+}, z.core.$strict>;
+export type IdentityConnectionPublicKey = z.infer<typeof identityConnectionPublicKeySchema>;
+export declare const identityConnectionCreateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"oidc">;
+    name: z.ZodString;
+    issuer: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"signer">;
+    name: z.ZodString;
+    issuer: z.ZodString;
+    authorizeUrl: z.ZodString;
+    publicKeys: z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        publicKey: z.ZodString;
+    }, z.core.$strict>>;
+    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>], "type">;
+export type IdentityConnectionCreate = z.infer<typeof identityConnectionCreateSchema>;
+export declare const identityConnectionUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    authorizeUrl: z.ZodOptional<z.ZodString>;
+    publicKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        publicKey: z.ZodString;
+    }, z.core.$strict>>>;
+    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type IdentityConnectionUpdate = z.infer<typeof identityConnectionUpdateSchema>;
+export declare const identityConnectionSchema: z.ZodObject<{
+    id: z.ZodCustom<`acn_${string}`, `acn_${string}`>;
+    teamId: z.ZodString;
+    type: z.ZodEnum<{
+        oidc: "oidc";
+        signer: "signer";
+    }>;
+    name: z.ZodString;
+    issuer: z.ZodString;
+    clientId: z.ZodNullable<z.ZodString>;
+    clientSecretSet: z.ZodBoolean;
+    authorizeUrl: z.ZodNullable<z.ZodString>;
+    publicKeys: z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        publicKey: z.ZodString;
+    }, z.core.$strict>>;
+    sessionTtlSeconds: z.ZodNumber;
+    createdAt: z.ZodString;
+    rotatedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type IdentityConnection = z.infer<typeof identityConnectionSchema>;
+export declare const externalGrantCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+        "content.publish": "content.publish";
+        "access.manage": "access.manage";
+    }>>;
+    constraints: z.ZodDefault<z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+    connectionId: z.ZodCustom<`acn_${string}`, `acn_${string}`>;
+    subject: z.ZodString;
+}, z.core.$strict>;
+export type ExternalGrantCreate = z.infer<typeof externalGrantCreateSchema>;