@spacefast/common 0.0.12 → 0.0.17

package/dist/contracts/grants.js

@@ -0,0 +1,783 @@
+import { z } from "zod";
+import { ISO_COUNTRY_CODES } from "./countries.js";
+import { registeredIdSchema } from "./ids.js";
+export const GRANT_CAPABILITIES = [
+    "page.view",
+    "comments.read",
+    "comments.write",
+    "content.publish",
+    "access.manage",
+];
+export const grantCapabilitySchema = z.enum(GRANT_CAPABILITIES);
+export const GRANT_CAPABILITY_PRESETS = ["view", "comment", "publish", "manage"];
+export const GRANT_PRESET_CAPABILITIES = {
+    view: ["page.view"],
+    comment: ["page.view", "comments.read", "comments.write"],
+    publish: ["page.view", "content.publish"],
+    manage: ["page.view", "comments.read", "comments.write", "content.publish", "access.manage"],
+};
+export const GRANT_AUDIENCE_KINDS = [
+    "public",
+    "team",
+    "person",
+    "link",
+    "password",
+    "machine",
+    "external",
+];
+export const grantAudienceKindSchema = z.enum(GRANT_AUDIENCE_KINDS);
+const grantReferenceSchema = z.string().trim().min(1).max(255);
+export const grantAudienceSchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("public") }).strict(),
+    z.object({ kind: z.literal("team"), teamId: grantReferenceSchema }).strict(),
+    z.object({ kind: z.literal("person"), personId: grantReferenceSchema }).strict(),
+    z.object({ kind: z.literal("link"), linkId: grantReferenceSchema }).strict(),
+    z.object({ kind: z.literal("password"), credentialId: grantReferenceSchema }).strict(),
+    z.object({ kind: z.literal("machine"), machineId: grantReferenceSchema }).strict(),
+    z
+        .object({
+        kind: z.literal("external"),
+        issuer: grantReferenceSchema,
+        subject: grantReferenceSchema,
+    })
+        .strict(),
+]);
+function hasUnsafePatternCharacter(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if (codePoint === undefined ||
+            codePoint <= 0x1f ||
+            codePoint === 0x7f ||
+            character === "\\" ||
+            character === "?" ||
+            character === "#") {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Canonical resource-pattern syntax shared by config compilation and evaluation.
+ * `*` matches one path segment and `**` matches zero or more segments. Wildcards
+ * are whole segments so a pattern can never disguise an encoded separator.
+ *
+ * Unlike URL-route canonicalization, resource patterns retain a terminal
+ * `index.html`: Grants can constrain the visitor-facing route and the artifact
+ * it resolves to independently.
+ */
+export function normalizeGrantResourcePattern(input) {
+    if (!input.startsWith("/") || input.startsWith("//") || hasUnsafePatternCharacter(input)) {
+        throw new TypeError("resource pattern must be a plain absolute URL path pattern");
+    }
+    if (/%2f|%5c|%2a/iu.test(input)) {
+        throw new TypeError("resource pattern contains an ambiguous encoded separator or wildcard");
+    }
+    let decoded;
+    try {
+        decoded = decodeURIComponent(input);
+    }
+    catch {
+        throw new TypeError("resource pattern contains malformed percent encoding");
+    }
+    if (hasUnsafePatternCharacter(decoded)) {
+        throw new TypeError("resource pattern contains an unsafe character");
+    }
+    const segments = [];
+    for (const rawSegment of decoded.split("/")) {
+        const segment = rawSegment.normalize("NFC");
+        if (segment === "" || segment === ".")
+            continue;
+        if (segment === "..") {
+            if (segments.length === 0)
+                throw new TypeError("resource pattern escapes the URL root");
+            segments.pop();
+            continue;
+        }
+        if (segment.includes("*") && segment !== "*" && segment !== "**") {
+            throw new TypeError("resource wildcards must occupy a whole path segment");
+        }
+        segments.push(segment);
+    }
+    return segments.length === 0 ? "/" : `/${segments.join("/")}`;
+}
+export const grantResourcePatternSchema = z
+    .string()
+    .min(1)
+    .max(1024)
+    .check((context) => {
+    try {
+        context.value = normalizeGrantResourcePattern(context.value);
+    }
+    catch (error) {
+        context.issues.push({
+            code: "custom",
+            input: context.value,
+            message: error instanceof Error ? error.message : "invalid resource pattern",
+        });
+    }
+});
+function uniqueArray(values) {
+    return new Set(values).size === values.length;
+}
+export const GRANT_RESOURCE_PATTERN_LIMIT = 100;
+export const grantResourceSetSchema = z
+    .object({
+    include: z.array(grantResourcePatternSchema).min(1).max(GRANT_RESOURCE_PATTERN_LIMIT),
+    exclude: z.array(grantResourcePatternSchema).max(GRANT_RESOURCE_PATTERN_LIMIT).default([]),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.include.length + value.exclude.length > GRANT_RESOURCE_PATTERN_LIMIT) {
+        context.addIssue({
+            code: "custom",
+            message: `resource sets support up to ${GRANT_RESOURCE_PATTERN_LIMIT} patterns`,
+        });
+    }
+    if (!uniqueArray(value.include)) {
+        context.addIssue({
+            code: "custom",
+            path: ["include"],
+            message: "include patterns must be unique",
+        });
+    }
+    if (!uniqueArray(value.exclude)) {
+        context.addIssue({
+            code: "custom",
+            path: ["exclude"],
+            message: "exclude patterns must be unique",
+        });
+    }
+});
+export const GRANT_TARGET_KINDS = ["live", "version", "branch", "all_versions"];
+export const grantTargetKindSchema = z.enum(GRANT_TARGET_KINDS);
+export const grantTargetSelectorSchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("live") }).strict(),
+    z.object({ kind: z.literal("version"), versionId: grantReferenceSchema }).strict(),
+    z.object({ kind: z.literal("branch"), branch: grantReferenceSchema }).strict(),
+    z.object({ kind: z.literal("all_versions") }).strict(),
+]);
+function parseIpv4(input) {
+    const parts = input.split(".");
+    if (parts.length !== 4)
+        return null;
+    let bits = 0n;
+    for (const part of parts) {
+        if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(part))
+            return null;
+        const value = Number(part);
+        if (value > 255)
+            return null;
+        bits = (bits << 8n) | BigInt(value);
+    }
+    return { bits, width: 32 };
+}
+function parseIpv6(input) {
+    if (input === "" || input.includes("%") || input.split("::").length > 2)
+        return null;
+    let value = input.toLowerCase();
+    const ipv4Tail = value.match(/(?:^|:)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)$/u)?.[1];
+    if (ipv4Tail) {
+        const parsed = parseIpv4(ipv4Tail);
+        if (!parsed)
+            return null;
+        value = `${value.slice(0, -ipv4Tail.length)}${Number((parsed.bits >> 16n) & 0xffffn).toString(16)}:${Number(parsed.bits & 0xffffn).toString(16)}`;
+    }
+    const [leftText, rightText] = value.split("::");
+    const left = leftText ? leftText.split(":") : [];
+    const right = rightText ? rightText.split(":") : [];
+    if ([...left, ...right].some((part) => !/^[0-9a-f]{1,4}$/u.test(part)))
+        return null;
+    const compressed = value.includes("::");
+    const missing = 8 - left.length - right.length;
+    if ((!compressed && missing !== 0) || (compressed && missing < 1))
+        return null;
+    const parts = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+    if (parts.length !== 8)
+        return null;
+    return {
+        bits: parts.reduce((bits, part) => (bits << 16n) | BigInt(`0x${part}`), 0n),
+        width: 128,
+    };
+}
+function parseIpAddress(input) {
+    return parseIpv4(input) ?? parseIpv6(input);
+}
+export function normalizeGrantNetworkCidr(input) {
+    const value = input.trim().toLowerCase();
+    const separator = value.lastIndexOf("/");
+    const address = separator === -1 ? value : value.slice(0, separator);
+    const parsed = parseIpAddress(address);
+    if (!parsed)
+        throw new TypeError("network rules require a valid IPv4 or IPv6 address");
+    if (separator === -1)
+        return value;
+    const prefixText = value.slice(separator + 1);
+    if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(prefixText)) {
+        throw new TypeError("network rules require a valid CIDR prefix");
+    }
+    const prefix = Number(prefixText);
+    if (prefix > parsed.width)
+        throw new TypeError("network CIDR prefix exceeds its address width");
+    return `${address}/${prefix}`;
+}
+export function grantNetworkCidrMatches(cidr, ipAddress) {
+    let canonical;
+    try {
+        canonical = normalizeGrantNetworkCidr(cidr);
+    }
+    catch {
+        return false;
+    }
+    const separator = canonical.lastIndexOf("/");
+    const networkText = separator === -1 ? canonical : canonical.slice(0, separator);
+    const network = parseIpAddress(networkText);
+    const address = parseIpAddress(ipAddress.trim().toLowerCase());
+    if (!network || !address || network.width !== address.width)
+        return false;
+    const prefix = separator === -1 ? network.width : Number(canonical.slice(separator + 1));
+    if (prefix === 0)
+        return true;
+    const shift = BigInt(network.width - prefix);
+    return network.bits >> shift === address.bits >> shift;
+}
+const grantNetworkCidrSchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .check((context) => {
+    try {
+        context.value = normalizeGrantNetworkCidr(context.value);
+    }
+    catch (error) {
+        context.issues.push({
+            code: "custom",
+            input: context.value,
+            message: error instanceof Error ? error.message : "invalid network rule",
+        });
+    }
+});
+const grantCountrySchema = z
+    .string()
+    .length(2)
+    .overwrite((country) => country.toUpperCase())
+    .refine((country) => ISO_COUNTRY_CODES.includes(country), "Country must be an ISO 3166-1 alpha-2 code.");
+const grantConstraintDateSchema = z.string().datetime();
+const grantConstraintMaxUsesSchema = z.number().int().positive().max(1_000_000);
+const grantConstraintIpCidrsSchema = z.array(grantNetworkCidrSchema).min(1).max(50);
+const grantConstraintCountriesSchema = z.array(grantCountrySchema).min(1).max(250);
+const grantConstraintUserAgentsSchema = z.array(z.string().trim().min(1).max(200)).min(1).max(50);
+const grantNetworkConstraintsSchema = z
+    .object({
+    ipCidrs: grantConstraintIpCidrsSchema.optional(),
+    countries: grantConstraintCountriesSchema.optional(),
+    excludedCountries: grantConstraintCountriesSchema.optional(),
+    excludedUserAgentSubstrings: grantConstraintUserAgentsSchema.optional(),
+})
+    .strict()
+    .superRefine((network, context) => {
+    if (network.ipCidrs === undefined &&
+        network.countries === undefined &&
+        network.excludedCountries === undefined &&
+        network.excludedUserAgentSubstrings === undefined) {
+        context.addIssue({
+            code: "custom",
+            message: "network requires at least one IP, country, or user-agent selector",
+        });
+    }
+});
+export const grantConstraintsSchema = z
+    .object({
+    notBefore: grantConstraintDateSchema.optional(),
+    expiresAt: grantConstraintDateSchema.optional(),
+    maxUses: grantConstraintMaxUsesSchema.optional(),
+    requireVerifiedEmail: z.boolean().optional(),
+    network: grantNetworkConstraintsSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.notBefore !== undefined &&
+        value.expiresAt !== undefined &&
+        Date.parse(value.notBefore) >= Date.parse(value.expiresAt)) {
+        context.addIssue({
+            code: "custom",
+            path: ["expiresAt"],
+            message: "expiresAt must be later than notBefore",
+        });
+    }
+});
+/** Field-scoped PATCH shape. `null` clears one constraint without replacing its siblings. */
+export const grantConstraintsPatchSchema = z
+    .object({
+    notBefore: grantConstraintDateSchema.nullable().optional(),
+    expiresAt: grantConstraintDateSchema.nullable().optional(),
+    maxUses: grantConstraintMaxUsesSchema.nullable().optional(),
+    requireVerifiedEmail: z.boolean().nullable().optional(),
+    network: z
+        .object({
+        ipCidrs: grantConstraintIpCidrsSchema.nullable().optional(),
+        countries: grantConstraintCountriesSchema.nullable().optional(),
+        excludedCountries: grantConstraintCountriesSchema.nullable().optional(),
+        excludedUserAgentSubstrings: grantConstraintUserAgentsSchema.nullable().optional(),
+    })
+        .strict()
+        .nullable()
+        .optional(),
+})
+    .strict();
+export function diffGrantConstraints(original, draft) {
+    const network = JSON.stringify(original.network) === JSON.stringify(draft.network)
+        ? undefined
+        : draft.network === undefined
+            ? null
+            : {
+                ...(JSON.stringify(original.network?.ipCidrs) === JSON.stringify(draft.network.ipCidrs)
+                    ? {}
+                    : { ipCidrs: draft.network.ipCidrs ?? null }),
+                ...(JSON.stringify(original.network?.countries) ===
+                    JSON.stringify(draft.network.countries)
+                    ? {}
+                    : { countries: draft.network.countries ?? null }),
+                ...(JSON.stringify(original.network?.excludedCountries) ===
+                    JSON.stringify(draft.network.excludedCountries)
+                    ? {}
+                    : { excludedCountries: draft.network.excludedCountries ?? null }),
+                ...(JSON.stringify(original.network?.excludedUserAgentSubstrings) ===
+                    JSON.stringify(draft.network.excludedUserAgentSubstrings)
+                    ? {}
+                    : {
+                        excludedUserAgentSubstrings: draft.network.excludedUserAgentSubstrings ?? null,
+                    }),
+            };
+    const patch = {
+        ...(original.notBefore === draft.notBefore ? {} : { notBefore: draft.notBefore ?? null }),
+        ...(original.expiresAt === draft.expiresAt ? {} : { expiresAt: draft.expiresAt ?? null }),
+        ...(original.maxUses === draft.maxUses ? {} : { maxUses: draft.maxUses ?? null }),
+        ...(original.requireVerifiedEmail === draft.requireVerifiedEmail
+            ? {}
+            : { requireVerifiedEmail: draft.requireVerifiedEmail ?? null }),
+        ...(network === undefined ? {} : { network }),
+    };
+    return Object.keys(patch).length === 0 ? undefined : patch;
+}
+export function applyGrantConstraintsPatch(current, patch) {
+    const network = patch.network === undefined
+        ? current.network
+        : patch.network === null
+            ? undefined
+            : {
+                ...current.network,
+                ...(patch.network.ipCidrs === undefined
+                    ? {}
+                    : { ipCidrs: patch.network.ipCidrs ?? undefined }),
+                ...(patch.network.countries === undefined
+                    ? {}
+                    : { countries: patch.network.countries ?? undefined }),
+                ...(patch.network.excludedCountries === undefined
+                    ? {}
+                    : { excludedCountries: patch.network.excludedCountries ?? undefined }),
+                ...(patch.network.excludedUserAgentSubstrings === undefined
+                    ? {}
+                    : {
+                        excludedUserAgentSubstrings: patch.network.excludedUserAgentSubstrings ?? undefined,
+                    }),
+            };
+    const compactNetwork = network && Object.values(network).some((value) => value !== undefined) ? network : undefined;
+    return grantConstraintsSchema.parse({
+        ...current,
+        ...(patch.notBefore === undefined ? {} : { notBefore: patch.notBefore ?? undefined }),
+        ...(patch.expiresAt === undefined ? {} : { expiresAt: patch.expiresAt ?? undefined }),
+        ...(patch.maxUses === undefined ? {} : { maxUses: patch.maxUses ?? undefined }),
+        ...(patch.requireVerifiedEmail === undefined
+            ? {}
+            : { requireVerifiedEmail: patch.requireVerifiedEmail ?? undefined }),
+        network: compactNetwork,
+    });
+}
+export const GRANT_SOURCE_KINDS = ["config", "managed", "system"];
+export const grantSourceKindSchema = z.enum(GRANT_SOURCE_KINDS);
+export const PRECLAIM_OPEN_GRANT_SOURCE_REFERENCE = "open:preclaim-author";
+export const SPACE_OPEN_GRANT_SOURCE_REFERENCE = "open:space";
+export const OWNING_TEAM_MANAGEMENT_GRANT_SOURCE_REFERENCE = "ownership:team";
+export const OWNING_TEAM_VERSION_GRANT_SOURCE_REFERENCE = "ownership:team:versions";
+export const OWNING_EXTERNAL_MANAGEMENT_GRANT_SOURCE_REFERENCE = "ownership:external";
+export const OWNING_EXTERNAL_VERSION_GRANT_SOURCE_REFERENCE = "ownership:external:versions";
+export const CONFIG_PUBLIC_GRANT_SOURCE_REFERENCE = "sf.jsonc#$.access.public";
+export const grantSourceSchema = z
+    .object({
+    kind: grantSourceKindSchema,
+    reference: grantReferenceSchema,
+})
+    .strict();
+const grantDimensionsSchema = z
+    .object({
+    name: z.string().trim().min(1).max(120).optional(),
+    audience: grantAudienceSchema,
+    resources: grantResourceSetSchema,
+    capabilities: z
+        .array(grantCapabilitySchema)
+        .min(1)
+        .max(GRANT_CAPABILITIES.length)
+        .refine(uniqueArray, "capabilities must be unique"),
+    constraints: grantConstraintsSchema.default({}),
+    target: grantTargetSelectorSchema,
+})
+    .strict();
+function validateGrantAudienceCapabilityBoundary(value, context) {
+    if (value.audience.kind === "public" &&
+        value.capabilities.some((capability) => capability === "content.publish" || capability === "access.manage")) {
+        context.addIssue({
+            code: "custom",
+            path: ["capabilities"],
+            message: "public audiences cannot receive content.publish or access.manage",
+        });
+        return;
+    }
+    if (value.audience.kind === "public" && value.target.kind === "branch") {
+        context.addIssue({
+            code: "custom",
+            path: ["target"],
+            message: "public audiences cannot target moving branches; use a Link or another explicit audience",
+        });
+    }
+    if (["link", "password"].includes(value.audience.kind) &&
+        value.capabilities.includes("access.manage")) {
+        context.addIssue({
+            code: "custom",
+            path: ["capabilities"],
+            message: `${value.audience.kind} audiences cannot receive access.manage`,
+        });
+    }
+    if (value.constraints.maxUses !== undefined &&
+        !["link", "password", "machine", "external"].includes(value.audience.kind)) {
+        context.addIssue({
+            code: "custom",
+            path: ["constraints", "maxUses"],
+            message: "maxUses is available only for Link, password, service-token, and external-identity credential redemptions",
+        });
+    }
+    if (value.constraints.requireVerifiedEmail === true &&
+        ["public", "machine"].includes(value.audience.kind)) {
+        context.addIssue({
+            code: "custom",
+            path: ["constraints", "requireVerifiedEmail"],
+            message: "requireVerifiedEmail is unavailable for public and machine audiences",
+        });
+    }
+}
+const grantObjectSchema = grantDimensionsSchema.extend({
+    id: z.string().trim().min(1).max(128),
+    source: grantSourceSchema,
+});
+function validateGrantCapabilityBoundary(value, context) {
+    validateGrantAudienceCapabilityBoundary(value, context);
+    if (value.audience.kind === "link" && value.capabilities.includes("content.publish")) {
+        context.addIssue({
+            code: "custom",
+            path: ["capabilities"],
+            message: "link audiences cannot publish content",
+        });
+    }
+}
+export const grantSchema = grantObjectSchema.superRefine(validateGrantCapabilityBoundary);
+export const managedGrantWriteSchema = grantDimensionsSchema.superRefine((value, context) => {
+    validateGrantAudienceCapabilityBoundary(value, context);
+    if (value.audience.kind === "link" && value.capabilities.includes("content.publish")) {
+        context.addIssue({
+            code: "custom",
+            path: ["capabilities"],
+            message: "link audiences can publish only through the system-issued pre-claim Open author Grant",
+        });
+    }
+});
+export const directManagedGrantWriteSchema = managedGrantWriteSchema.superRefine((value, context) => {
+    if (!["public", "team", "person"].includes(value.audience.kind)) {
+        context.addIssue({
+            code: "custom",
+            path: ["audience", "kind"],
+            message: "direct managed Grants support only public, team, and person audiences; credential-backed audiences use their dedicated workflow",
+        });
+    }
+});
+export const grantSourceExplanationSchema = z
+    .object({
+    editable: z.boolean(),
+    label: z.string().min(1),
+    detail: z.string().min(1),
+})
+    .strict();
+export const spaceGrantSchema = z
+    .object({
+    grant: grantObjectSchema
+        .extend({ id: registeredIdSchema("grt") })
+        .superRefine(validateGrantCapabilityBoundary),
+    generation: z.number().int().positive(),
+    status: z.enum(["scheduled", "active", "expired"]),
+    sourceExplanation: grantSourceExplanationSchema,
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime(),
+})
+    .strict();
+export const grantCheckQuerySchema = z
+    .object({
+    path: z.string().min(1).max(2048).default("/"),
+    target: z.enum(["live", "version", "branch"]).default("live"),
+    targetId: z.string().trim().min(1).max(255).optional(),
+    audience: grantAudienceKindSchema.default("public"),
+    personId: z.string().trim().min(1).max(255).optional(),
+    linkId: z.string().trim().min(1).max(255).optional(),
+    passwordCredentialId: z.string().trim().min(1).max(255).optional(),
+    machineId: z.string().trim().min(1).max(255).optional(),
+    issuer: z.string().trim().min(1).max(255).optional(),
+    subject: z.string().trim().min(1).max(255).optional(),
+    verifiedEmail: z.enum(["true", "false"]).optional(),
+    ipAddress: z.string().trim().min(1).max(64).optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.target === "live" && value.targetId !== undefined) {
+        context.addIssue({
+            code: "custom",
+            path: ["targetId"],
+            message: "targetId is only valid for a version or branch target",
+        });
+    }
+    if (value.target !== "live" && value.targetId === undefined) {
+        context.addIssue({
+            code: "custom",
+            path: ["targetId"],
+            message: `targetId is required for a ${value.target} target`,
+        });
+    }
+    const audienceFields = [
+        ["person", "personId"],
+        ["link", "linkId"],
+        ["password", "passwordCredentialId"],
+        ["machine", "machineId"],
+        ["external", "issuer"],
+        ["external", "subject"],
+    ];
+    for (const [audience, field] of audienceFields) {
+        if (value.audience === audience && value[field] === undefined) {
+            context.addIssue({
+                code: "custom",
+                path: [field],
+                message: `${field} is required when simulating ${audience} access`,
+            });
+        }
+        if (value.audience !== audience && value[field] !== undefined) {
+            context.addIssue({
+                code: "custom",
+                path: [field],
+                message: `${field} is only valid when simulating ${audience} access`,
+            });
+        }
+    }
+});
+export const GRANT_CHECK_FAILURES = [
+    "space_unclaimed_config",
+    "audience",
+    "target",
+    "invalid_time",
+    "not_before",
+    "expired",
+    "max_uses",
+    "verified_email",
+    "network",
+    "resource_not_included",
+    "resource_excluded",
+];
+export const grantCheckFailureSchema = z.enum(GRANT_CHECK_FAILURES);
+export const grantCheckSchema = z
+    .object({
+    path: z.string().min(1),
+    target: z.discriminatedUnion("kind", [
+        z.object({ kind: z.literal("live") }).strict(),
+        z.object({ kind: z.literal("version"), versionId: z.string().min(1) }).strict(),
+        z.object({ kind: z.literal("branch"), branch: z.string().min(1) }).strict(),
+    ]),
+    simulatedAudience: grantAudienceSchema,
+    capabilities: z.array(grantCapabilitySchema),
+    matchingGrants: z.array(z
+        .object({
+        grant: spaceGrantSchema,
+        capabilities: z.array(grantCapabilitySchema).min(1),
+    })
+        .strict()),
+    evaluatedGrants: z.array(z
+        .object({
+        grant: spaceGrantSchema,
+        failures: z.array(grantCheckFailureSchema),
+    })
+        .strict()),
+})
+    .strict();
+const credentialGrantFields = {
+    name: z.string().trim().min(1).max(120),
+    resources: grantResourceSetSchema,
+    capabilities: z
+        .array(grantCapabilitySchema)
+        .min(1)
+        .max(GRANT_CAPABILITIES.length)
+        .refine(uniqueArray, "capabilities must be unique"),
+    constraints: grantConstraintsSchema.default({}),
+    target: grantTargetSelectorSchema,
+};
+export const passwordCredentialCreateSchema = z
+    .object({
+    ...credentialGrantFields,
+    password: z.string().min(1).max(1024),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const unsafeCapability = value.capabilities.find((capability) => capability === "content.publish" || capability === "access.manage");
+    if (unsafeCapability) {
+        context.addIssue({
+            code: "custom",
+            path: ["capabilities"],
+            message: `password audiences cannot receive ${unsafeCapability}`,
+        });
+    }
+});
+export const passwordCredentialRotateSchema = z
+    .object({ password: z.string().min(1).max(1024) })
+    .strict();
+export const machineCredentialCreateSchema = z
+    .object(credentialGrantFields)
+    .strict()
+    .superRefine((value, context) => {
+    if (value.constraints.requireVerifiedEmail === true) {
+        context.addIssue({
+            code: "custom",
+            path: ["constraints", "requireVerifiedEmail"],
+            message: "requireVerifiedEmail is unavailable for machine audiences",
+        });
+    }
+});
+export const passwordCredentialSchema = z
+    .object({
+    id: registeredIdSchema("pwd"),
+    grant: spaceGrantSchema,
+    rotatedAt: z.string().datetime().nullable(),
+    lastUsedAt: z.string().datetime().nullable(),
+    revokedAt: z.string().datetime().nullable(),
+})
+    .strict();
+export const machineCredentialSchema = z
+    .object({
+    id: registeredIdSchema("mch"),
+    grant: spaceGrantSchema,
+    tokenHint: z.string().min(1).max(32),
+    rotatedAt: z.string().datetime().nullable(),
+    lastUsedAt: z.string().datetime().nullable(),
+    revokedAt: z.string().datetime().nullable(),
+})
+    .strict();
+export const machineCredentialSecretSchema = z
+    .object({
+    credential: machineCredentialSchema,
+    token: z.string().min(32).max(256),
+})
+    .strict();
+export const machineCredentialExchangeRequestSchema = z
+    .object({
+    spaceId: registeredIdSchema("spc"),
+    host: z.string().trim().min(1).max(255),
+    resource: z.string().min(1).max(1024),
+    target: z
+        .discriminatedUnion("kind", [
+        z.object({ kind: z.literal("live") }).strict(),
+        z.object({ kind: z.literal("version"), versionId: grantReferenceSchema }).strict(),
+        z.object({ kind: z.literal("branch"), branch: grantReferenceSchema }).strict(),
+    ])
+        .default({ kind: "live" }),
+})
+    .strict();
+export const machineCredentialExchangeResponseSchema = z
+    .object({
+    token: z.string().min(1),
+    expiresAt: z.string().datetime(),
+})
+    .strict();
+export const credentialRevocationSchema = z
+    .object({
+    grantId: registeredIdSchema("grt"),
+    revoked: z.literal(true),
+})
+    .strict();
+export const IDENTITY_CONNECTION_DEFAULT_TTL_SECONDS = 8 * 60 * 60;
+export const EXTERNAL_IDENTITY_MAX_TTL_SECONDS = 30 * 60;
+export const identityConnectionPublicKeySchema = z
+    .object({
+    kid: z.string().min(1).max(64),
+    publicKey: z
+        .string()
+        .regex(/^[A-Za-z0-9_-]{43}$/, "publicKey must be a raw Ed25519 public key"),
+})
+    .strict();
+export const identityConnectionCreateSchema = z.discriminatedUnion("type", [
+    z
+        .object({
+        type: z.literal("oidc"),
+        name: z.string().trim().min(1).max(200),
+        issuer: z.string().min(1).max(1024),
+        clientId: z.string().min(1).max(512),
+        clientSecret: z.string().min(1).max(2048),
+        sessionTtlSeconds: z
+            .number()
+            .int()
+            .min(60)
+            .max(24 * 60 * 60)
+            .optional(),
+    })
+        .strict(),
+    z
+        .object({
+        type: z.literal("signer"),
+        name: z.string().trim().min(1).max(200),
+        issuer: z.string().min(1).max(1024),
+        authorizeUrl: z.string().min(1).max(2048),
+        publicKeys: z.array(identityConnectionPublicKeySchema).min(1).max(5),
+        sessionTtlSeconds: z.number().int().min(60).max(EXTERNAL_IDENTITY_MAX_TTL_SECONDS).optional(),
+    })
+        .strict(),
+]);
+export const identityConnectionUpdateSchema = z
+    .object({
+    name: z.string().trim().min(1).max(200).optional(),
+    clientId: z.string().min(1).max(512).optional(),
+    clientSecret: z.string().min(1).max(2048).optional(),
+    authorizeUrl: z.string().min(1).max(2048).optional(),
+    publicKeys: z.array(identityConnectionPublicKeySchema).min(1).max(5).optional(),
+    sessionTtlSeconds: z
+        .number()
+        .int()
+        .min(60)
+        .max(24 * 60 * 60)
+        .optional(),
+})
+    .strict();
+export const identityConnectionSchema = z
+    .object({
+    id: registeredIdSchema("acn"),
+    teamId: z.string().min(1),
+    type: z.enum(["oidc", "signer"]),
+    name: z.string().min(1),
+    issuer: z.string().min(1),
+    clientId: z.string().nullable(),
+    clientSecretSet: z.boolean(),
+    authorizeUrl: z.string().nullable(),
+    publicKeys: z.array(identityConnectionPublicKeySchema),
+    sessionTtlSeconds: z.number().int().positive(),
+    createdAt: z.string().datetime(),
+    rotatedAt: z.string().datetime().nullable(),
+    lastUsedAt: z.string().datetime().nullable(),
+    revokedAt: z.string().datetime().nullable(),
+})
+    .strict();
+export const externalGrantCreateSchema = z
+    .object({
+    connectionId: registeredIdSchema("acn"),
+    subject: z.string().min(1).max(255),
+    ...credentialGrantFields,
+})
+    .strict();