@spacefast/common 0.0.12 → 0.0.17

package/dist/contracts/access.d.ts

@@ -1,1270 +1,560 @@
 import { z } from "zod";
-export declare const grantSchema: z.ZodString;
-export type Grant = z.infer<typeof grantSchema>;
-export declare const GRANT_NAMESPACES: readonly ["email:", "team:", "sub-team:", "user:", "space:", "link:", "invite:", "svc:", "sso:", "ext:", "pw:"];
-export declare function isWellFormedGrant(grant: string): boolean;
-export declare const requiredGrantSchema: z.ZodString;
-export declare const SPACE_LEVELS: readonly ["viewer", "commenter", "editor", "admin"];
-export declare const spaceLevelSchema: z.ZodEnum<{
+export declare const SPACE_ACCESS_PRESETS: readonly ["private", "team", "public"];
+export declare const ACCESS_HANDOFF_MEDIA_TYPE = "application/vnd.spacefast.access-handoff+json";
+export declare const spaceAccessPresetSchema: z.ZodEnum<{
+    team: "team";
+    public: "public";
+    private: "private";
+}>;
+export type SpaceAccessPreset = z.infer<typeof spaceAccessPresetSchema>;
+export declare const ACCESS_ROLES: readonly ["viewer", "commenter", "editor", "manager"];
+export declare const accessRoleSchema: z.ZodEnum<{
     viewer: "viewer";
     commenter: "commenter";
     editor: "editor";
-    admin: "admin";
+    manager: "manager";
 }>;
-export type SpaceLevel = z.infer<typeof spaceLevelSchema>;
-export declare const accessKeySchema: z.ZodObject<{
-    kid: z.ZodString;
-    alg: z.ZodLiteral<"EdDSA">;
-    publicKey: z.ZodString;
-    grantNamespaces: z.ZodArray<z.ZodString>;
-}, z.core.$strip>;
-export type AccessKey = z.infer<typeof accessKeySchema>;
-export declare const ACCESS_CONNECTION_TYPES: readonly ["oidc", "external"];
-export declare const accessConnectionTypeSchema: z.ZodEnum<{
-    external: "external";
-    oidc: "oidc";
-}>;
-export declare const OIDC_CONNECTION_DEFAULT_TTL_SECONDS: number;
-export declare const EXTERNAL_CONNECTION_DEFAULT_TTL_SECONDS: number;
-export declare const EXTERNAL_TOKEN_MAX_TTL_SECONDS: number;
-export declare function ssoGrant(connectionId: string): string;
-export declare function externalGrantNamespace(connectionId: string): string;
-export declare function externalGrant(connectionId: string, tag: string): string;
-export declare function connectionAcquireRef(connectionId: string): string;
-export declare function parseConnectionAcquireRef(url: string): string | null;
-export declare function referencedConnectionIds(input: {
-    requiredGrants?: string[] | undefined;
-    acquire?: Array<{
-        type: string;
-        url?: string;
-    }> | undefined;
-}): string[];
-export declare const externalConnectionPublicKeySchema: z.ZodObject<{
-    kid: z.ZodString;
-    publicKey: z.ZodString;
-}, z.core.$strip>;
-export type ExternalConnectionPublicKey = z.infer<typeof externalConnectionPublicKeySchema>;
-export declare const accessConnectionSchema: z.ZodObject<{
+export type AccessRole = z.infer<typeof accessRoleSchema>;
+export declare function accessRoleRank(role: AccessRole): number;
+export declare function maxAccessRole(left: AccessRole | null, right: AccessRole | null): AccessRole | null;
+/**
+ * Canonicalizes the URL route identity used by People, Links, requests,
+ * comments, and runtime authorization.
+ */
+export declare function normalizeAccessScopePath(input: string): string;
+export declare const accessScopePathSchema: z.ZodString;
+export type AccessScopePath = z.infer<typeof accessScopePathSchema>;
+export declare function accessScopeContains(scope: string, path: string): boolean;
+export declare const authorityReferenceSchema: z.ZodString;
+export type AuthorityReference = z.infer<typeof authorityReferenceSchema>;
+export declare const accountPrincipalSchema: z.ZodString;
+export type AccountPrincipal = z.infer<typeof accountPrincipalSchema>;
+export declare const identifiedPrincipalSchema: z.ZodString;
+export type IdentifiedPrincipal = z.infer<typeof identifiedPrincipalSchema>;
+export declare const accessPrincipalSchema: z.ZodUnion<readonly [z.ZodLiteral<"anonymous">, z.ZodString]>;
+export type AccessPrincipal = z.infer<typeof accessPrincipalSchema>;
+export declare function accountPrincipal(userId: string): AccountPrincipal;
+/** The user id behind an account principal; null for anonymous or malformed. */
+export declare function accountPrincipalUserId(principal: string | undefined | null): string | null;
+/**
+ * The identity an authority reference names on its own, if any. Credential
+ * classes name nobody. This is the ONE place a class maps to an identity: at
+ * the exchange that just authenticated it, never downstream.
+ */
+export declare function principalForAuthority(reference: AuthorityReference): IdentifiedPrincipal | undefined;
+export declare const personGrantSchema: z.ZodObject<{
     id: z.ZodString;
-    teamId: z.ZodString;
-    type: z.ZodEnum<{
-        external: "external";
-        oidc: "oidc";
+    scope: z.ZodString;
+    role: z.ZodEnum<{
+        viewer: "viewer";
+        commenter: "commenter";
+        editor: "editor";
+        manager: "manager";
     }>;
-    name: z.ZodString;
-    issuer: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    clientId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    clientSecretSet: z.ZodDefault<z.ZodBoolean>;
-    authorizeUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    publicKeys: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        kid: z.ZodString;
-        publicKey: z.ZodString;
-    }, z.core.$strip>>>;
-    sessionTtlSeconds: z.ZodNumber;
-    guestEmailDomains: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     createdAt: z.ZodString;
-    revokedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    active: z.ZodBoolean;
+    revokedAt: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
-export type AccessConnection = z.infer<typeof accessConnectionSchema>;
-export declare const oidcConnectionCreateSchema: z.ZodObject<{
-    type: z.ZodLiteral<"oidc">;
-    name: z.ZodString;
-    issuer: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-    guestEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export declare const externalConnectionCreateSchema: z.ZodObject<{
-    type: z.ZodLiteral<"external">;
-    name: z.ZodString;
-    authorizeUrl: z.ZodString;
-    publicKeys: z.ZodArray<z.ZodObject<{
-        kid: z.ZodString;
-        publicKey: z.ZodString;
+export type PersonGrant = z.infer<typeof personGrantSchema>;
+export declare const spacePersonStatusSchema: z.ZodEnum<{
+    revoked: "revoked";
+    pending: "pending";
+    accepted: "accepted";
+}>;
+export declare const spacePersonDisplayNameSchema: z.ZodString;
+export declare function fallbackSpacePersonDisplayName(personId: string): string;
+export declare const spacePersonSchema: z.ZodObject<{
+    id: z.ZodString;
+    spaceId: z.ZodString;
+    displayName: z.ZodString;
+    email: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        revoked: "revoked";
+        pending: "pending";
+        accepted: "accepted";
+    }>;
+    grants: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        scope: z.ZodString;
+        role: z.ZodEnum<{
+            viewer: "viewer";
+            commenter: "commenter";
+            editor: "editor";
+            manager: "manager";
+        }>;
+        createdAt: z.ZodString;
+        revokedAt: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
-    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-    guestEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    invitedBy: z.ZodNullable<z.ZodString>;
+    inviteExpiresAt: z.ZodNullable<z.ZodString>;
+    acceptedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
 }, z.core.$strip>;
-export declare const accessConnectionCreateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    type: z.ZodLiteral<"oidc">;
-    name: z.ZodString;
-    issuer: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-    guestEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"external">;
-    name: z.ZodString;
-    authorizeUrl: z.ZodString;
-    publicKeys: z.ZodArray<z.ZodObject<{
-        kid: z.ZodString;
-        publicKey: z.ZodString;
+export type SpacePerson = z.infer<typeof spacePersonSchema>;
+export declare const inheritedTeamAccessSchema: z.ZodObject<{
+    teamId: z.ZodString;
+    teamName: z.ZodString;
+    ruleScopes: z.ZodArray<z.ZodString>;
+    members: z.ZodArray<z.ZodObject<{
+        membershipId: z.ZodString;
+        userId: z.ZodString;
+        displayName: z.ZodString;
+        email: z.ZodString;
+        teamRole: z.ZodString;
+        role: z.ZodLiteral<"editor">;
     }, z.core.$strip>>;
-    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-    guestEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>], "type">;
-export type AccessConnectionCreate = z.infer<typeof accessConnectionCreateSchema>;
-export declare const accessConnectionUpdateSchema: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    issuer: z.ZodOptional<z.ZodString>;
-    clientId: z.ZodOptional<z.ZodString>;
-    clientSecret: z.ZodOptional<z.ZodString>;
-    authorizeUrl: z.ZodOptional<z.ZodString>;
-    publicKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        kid: z.ZodString;
-        publicKey: z.ZodString;
-    }, z.core.$strip>>>;
-    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-    guestEmailDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
 }, z.core.$strip>;
-export type AccessConnectionUpdate = z.infer<typeof accessConnectionUpdateSchema>;
-export declare const accessConnectionRevokeResultSchema: z.ZodObject<{
-    connection: z.ZodObject<{
+export type InheritedTeamAccess = z.infer<typeof inheritedTeamAccessSchema>;
+export declare const spacePeopleListSchema: z.ZodObject<{
+    people: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
-        teamId: z.ZodString;
-        type: z.ZodEnum<{
-            external: "external";
-            oidc: "oidc";
-        }>;
-        name: z.ZodString;
-        issuer: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        clientId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        clientSecretSet: z.ZodDefault<z.ZodBoolean>;
-        authorizeUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        publicKeys: z.ZodDefault<z.ZodArray<z.ZodObject<{
-            kid: z.ZodString;
-            publicKey: z.ZodString;
-        }, z.core.$strip>>>;
-        sessionTtlSeconds: z.ZodNumber;
-        guestEmailDomains: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-        createdAt: z.ZodString;
-        revokedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        active: z.ZodBoolean;
-    }, z.core.$strip>;
-    disabledRules: z.ZodDefault<z.ZodArray<z.ZodObject<{
         spaceId: z.ZodString;
-        ruleId: z.ZodString;
-    }, z.core.$strip>>>;
-}, z.core.$strip>;
-export type AccessConnectionRevokeResult = z.infer<typeof accessConnectionRevokeResultSchema>;
-export declare const passwordAcquireSchema: z.ZodObject<{
-    type: z.ZodLiteral<"password">;
-    ref: z.ZodString;
-    transport: z.ZodEnum<{
-        basic: "basic";
-        form: "form";
-    }>;
-    username: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export declare const loginAcquireSchema: z.ZodObject<{
-    type: z.ZodLiteral<"login">;
-    url: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export declare const acquireSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    type: z.ZodLiteral<"password">;
-    ref: z.ZodString;
-    transport: z.ZodEnum<{
-        basic: "basic";
-        form: "form";
-    }>;
-    username: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"login">;
-    url: z.ZodString;
-    label: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>], "type">;
-export type Acquire = z.infer<typeof acquireSchema>;
-export declare const ruleAuthSchema: z.ZodObject<{
-    requiredGrants: z.ZodArray<z.ZodString>;
-    issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        kid: z.ZodString;
-        alg: z.ZodLiteral<"EdDSA">;
-        publicKey: z.ZodString;
-        grantNamespaces: z.ZodArray<z.ZodString>;
-    }, z.core.$strip>>>;
-    acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        type: z.ZodLiteral<"password">;
-        ref: z.ZodString;
-        transport: z.ZodEnum<{
-            basic: "basic";
-            form: "form";
+        displayName: z.ZodString;
+        email: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            revoked: "revoked";
+            pending: "pending";
+            accepted: "accepted";
         }>;
-        username: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        type: z.ZodLiteral<"login">;
-        url: z.ZodString;
-        label: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>], "type">>>;
-}, z.core.$strip>;
-export type RuleAuth = z.infer<typeof ruleAuthSchema>;
-export declare const ruleMatchSchema: z.ZodObject<{
-    host: z.ZodOptional<z.ZodString>;
-    hostPattern: z.ZodOptional<z.ZodString>;
-    hostTemplate: z.ZodOptional<z.ZodString>;
-    pathPattern: z.ZodOptional<z.ZodString>;
-    channel: z.ZodOptional<z.ZodString>;
-    ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    agent: z.ZodOptional<z.ZodString>;
-    country: z.ZodOptional<z.ZodString>;
-    countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    header: z.ZodOptional<z.ZodObject<{
-        name: z.ZodString;
-        value: z.ZodString;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare const MANAGED_BY_VALUES: readonly ["sharing", "firewall", "file_share", "cast_reviewer", "team_default"];
-export declare const managedBySchema: z.ZodEnum<{
-    sharing: "sharing";
-    firewall: "firewall";
-    file_share: "file_share";
-    cast_reviewer: "cast_reviewer";
-    team_default: "team_default";
-}>;
-export type ManagedBy = z.infer<typeof managedBySchema>;
-export declare const runtimeRuleSchema: z.ZodObject<{
-    id: z.ZodOptional<z.ZodString>;
-    match: z.ZodDefault<z.ZodObject<{
-        host: z.ZodOptional<z.ZodString>;
-        hostPattern: z.ZodOptional<z.ZodString>;
-        hostTemplate: z.ZodOptional<z.ZodString>;
-        pathPattern: z.ZodOptional<z.ZodString>;
-        channel: z.ZodOptional<z.ZodString>;
-        ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        agent: z.ZodOptional<z.ZodString>;
-        country: z.ZodOptional<z.ZodString>;
-        countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        header: z.ZodOptional<z.ZodObject<{
-            name: z.ZodString;
-            value: z.ZodString;
+        grants: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            scope: z.ZodString;
+            role: z.ZodEnum<{
+                viewer: "viewer";
+                commenter: "commenter";
+                editor: "editor";
+                manager: "manager";
+            }>;
+            createdAt: z.ZodString;
+            revokedAt: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>>;
+        invitedBy: z.ZodNullable<z.ZodString>;
+        inviteExpiresAt: z.ZodNullable<z.ZodString>;
+        acceptedAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
     }, z.core.$strip>>;
-    effect: z.ZodEnum<{
-        allow: "allow";
-        deny: "deny";
-        challenge: "challenge";
-    }>;
-    auth: z.ZodOptional<z.ZodObject<{
-        requiredGrants: z.ZodArray<z.ZodString>;
-        issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            kid: z.ZodString;
-            alg: z.ZodLiteral<"EdDSA">;
-            publicKey: z.ZodString;
-            grantNamespaces: z.ZodArray<z.ZodString>;
-        }, z.core.$strip>>>;
-        acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"password">;
-            ref: z.ZodString;
-            transport: z.ZodEnum<{
-                basic: "basic";
-                form: "form";
-            }>;
-            username: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"login">;
-            url: z.ZodString;
-            label: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>], "type">>>;
+    inheritedTeamAccess: z.ZodNullable<z.ZodObject<{
+        teamId: z.ZodString;
+        teamName: z.ZodString;
+        ruleScopes: z.ZodArray<z.ZodString>;
+        members: z.ZodArray<z.ZodObject<{
+            membershipId: z.ZodString;
+            userId: z.ZodString;
+            displayName: z.ZodString;
+            email: z.ZodString;
+            teamRole: z.ZodString;
+            role: z.ZodLiteral<"editor">;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
-    managedBy: z.ZodOptional<z.ZodEnum<{
-        sharing: "sharing";
-        firewall: "firewall";
-        file_share: "file_share";
-        cast_reviewer: "cast_reviewer";
-        team_default: "team_default";
-    }>>;
-    expiresAt: z.ZodOptional<z.ZodNumber>;
-    reasonCode: z.ZodOptional<z.ZodString>;
-    message: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type RuntimeRule = z.infer<typeof runtimeRuleSchema>;
-export declare const ACCESS_TOKEN_KID = "spacefast-runtime-v1";
-export declare const ACCESS_TOKEN_ALG = "EdDSA";
-export declare const RUNTIME_JWKS_WELL_KNOWN_FILENAME = "spacefast-runtime-jwks.json";
-export declare const LOCAL_PW_TOKEN_KID = "spacefast-local-pw-v1";
-export declare const accessTokenPayloadSchema: z.ZodObject<{
-    sub: z.ZodString;
-    grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    exp: z.ZodNumber;
-    nbf: z.ZodOptional<z.ZodNumber>;
-    iat: z.ZodOptional<z.ZodNumber>;
-    iss: z.ZodOptional<z.ZodString>;
-    aud: z.ZodOptional<z.ZodString>;
-    sv: z.ZodOptional<z.ZodNumber>;
-    jti: z.ZodOptional<z.ZodString>;
-    room: z.ZodOptional<z.ZodString>;
-    anonymous_id: z.ZodOptional<z.ZodString>;
-    name: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>;
-export declare const authorizeRequestSchema: z.ZodObject<{
-    aud: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export declare const authorizeResponseSchema: z.ZodObject<{
-    token: z.ZodString;
-    payload: z.ZodObject<{
-        sub: z.ZodString;
-        grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        exp: z.ZodNumber;
-        nbf: z.ZodOptional<z.ZodNumber>;
-        iat: z.ZodOptional<z.ZodNumber>;
-        iss: z.ZodOptional<z.ZodString>;
-        aud: z.ZodOptional<z.ZodString>;
-        sv: z.ZodOptional<z.ZodNumber>;
-        jti: z.ZodOptional<z.ZodString>;
-        room: z.ZodOptional<z.ZodString>;
-        anonymous_id: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
-    expiresAt: z.ZodNumber;
-}, z.core.$strip>;
-export declare const accessEventSchema: z.ZodObject<{
-    sub: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    grantsHash: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    ruleId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    effect: z.ZodEnum<{
-        allow: "allow";
-        deny: "deny";
-        challenge: "challenge";
-    }>;
-    reasonCode: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    host: z.ZodString;
-    path: z.ZodString;
-    ts: z.ZodNumber;
 }, z.core.$strip>;
-export type AccessEvent = z.infer<typeof accessEventSchema>;
-export declare function spaceLevelGrant(spaceId: string, level: SpaceLevel): string;
-export declare function shareLinkGrant(linkId: string): string;
-export declare function inviteGrant(inviteId: string): string;
-export declare function serviceTokenGrant(tokenId: string): string;
-export declare const shareLinkSchema: z.ZodObject<{
+export type SpacePeopleList = z.infer<typeof spacePeopleListSchema>;
+export declare const accessShareLinkSchema: z.ZodObject<{
     id: z.ZodString;
     spaceId: z.ZodString;
-    label: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    path: z.ZodString;
-    createdBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    grantId: z.ZodString;
+    revision: z.ZodNumber;
+    name: z.ZodString;
+    landingPath: z.ZodString;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodString>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+    }>>;
+    constraints: z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+    createdBy: z.ZodNullable<z.ZodString>;
+    openCount: z.ZodNumber;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodString;
-    lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    useCount: z.ZodDefault<z.ZodNumber>;
     active: z.ZodBoolean;
 }, z.core.$strip>;
-export type ShareLink = z.infer<typeof shareLinkSchema>;
-export declare const shareLinkCreateSchema: z.ZodObject<{
-    path: z.ZodDefault<z.ZodString>;
-    expiresAt: z.ZodOptional<z.ZodNumber>;
-    label: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type ShareLinkCreate = z.infer<typeof shareLinkCreateSchema>;
-export declare const shareLinkWithUrlSchema: z.ZodObject<{
+export type AccessShareLink = z.infer<typeof accessShareLinkSchema>;
+export declare const accessShareLinkWithUrlSchema: z.ZodObject<{
     id: z.ZodString;
     spaceId: z.ZodString;
-    label: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    path: z.ZodString;
-    createdBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    grantId: z.ZodString;
+    revision: z.ZodNumber;
+    name: z.ZodString;
+    landingPath: z.ZodString;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodString>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+    }>>;
+    constraints: z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+    createdBy: z.ZodNullable<z.ZodString>;
+    openCount: z.ZodNumber;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodString;
-    lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    useCount: z.ZodDefault<z.ZodNumber>;
     active: z.ZodBoolean;
     url: z.ZodString;
 }, z.core.$strip>;
-export type ShareLinkWithUrl = z.infer<typeof shareLinkWithUrlSchema>;
-export declare const SPACE_VISIBILITIES: readonly ["public", "restricted"];
-export declare const spaceVisibilitySchema: z.ZodEnum<{
-    public: "public";
-    restricted: "restricted";
-}>;
-export type SpaceVisibility = z.infer<typeof spaceVisibilitySchema>;
-export declare const sharingConnectionAudienceSchema: z.ZodObject<{
-    connectionId: z.ZodString;
-    tag: z.ZodOptional<z.ZodString>;
-    emailDomain: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type SharingConnectionAudience = z.infer<typeof sharingConnectionAudienceSchema>;
-export declare const visibilityWriteSchema: z.ZodObject<{
-    visibility: z.ZodEnum<{
-        public: "public";
-        restricted: "restricted";
-    }>;
-}, z.core.$strip>;
-export declare const sharingPasswordWriteSchema: z.ZodObject<{
-    password: z.ZodString;
-}, z.core.$strip>;
-export declare const sharingAudiencesWriteSchema: z.ZodObject<{
-    audiences: z.ZodArray<z.ZodObject<{
-        connectionId: z.ZodString;
-        tag: z.ZodOptional<z.ZodString>;
-        emailDomain: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare const spaceProtectionWriteSchema: z.ZodObject<{
-    visibility: z.ZodEnum<{
-        public: "public";
-        restricted: "restricted";
-    }>;
-    password: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-}, z.core.$strip>;
-export type SpaceProtectionWrite = z.infer<typeof spaceProtectionWriteSchema>;
-export declare const sharingAudienceSchema: z.ZodObject<{
-    connectionId: z.ZodString;
-    type: z.ZodEnum<{
-        external: "external";
-        oidc: "oidc";
-    }>;
-    name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    tag: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    emailDomain: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    grant: z.ZodString;
-}, z.core.$strip>;
-export type SharingAudience = z.infer<typeof sharingAudienceSchema>;
-export declare const sharingPersonSchema: z.ZodObject<{
-    kind: z.ZodEnum<{
-        team_member: "team_member";
-        invitee: "invitee";
-    }>;
-    userId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    email: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    teamRole: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    level: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
-        viewer: "viewer";
-        commenter: "commenter";
-        editor: "editor";
-        admin: "admin";
-    }>>>;
-    inviteId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    status: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
-        expired: "expired";
-        pending: "pending";
-        accepted: "accepted";
-    }>>>;
-    lastViewedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-}, z.core.$strip>;
-export type SharingPerson = z.infer<typeof sharingPersonSchema>;
-export declare const INVITE_ACCEPT_LINK_TTL_SECONDS: number;
-export declare const INVITE_TOKEN_TTL_SECONDS: number;
-export declare const ACCESS_MESSAGE_MAX_LENGTH = 280;
-export declare const INVITE_STATUSES: readonly ["pending", "accepted", "expired", "revoked"];
-export declare const inviteStatusSchema: z.ZodEnum<{
-    expired: "expired";
-    pending: "pending";
-    accepted: "accepted";
-    revoked: "revoked";
-}>;
-export type InviteStatus = z.infer<typeof inviteStatusSchema>;
-export declare const spaceInviteSchema: z.ZodObject<{
+export type AccessShareLinkWithUrl = z.infer<typeof accessShareLinkWithUrlSchema>;
+export declare const accessShareLinkReadSchema: z.ZodObject<{
     id: z.ZodString;
     spaceId: z.ZodString;
-    email: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    invitedBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    message: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    status: z.ZodEnum<{
-        expired: "expired";
-        pending: "pending";
-        accepted: "accepted";
-        revoked: "revoked";
-    }>;
-    expiresAt: z.ZodNumber;
-    acceptedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    grantId: z.ZodString;
+    revision: z.ZodNumber;
+    name: z.ZodString;
+    landingPath: z.ZodString;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodString>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+    }>>;
+    constraints: z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">;
+    createdBy: z.ZodNullable<z.ZodString>;
+    openCount: z.ZodNumber;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodString;
-    lastViewedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    active: z.ZodBoolean;
+    url: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
-export type SpaceInvite = z.infer<typeof spaceInviteSchema>;
-export declare const spaceInviteCreateSchema: z.ZodObject<{
-    email: z.ZodString;
-    message: z.ZodOptional<z.ZodString>;
+export type AccessShareLinkRead = z.infer<typeof accessShareLinkReadSchema>;
+export declare const publishedAccessSchema: z.ZodObject<{
+    url: z.ZodString;
+    token: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
-export declare const ACCESS_REQUEST_STATUSES: readonly ["pending", "approved", "denied"];
-export declare const accessRequestStatusSchema: z.ZodEnum<{
+export type PublishedAccess = z.infer<typeof publishedAccessSchema>;
+export declare const canonicalAccessRequestStatusSchema: z.ZodEnum<{
+    canceled: "canceled";
+    expired: "expired";
     pending: "pending";
+    verification_pending: "verification_pending";
     approved: "approved";
     denied: "denied";
 }>;
-export declare const accessRequestSchema: z.ZodObject<{
+export declare const accessRequestRoleSchema: z.ZodEnum<{
+    viewer: "viewer";
+    commenter: "commenter";
+    editor: "editor";
+    manager: "manager";
+}>;
+export type AccessRequestRole = z.infer<typeof accessRequestRoleSchema>;
+export declare const canonicalAccessRequestSchema: z.ZodObject<{
     id: z.ZodString;
     spaceId: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
     email: z.ZodString;
-    userId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    host: z.ZodString;
-    path: z.ZodString;
-    message: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    scope: z.ZodString;
+    requestedRole: z.ZodEnum<{
+        viewer: "viewer";
+        commenter: "commenter";
+        editor: "editor";
+        manager: "manager";
+    }>;
+    message: z.ZodNullable<z.ZodString>;
     status: z.ZodEnum<{
+        canceled: "canceled";
+        expired: "expired";
         pending: "pending";
+        verification_pending: "verification_pending";
         approved: "approved";
         denied: "denied";
     }>;
-    resolvedBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    resolvedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    emailVerifiedAt: z.ZodNullable<z.ZodString>;
+    resolvedBy: z.ZodNullable<z.ZodString>;
+    resolvedAt: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodString;
-}, z.core.$strip>;
-export type AccessRequest = z.infer<typeof accessRequestSchema>;
-export declare const accessRequestCreateSchema: z.ZodObject<{
-    space: z.ZodString;
-    host: z.ZodString;
-    path: z.ZodDefault<z.ZodString>;
-    nonce: z.ZodOptional<z.ZodString>;
-    message: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export declare const accessRequestApproveSchema: z.ZodObject<{
-    as: z.ZodDefault<z.ZodEnum<{
-        team: "team";
-        invite: "invite";
-    }>>;
-}, z.core.$strip>;
-export declare const FILE_SHARE_AUDIENCES: readonly ["public", "people"];
-export declare const fileShareAudienceSchema: z.ZodEnum<{
-    public: "public";
-    people: "people";
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type CanonicalAccessRequest = z.infer<typeof canonicalAccessRequestSchema>;
+export declare const accessFenceKindValues: readonly ["none", "ownership", "exposure"];
+export declare const accessFenceKindSchema: z.ZodEnum<{
+    none: "none";
+    ownership: "ownership";
+    exposure: "exposure";
 }>;
-export type FileShareAudience = z.infer<typeof fileShareAudienceSchema>;
-export declare const fileShareSchema: z.ZodObject<{
-    path: z.ZodString;
-    audience: z.ZodEnum<{
-        public: "public";
-        people: "people";
-    }>;
-    grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    patterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export type FileShare = z.infer<typeof fileShareSchema>;
-export declare const fileShareWriteSchema: z.ZodObject<{
-    path: z.ZodString;
-    audience: z.ZodEnum<{
-        public: "public";
-        people: "people";
-    }>;
-    grants: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export declare const sharingRequestSchema: z.ZodObject<{
-    id: z.ZodString;
+export type AccessFenceKind = z.infer<typeof accessFenceKindSchema>;
+export declare const ACCESS_GRANT_SCOPE_LIMIT = 32;
+export declare const linkCapabilitiesSchema: z.ZodArray<z.ZodEnum<{
+    "page.view": "page.view";
+    "comments.read": "comments.read";
+    "comments.write": "comments.write";
+}>>;
+export type LinkCapabilities = z.infer<typeof linkCapabilitiesSchema>;
+export declare const spacePersonInviteWriteSchema: z.ZodObject<{
     email: z.ZodString;
-    message: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    createdAt: z.ZodString;
-    host: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    path: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-}, z.core.$strip>;
-export type SharingRequest = z.infer<typeof sharingRequestSchema>;
-export declare const SERVICE_TOKEN_DEFAULT_TTL_SECONDS: number;
-export declare const SERVICE_TOKEN_AUDIENCES: readonly ["viewers"];
-export declare const serviceTokenAudienceSchema: z.ZodEnum<{
-    viewers: "viewers";
-}>;
-export declare const serviceTokenActsAsSchema: z.ZodObject<{
-    audiences: z.ZodDefault<z.ZodArray<z.ZodEnum<{
-        viewers: "viewers";
-    }>>>;
-}, z.core.$strip>;
-export type ServiceTokenActsAs = z.infer<typeof serviceTokenActsAsSchema>;
-export declare const serviceTokenSchema: z.ZodObject<{
-    id: z.ZodString;
-    teamId: z.ZodString;
-    spaceId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    name: z.ZodString;
-    actsAs: z.ZodObject<{
-        audiences: z.ZodDefault<z.ZodArray<z.ZodEnum<{
-            viewers: "viewers";
-        }>>>;
-    }, z.core.$strip>;
-    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
-    lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    createdAt: z.ZodString;
-    active: z.ZodBoolean;
-}, z.core.$strip>;
-export type ServiceToken = z.infer<typeof serviceTokenSchema>;
-export declare const serviceTokenCreateSchema: z.ZodObject<{
-    name: z.ZodString;
-    spaceId: z.ZodOptional<z.ZodString>;
-    expiresAt: z.ZodOptional<z.ZodNumber>;
-    actsAs: z.ZodOptional<z.ZodObject<{
-        audiences: z.ZodDefault<z.ZodArray<z.ZodEnum<{
-            viewers: "viewers";
-        }>>>;
+    grants: z.ZodArray<z.ZodObject<{
+        scope: z.ZodString;
+        role: z.ZodEnum<{
+            viewer: "viewer";
+            commenter: "commenter";
+            editor: "editor";
+            manager: "manager";
+        }>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
-export type ServiceTokenCreate = z.infer<typeof serviceTokenCreateSchema>;
-export declare const serviceTokenWithSecretSchema: z.ZodObject<{
-    id: z.ZodString;
-    teamId: z.ZodString;
-    spaceId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    name: z.ZodString;
-    actsAs: z.ZodObject<{
-        audiences: z.ZodDefault<z.ZodArray<z.ZodEnum<{
-            viewers: "viewers";
-        }>>>;
-    }, z.core.$strip>;
-    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
-    lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    createdAt: z.ZodString;
-    active: z.ZodBoolean;
-    token: z.ZodString;
-}, z.core.$strip>;
-export type ServiceTokenWithSecret = z.infer<typeof serviceTokenWithSecretSchema>;
-export declare const FIREWALL_EFFECTS: readonly ["deny", "challenge"];
-export declare const firewallEffectSchema: z.ZodEnum<{
-    deny: "deny";
-    challenge: "challenge";
-}>;
-export type FirewallEffect = z.infer<typeof firewallEffectSchema>;
-export declare const firewallCountriesSchema: z.ZodObject<{
-    mode: z.ZodEnum<{
-        allow: "allow";
-        block: "block";
+export declare const personGrantWriteSchema: z.ZodObject<{
+    scope: z.ZodString;
+    role: z.ZodEnum<{
+        viewer: "viewer";
+        commenter: "commenter";
+        editor: "editor";
+        manager: "manager";
     }>;
-    list: z.ZodArray<z.ZodString>;
-    effect: z.ZodDefault<z.ZodEnum<{
-        deny: "deny";
-        challenge: "challenge";
-    }>>;
-}, z.core.$strip>;
-export type FirewallCountries = z.infer<typeof firewallCountriesSchema>;
-export declare const firewallIpEntrySchema: z.ZodObject<{
-    cidr: z.ZodString;
-    effect: z.ZodDefault<z.ZodEnum<{
-        deny: "deny";
-        challenge: "challenge";
-    }>>;
 }, z.core.$strip>;
-export type FirewallIpEntry = z.infer<typeof firewallIpEntrySchema>;
-export declare const firewallBotEntrySchema: z.ZodObject<{
-    agent: z.ZodString;
-    effect: z.ZodDefault<z.ZodEnum<{
-        deny: "deny";
-        challenge: "challenge";
-    }>>;
-}, z.core.$strip>;
-export type FirewallBotEntry = z.infer<typeof firewallBotEntrySchema>;
-export declare const firewallWriteSchema: z.ZodObject<{
-    countries: z.ZodDefault<z.ZodNullable<z.ZodObject<{
-        mode: z.ZodEnum<{
-            allow: "allow";
-            block: "block";
-        }>;
-        list: z.ZodArray<z.ZodString>;
-        effect: z.ZodDefault<z.ZodEnum<{
-            deny: "deny";
-            challenge: "challenge";
-        }>>;
-    }, z.core.$strip>>>;
-    ipCidrs: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        cidr: z.ZodString;
-        effect: z.ZodDefault<z.ZodEnum<{
-            deny: "deny";
-            challenge: "challenge";
-        }>>;
-    }, z.core.$strip>>>;
-    bots: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        agent: z.ZodString;
-        effect: z.ZodDefault<z.ZodEnum<{
-            deny: "deny";
-            challenge: "challenge";
-        }>>;
-    }, z.core.$strip>>>;
-}, z.core.$strip>;
-export type FirewallWrite = z.infer<typeof firewallWriteSchema>;
-export declare const spaceFirewallSchema: z.ZodObject<{
-    countries: z.ZodDefault<z.ZodNullable<z.ZodObject<{
-        mode: z.ZodEnum<{
-            allow: "allow";
-            block: "block";
-        }>;
-        list: z.ZodArray<z.ZodString>;
-        effect: z.ZodDefault<z.ZodEnum<{
-            deny: "deny";
-            challenge: "challenge";
-        }>>;
-    }, z.core.$strip>>>;
-    ipCidrs: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        cidr: z.ZodString;
-        effect: z.ZodDefault<z.ZodEnum<{
-            deny: "deny";
-            challenge: "challenge";
-        }>>;
-    }, z.core.$strip>>>;
-    bots: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        agent: z.ZodString;
-        effect: z.ZodDefault<z.ZodEnum<{
-            deny: "deny";
-            challenge: "challenge";
-        }>>;
-    }, z.core.$strip>>>;
-    custom: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip>;
-export type SpaceFirewall = z.infer<typeof spaceFirewallSchema>;
-export declare const TEAM_PREVIEW_LOCK_LIVE_RULE_ID = "team-preview-lock:live";
-export declare const TEAM_PREVIEW_LOCK_RULE_ID = "team-preview-lock";
-export declare function teamPreviewLockRules(teamId: string): RuntimeRule[];
-export declare function isTeamPreviewLockRule(rule: Pick<RuntimeRule, "id">): boolean;
-export declare function teamPreviewLockActive(rules: ReadonlyArray<Pick<RuntimeRule, "id">>): boolean;
-export declare function withTeamPreviewLock(rules: RuntimeRule[], teamId: string, enabled: boolean): RuntimeRule[];
-export declare const spaceSharingSchema: z.ZodObject<{
-    visibility: z.ZodEnum<{
-        public: "public";
-        restricted: "restricted";
-    }>;
-    hasPassword: z.ZodBoolean;
-    people: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        kind: z.ZodEnum<{
-            team_member: "team_member";
-            invitee: "invitee";
-        }>;
-        userId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        email: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        teamRole: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        level: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+export declare const spacePersonGrantSetWriteSchema: z.ZodObject<{
+    grants: z.ZodArray<z.ZodObject<{
+        scope: z.ZodString;
+        role: z.ZodEnum<{
             viewer: "viewer";
             commenter: "commenter";
             editor: "editor";
-            admin: "admin";
-        }>>>;
-        inviteId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        status: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
-            expired: "expired";
-            pending: "pending";
-            accepted: "accepted";
-        }>>>;
-        lastViewedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    }, z.core.$strip>>>;
-    audiences: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        connectionId: z.ZodString;
-        type: z.ZodEnum<{
-            external: "external";
-            oidc: "oidc";
+            manager: "manager";
         }>;
-        name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        tag: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        emailDomain: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        grant: z.ZodString;
-    }, z.core.$strip>>>;
-    links: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        spaceId: z.ZodString;
-        label: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        path: z.ZodString;
-        createdBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
-        createdAt: z.ZodString;
-        lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        useCount: z.ZodDefault<z.ZodNumber>;
-        active: z.ZodBoolean;
-    }, z.core.$strip>>>;
-    fileShares: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        path: z.ZodString;
-        audience: z.ZodEnum<{
-            public: "public";
-            people: "people";
-        }>;
-        grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        patterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>>>;
-    requests: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        email: z.ZodString;
-        message: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        createdAt: z.ZodString;
-        host: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        path: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    }, z.core.$strip>>>;
-    customRulesActive: z.ZodBoolean;
-    accessExceedsPlan: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
-export type SpaceSharing = z.infer<typeof spaceSharingSchema>;
-export declare const channelSchema: z.ZodObject<{
+export declare const accessShareLinkCreateSchema: z.ZodObject<{
     name: z.ZodString;
-    versionId: z.ZodString;
-    history: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        versionId: z.ZodString;
-        at: z.ZodString;
-    }, z.core.$strip>>>;
-}, z.core.$strip>;
-export type Channel = z.infer<typeof channelSchema>;
-export declare const servingConfigSchema: z.ZodObject<{
-    index: z.ZodOptional<z.ZodString>;
-    fallback: z.ZodOptional<z.ZodString>;
-    listing: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-export declare const policyDocSchema: z.ZodObject<{
-    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        match: z.ZodDefault<z.ZodObject<{
-            host: z.ZodOptional<z.ZodString>;
-            hostPattern: z.ZodOptional<z.ZodString>;
-            hostTemplate: z.ZodOptional<z.ZodString>;
-            pathPattern: z.ZodOptional<z.ZodString>;
-            channel: z.ZodOptional<z.ZodString>;
-            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            agent: z.ZodOptional<z.ZodString>;
-            country: z.ZodOptional<z.ZodString>;
-            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            header: z.ZodOptional<z.ZodObject<{
-                name: z.ZodString;
-                value: z.ZodString;
-            }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        effect: z.ZodEnum<{
-            allow: "allow";
-            deny: "deny";
-            challenge: "challenge";
-        }>;
-        auth: z.ZodOptional<z.ZodObject<{
-            requiredGrants: z.ZodArray<z.ZodString>;
-            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                kid: z.ZodString;
-                alg: z.ZodLiteral<"EdDSA">;
-                publicKey: z.ZodString;
-                grantNamespaces: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>>>;
-            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"password">;
-                ref: z.ZodString;
-                transport: z.ZodEnum<{
-                    basic: "basic";
-                    form: "form";
-                }>;
-                username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>, z.ZodObject<{
-                type: z.ZodLiteral<"login">;
-                url: z.ZodString;
-                label: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>], "type">>>;
-        }, z.core.$strip>>;
-        managedBy: z.ZodOptional<z.ZodEnum<{
-            sharing: "sharing";
-            firewall: "firewall";
-            file_share: "file_share";
-            cast_reviewer: "cast_reviewer";
-            team_default: "team_default";
-        }>>;
-        expiresAt: z.ZodOptional<z.ZodNumber>;
-        reasonCode: z.ZodOptional<z.ZodString>;
-        message: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
-    issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        kid: z.ZodString;
-        alg: z.ZodLiteral<"EdDSA">;
-        publicKey: z.ZodString;
-        grantNamespaces: z.ZodArray<z.ZodString>;
-    }, z.core.$strip>>>;
-    sessionVersion: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-export type PolicyDoc = z.infer<typeof policyDocSchema>;
-export declare const spacePolicySchema: z.ZodObject<{
-    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        match: z.ZodDefault<z.ZodObject<{
-            host: z.ZodOptional<z.ZodString>;
-            hostPattern: z.ZodOptional<z.ZodString>;
-            hostTemplate: z.ZodOptional<z.ZodString>;
-            pathPattern: z.ZodOptional<z.ZodString>;
-            channel: z.ZodOptional<z.ZodString>;
-            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            agent: z.ZodOptional<z.ZodString>;
-            country: z.ZodOptional<z.ZodString>;
-            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            header: z.ZodOptional<z.ZodObject<{
-                name: z.ZodString;
-                value: z.ZodString;
-            }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        effect: z.ZodEnum<{
-            allow: "allow";
-            deny: "deny";
-            challenge: "challenge";
-        }>;
-        auth: z.ZodOptional<z.ZodObject<{
-            requiredGrants: z.ZodArray<z.ZodString>;
-            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                kid: z.ZodString;
-                alg: z.ZodLiteral<"EdDSA">;
-                publicKey: z.ZodString;
-                grantNamespaces: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>>>;
-            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"password">;
-                ref: z.ZodString;
-                transport: z.ZodEnum<{
-                    basic: "basic";
-                    form: "form";
-                }>;
-                username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>, z.ZodObject<{
-                type: z.ZodLiteral<"login">;
-                url: z.ZodString;
-                label: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>], "type">>>;
-        }, z.core.$strip>>;
-        managedBy: z.ZodOptional<z.ZodEnum<{
-            sharing: "sharing";
-            firewall: "firewall";
-            file_share: "file_share";
-            cast_reviewer: "cast_reviewer";
-            team_default: "team_default";
-        }>>;
-        expiresAt: z.ZodOptional<z.ZodNumber>;
-        reasonCode: z.ZodOptional<z.ZodString>;
-        message: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
-    version: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>;
-export type SpacePolicy = z.infer<typeof spacePolicySchema>;
-export declare const spaceAccessRulesWriteSchema: z.ZodObject<{
-    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        match: z.ZodDefault<z.ZodObject<{
-            host: z.ZodOptional<z.ZodString>;
-            hostPattern: z.ZodOptional<z.ZodString>;
-            hostTemplate: z.ZodOptional<z.ZodString>;
-            pathPattern: z.ZodOptional<z.ZodString>;
-            channel: z.ZodOptional<z.ZodString>;
+    landingPath: z.ZodDefault<z.ZodString>;
+    resources: z.ZodObject<{
+        include: z.ZodArray<z.ZodString>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+    }>>>;
+    constraints: z.ZodDefault<z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        maxUses: z.ZodOptional<z.ZodNumber>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
+        network: z.ZodOptional<z.ZodObject<{
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            agent: z.ZodOptional<z.ZodString>;
-            country: z.ZodOptional<z.ZodString>;
-            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            header: z.ZodOptional<z.ZodObject<{
-                name: z.ZodString;
-                value: z.ZodString;
-            }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        effect: z.ZodEnum<{
-            allow: "allow";
-            deny: "deny";
-            challenge: "challenge";
-        }>;
-        auth: z.ZodOptional<z.ZodObject<{
-            requiredGrants: z.ZodArray<z.ZodString>;
-            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                kid: z.ZodString;
-                alg: z.ZodLiteral<"EdDSA">;
-                publicKey: z.ZodString;
-                grantNamespaces: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>>>;
-            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"password">;
-                ref: z.ZodString;
-                transport: z.ZodEnum<{
-                    basic: "basic";
-                    form: "form";
-                }>;
-                username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>, z.ZodObject<{
-                type: z.ZodLiteral<"login">;
-                url: z.ZodString;
-                label: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>], "type">>>;
-        }, z.core.$strip>>;
-        managedBy: z.ZodOptional<z.ZodEnum<{
-            sharing: "sharing";
-            firewall: "firewall";
-            file_share: "file_share";
-            cast_reviewer: "cast_reviewer";
-            team_default: "team_default";
-        }>>;
-        expiresAt: z.ZodOptional<z.ZodNumber>;
-        reasonCode: z.ZodOptional<z.ZodString>;
-        message: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
-    expectedVersion: z.ZodOptional<z.ZodNumber>;
+            countries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    target: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strip>;
+export declare const accessShareLinkUpdateSchema: z.ZodObject<{
+    expectedRevision: z.ZodNumber;
+    name: z.ZodOptional<z.ZodString>;
+    landingPath: z.ZodOptional<z.ZodString>;
+    resources: z.ZodOptional<z.ZodObject<{
+        include: z.ZodArray<z.ZodString>;
+        exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "page.view": "page.view";
+        "comments.read": "comments.read";
+        "comments.write": "comments.write";
+    }>>>;
+    constraints: z.ZodOptional<z.ZodObject<{
+        notBefore: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        maxUses: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        requireVerifiedEmail: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        network: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            ipCidrs: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            countries: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            excludedCountries: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            excludedUserAgentSubstrings: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    target: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"live">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"version">;
+        versionId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"branch">;
+        branch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"all_versions">;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strip>;
+export declare const canonicalAccessRequestCreateSchema: z.ZodObject<{
+    email: z.ZodString;
+    scope: z.ZodString;
+    requestedRole: z.ZodDefault<z.ZodEnum<{
+        viewer: "viewer";
+        commenter: "commenter";
+        editor: "editor";
+        manager: "manager";
+    }>>;
+    message: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-export type SpaceAccessRulesWrite = z.infer<typeof spaceAccessRulesWriteSchema>;
-export declare const spaceAccessRulesReadSchema: z.ZodObject<{
-    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        match: z.ZodDefault<z.ZodObject<{
-            host: z.ZodOptional<z.ZodString>;
-            hostPattern: z.ZodOptional<z.ZodString>;
-            hostTemplate: z.ZodOptional<z.ZodString>;
-            pathPattern: z.ZodOptional<z.ZodString>;
-            channel: z.ZodOptional<z.ZodString>;
-            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            agent: z.ZodOptional<z.ZodString>;
-            country: z.ZodOptional<z.ZodString>;
-            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            header: z.ZodOptional<z.ZodObject<{
-                name: z.ZodString;
-                value: z.ZodString;
-            }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        effect: z.ZodEnum<{
-            allow: "allow";
-            deny: "deny";
-            challenge: "challenge";
-        }>;
-        auth: z.ZodOptional<z.ZodObject<{
-            requiredGrants: z.ZodArray<z.ZodString>;
-            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                kid: z.ZodString;
-                alg: z.ZodLiteral<"EdDSA">;
-                publicKey: z.ZodString;
-                grantNamespaces: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>>>;
-            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"password">;
-                ref: z.ZodString;
-                transport: z.ZodEnum<{
-                    basic: "basic";
-                    form: "form";
-                }>;
-                username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>, z.ZodObject<{
-                type: z.ZodLiteral<"login">;
-                url: z.ZodString;
-                label: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>], "type">>>;
-        }, z.core.$strip>>;
-        managedBy: z.ZodOptional<z.ZodEnum<{
-            sharing: "sharing";
-            firewall: "firewall";
-            file_share: "file_share";
-            cast_reviewer: "cast_reviewer";
-            team_default: "team_default";
-        }>>;
-        expiresAt: z.ZodOptional<z.ZodNumber>;
-        reasonCode: z.ZodOptional<z.ZodString>;
-        message: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
-    version: z.ZodDefault<z.ZodNumber>;
-    accessExceedsPlan: z.ZodDefault<z.ZodBoolean>;
+export declare const canonicalAccessRequestApproveSchema: z.ZodObject<{
+    scope: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodEnum<{
+        viewer: "viewer";
+        commenter: "commenter";
+        editor: "editor";
+        manager: "manager";
+    }>>;
 }, z.core.$strip>;
-export type SpaceAccessRulesRead = z.infer<typeof spaceAccessRulesReadSchema>;
-export declare const quickShareSchema: z.ZodObject<{
-    kind: z.ZodLiteral<"quick_share">;
+export declare const openHandoffSchema: z.ZodObject<{
     url: z.ZodString;
     expiresAt: z.ZodString;
-    outcome: z.ZodEnum<{
-        created: "created";
-        reused: "reused";
-    }>;
-}, z.core.$strip>;
-export type QuickShare = z.infer<typeof quickShareSchema>;
-export declare const quickShareDeleteSchema: z.ZodObject<{
-    outcome: z.ZodEnum<{
-        deleted: "deleted";
-        unchanged: "unchanged";
+    kind: z.ZodEnum<{
+        management: "management";
+        person: "person";
+        claim_preview: "claim_preview";
     }>;
 }, z.core.$strip>;
-export type QuickShareDelete = z.infer<typeof quickShareDeleteSchema>;
-export declare const enhancementsSchema: z.ZodObject<{
-    enabled: z.ZodBoolean;
-    active: z.ZodArray<z.ZodString>;
-}, z.core.$strip>;
-export type Enhancements = z.infer<typeof enhancementsSchema>;
-export declare const enhancementsWriteSchema: z.ZodObject<{
-    enabled: z.ZodBoolean;
+export declare const openLinkSchema: z.ZodObject<{
+    url: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    kind: z.ZodLiteral<"link">;
 }, z.core.$strip>;
-export type EnhancementsWrite = z.infer<typeof enhancementsWriteSchema>;
-export declare const ruleSourceSchema: z.ZodEnum<{
-    cloud: "cloud";
-    file: "file";
-    platform: "platform";
-}>;
-export declare const effectiveRuleSchema: z.ZodObject<{
-    id: z.ZodOptional<z.ZodString>;
-    match: z.ZodDefault<z.ZodObject<{
-        host: z.ZodOptional<z.ZodString>;
-        hostPattern: z.ZodOptional<z.ZodString>;
-        hostTemplate: z.ZodOptional<z.ZodString>;
-        pathPattern: z.ZodOptional<z.ZodString>;
-        channel: z.ZodOptional<z.ZodString>;
-        ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        agent: z.ZodOptional<z.ZodString>;
-        country: z.ZodOptional<z.ZodString>;
-        countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        header: z.ZodOptional<z.ZodObject<{
-            name: z.ZodString;
-            value: z.ZodString;
-        }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    effect: z.ZodEnum<{
-        allow: "allow";
-        deny: "deny";
-        challenge: "challenge";
+export declare const privateOpenSchema: z.ZodUnion<readonly [z.ZodObject<{
+    url: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    kind: z.ZodLiteral<"link">;
+}, z.core.$strip>, z.ZodObject<{
+    url: z.ZodString;
+    expiresAt: z.ZodString;
+    kind: z.ZodEnum<{
+        management: "management";
+        person: "person";
+        claim_preview: "claim_preview";
     }>;
-    auth: z.ZodOptional<z.ZodObject<{
-        requiredGrants: z.ZodArray<z.ZodString>;
-        issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            kid: z.ZodString;
-            alg: z.ZodLiteral<"EdDSA">;
-            publicKey: z.ZodString;
-            grantNamespaces: z.ZodArray<z.ZodString>;
-        }, z.core.$strip>>>;
-        acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"password">;
-            ref: z.ZodString;
-            transport: z.ZodEnum<{
-                basic: "basic";
-                form: "form";
-            }>;
-            username: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"login">;
-            url: z.ZodString;
-            label: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>], "type">>>;
-    }, z.core.$strip>>;
-    managedBy: z.ZodOptional<z.ZodEnum<{
-        sharing: "sharing";
-        firewall: "firewall";
-        file_share: "file_share";
-        cast_reviewer: "cast_reviewer";
-        team_default: "team_default";
-    }>>;
-    expiresAt: z.ZodOptional<z.ZodNumber>;
-    reasonCode: z.ZodOptional<z.ZodString>;
-    message: z.ZodOptional<z.ZodString>;
-    source: z.ZodEnum<{
-        cloud: "cloud";
-        file: "file";
-        platform: "platform";
+}, z.core.$strip>]>;
+export declare const openHandoffCreateSchema: z.ZodObject<{
+    landingPath: z.ZodDefault<z.ZodString>;
+    targetHost: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type OpenHandoff = z.infer<typeof openHandoffSchema>;
+export type OpenLink = z.infer<typeof openLinkSchema>;
+export type PrivateOpen = z.infer<typeof privateOpenSchema>;
+export declare const teamSpaceAccessDefaultSchema: z.ZodObject<{
+    newSpaceGrantPreset: z.ZodEnum<{
+        team: "team";
+        public: "public";
+        private: "private";
     }>;
-    order: z.ZodNumber;
 }, z.core.$strip>;
-export type EffectiveRule = z.infer<typeof effectiveRuleSchema>;
-export declare const effectivePolicySchema: z.ZodObject<{
-    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        match: z.ZodDefault<z.ZodObject<{
-            host: z.ZodOptional<z.ZodString>;
-            hostPattern: z.ZodOptional<z.ZodString>;
-            hostTemplate: z.ZodOptional<z.ZodString>;
-            pathPattern: z.ZodOptional<z.ZodString>;
-            channel: z.ZodOptional<z.ZodString>;
-            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            agent: z.ZodOptional<z.ZodString>;
-            country: z.ZodOptional<z.ZodString>;
-            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            header: z.ZodOptional<z.ZodObject<{
-                name: z.ZodString;
-                value: z.ZodString;
-            }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        effect: z.ZodEnum<{
-            allow: "allow";
-            deny: "deny";
-            challenge: "challenge";
-        }>;
-        auth: z.ZodOptional<z.ZodObject<{
-            requiredGrants: z.ZodArray<z.ZodString>;
-            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                kid: z.ZodString;
-                alg: z.ZodLiteral<"EdDSA">;
-                publicKey: z.ZodString;
-                grantNamespaces: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>>>;
-            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"password">;
-                ref: z.ZodString;
-                transport: z.ZodEnum<{
-                    basic: "basic";
-                    form: "form";
-                }>;
-                username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>, z.ZodObject<{
-                type: z.ZodLiteral<"login">;
-                url: z.ZodString;
-                label: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>], "type">>>;
-        }, z.core.$strip>>;
-        managedBy: z.ZodOptional<z.ZodEnum<{
-            sharing: "sharing";
-            firewall: "firewall";
-            file_share: "file_share";
-            cast_reviewer: "cast_reviewer";
-            team_default: "team_default";
-        }>>;
-        expiresAt: z.ZodOptional<z.ZodNumber>;
-        reasonCode: z.ZodOptional<z.ZodString>;
-        message: z.ZodOptional<z.ZodString>;
-        source: z.ZodEnum<{
-            cloud: "cloud";
-            file: "file";
-            platform: "platform";
-        }>;
-        order: z.ZodNumber;
-    }, z.core.$strip>>>;
-    issuers: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        kid: z.ZodString;
-        alg: z.ZodLiteral<"EdDSA">;
-        publicKey: z.ZodString;
-        grantNamespaces: z.ZodArray<z.ZodString>;
-    }, z.core.$strip>>>;
-    cloudVersion: z.ZodDefault<z.ZodNumber>;
-    fileVersion: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    secrets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
-    sessionVersion: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>;
-export type EffectivePolicy = z.infer<typeof effectivePolicySchema>;
-export declare const accessSimulateResultSchema: z.ZodObject<{
-    verdict: z.ZodEnum<{
-        allow: "allow";
-        deny: "deny";
-        challenge: "challenge";
+export declare const teamSpaceAccessDefaultWriteSchema: z.ZodObject<{
+    newSpaceGrantPreset: z.ZodEnum<{
+        team: "team";
+        public: "public";
+        private: "private";
     }>;
-    matchedRule: z.ZodDefault<z.ZodNullable<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        match: z.ZodDefault<z.ZodObject<{
-            host: z.ZodOptional<z.ZodString>;
-            hostPattern: z.ZodOptional<z.ZodString>;
-            hostTemplate: z.ZodOptional<z.ZodString>;
-            pathPattern: z.ZodOptional<z.ZodString>;
-            channel: z.ZodOptional<z.ZodString>;
-            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            agent: z.ZodOptional<z.ZodString>;
-            country: z.ZodOptional<z.ZodString>;
-            countryNotIn: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            header: z.ZodOptional<z.ZodObject<{
-                name: z.ZodString;
-                value: z.ZodString;
-            }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        effect: z.ZodEnum<{
-            allow: "allow";
-            deny: "deny";
-            challenge: "challenge";
-        }>;
-        auth: z.ZodOptional<z.ZodObject<{
-            requiredGrants: z.ZodArray<z.ZodString>;
-            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                kid: z.ZodString;
-                alg: z.ZodLiteral<"EdDSA">;
-                publicKey: z.ZodString;
-                grantNamespaces: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>>>;
-            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"password">;
-                ref: z.ZodString;
-                transport: z.ZodEnum<{
-                    basic: "basic";
-                    form: "form";
-                }>;
-                username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>, z.ZodObject<{
-                type: z.ZodLiteral<"login">;
-                url: z.ZodString;
-                label: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>], "type">>>;
-        }, z.core.$strip>>;
-        managedBy: z.ZodOptional<z.ZodEnum<{
-            sharing: "sharing";
-            firewall: "firewall";
-            file_share: "file_share";
-            cast_reviewer: "cast_reviewer";
-            team_default: "team_default";
-        }>>;
-        expiresAt: z.ZodOptional<z.ZodNumber>;
-        reasonCode: z.ZodOptional<z.ZodString>;
-        message: z.ZodOptional<z.ZodString>;
-        source: z.ZodEnum<{
-            cloud: "cloud";
-            file: "file";
-            platform: "platform";
-        }>;
-        order: z.ZodNumber;
-    }, z.core.$strip>>>;
-    why: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    whoWouldPass: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
-export type AccessSimulateResult = z.infer<typeof accessSimulateResultSchema>;
+export declare const ACCESS_TOKEN_KID = "spacefast-runtime-v1";
+export declare const ACCESS_TOKEN_ALG = "EdDSA";
+export declare const RUNTIME_JWKS_WELL_KNOWN_FILENAME = "spacefast-runtime-jwks.json";
+export declare const accessTokenPublicProfileSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    avatar_url: z.ZodOptional<z.ZodURL>;
+}, z.core.$strict>;
+export type AccessTokenPublicProfile = z.infer<typeof accessTokenPublicProfileSchema>;
+export declare const accessTokenPayloadSchema: z.ZodObject<{
+    sub: z.ZodString;
+    principal: z.ZodOptional<z.ZodString>;
+    authorities: z.ZodArray<z.ZodString>;
+    exp: z.ZodNumber;
+    nbf: z.ZodNumber;
+    iat: z.ZodNumber;
+    iss: z.ZodString;
+    aud: z.ZodString;
+    spaceId: z.ZodString;
+    sid: z.ZodString;
+    generation: z.ZodNumber;
+    emailVerified: z.ZodDefault<z.ZodBoolean>;
+    profile: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        avatar_url: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>>;
+    jti: z.ZodString;
+}, z.core.$strip>;
+export type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>;