@spacefast/common 0.0.2

package/dist/contracts/access.js

@@ -0,0 +1,396 @@
+import { z } from "zod";
+// Unified access contracts (internal-docs/stattic-model-plan.html "Section I ·
+// access" + internal-docs/access-management-plan.md).
+//
+// Unified access contracts (the one access & policy lane). The headline
+// simplification: **firewall ⊂ access** — there is exactly one Rule schema, and
+// an anonymous firewall rule is simply a Rule whose `auth` is absent. The
+// runtime enforces a verifiable subset (password secret-compare + token
+// Ed25519/grant-intersection + anonymous firewall); the cloud resolves identity
+// and mints signed tokens. Field names are the spec contract — do not rename.
+// ---------------------------------------------------------------------------
+// 1. Grants
+// ---------------------------------------------------------------------------
+// A grant is a string in a verified token (or a `requiredGrants` entry on a
+// rule). Identity is a string set: the runtime is a verifier and
+// set-intersector — a visitor passes when `grants ∩ requiredGrants ≠ ∅`.
+//
+// Grants are globs. One namespace per kind, with `*` wildcards permitted in
+// `requiredGrants` so a rule can name a class of identities:
+//
+//   email:alice@acme.com        a single verified email
+//   email:*@acme.com            any verified email on a domain (glob)
+//   team:team_123:member        top-level team membership at a role
+//   sub-team:sub_123:member     enterprise group membership inside a team
+//   user:<handle>               a specific platform person
+//   svc:<tokenId>               a service token (CI, agents)
+//   ext:{connectionId}:<tag>    an owner-defined external grant
+//
+// Tokens signed by an external (BYO) key may only carry grants namespaced to
+// that key (see `accessKeySchema.grantNamespaces`); everything else is dropped
+// before intersection.
+export const grantSchema = z.string().min(1).max(255);
+// Known grant namespace prefixes. Useful for validation/UX; not exhaustive of
+// every future namespace, but covers the documented vocabulary.
+export const GRANT_NAMESPACES = [
+    "email:",
+    "team:",
+    "sub-team:",
+    "user:",
+    "svc:",
+    "ext:",
+    // Mint-time-only namespaces (sources the cloud resolves into the above, plus
+    // transient grants the runtime mints itself).
+    "email-domain:",
+    "space:",
+    "link:",
+    "sso:",
+    "pw:", // minted by a form-transport password challenge
+];
+const GRANT_PATTERN = /^(email|email-domain|team|sub-team|user|svc|ext|space|link|sso|pw):.+$/;
+// Validator for grant globs like "email:*@acme.com", "team:team_123:member",
+// "sub-team:sub_123:member", "user:<h>", "svc:…", "ext:{conn}:…". Returns true when the grant string is a
+// well-formed `namespace:value`. This is advisory (the runtime intersects
+// opaque strings); use it for authoring-surface validation, not enforcement.
+export function isWellFormedGrant(grant) {
+    return GRANT_PATTERN.test(grant);
+}
+// A `requiredGrants` entry may contain `*` wildcards; a minted token grant must
+// be concrete (no `*`). Both share `grantSchema`; this narrows the authoring
+// case.
+export const requiredGrantSchema = grantSchema.refine(isWellFormedGrant, {
+    message: "grant must be namespaced, e.g. email:*@acme.com, team:team_123:member, sub-team:sub_123:member, user:<h>, svc:…, ext:{conn}:…",
+});
+// ---------------------------------------------------------------------------
+// 2. Issuer registry
+// ---------------------------------------------------------------------------
+// A registered signing key. SSO + BYO-issuer keys are registered once at
+// team/space level; rules reference grants, and a token's grants are dropped
+// unless namespaced to one of `grantNamespaces`. Service tokens are just tokens
+// carrying `svc:` grants signed by a platform key.
+export const accessKeySchema = z.object({
+    kid: z.string().min(1).describe("Key id; matches the token header `kid`."),
+    alg: z.literal("EdDSA"),
+    publicKey: z.string().min(1).describe("base64url-encoded raw Ed25519 public key."),
+    // Grants in a token signed by this key are DROPPED unless prefixed by one of
+    // these. Platform keys list the platform prefixes
+    // (["team:","sub-team:","user:","email:","email-domain:","space:","link:","svc:","sso:"]);
+    // external keys list exactly ["ext:{connectionId}:"], bounding a leaked key's
+    // blast radius to the rules the owner pointed at it.
+    grantNamespaces: z.array(z.string().min(1)).min(1),
+});
+// ---------------------------------------------------------------------------
+// 3. The unified runtime Rule (firewall = a rule with no auth)
+// ---------------------------------------------------------------------------
+// The `auth` object: pass when EITHER the password OR the token leg is
+// satisfied. Folds the old basicAuth / sso / login / composite requirement
+// types into two legs. An absent `auth` makes the rule an anonymous firewall
+// rule (effect applies on match, no credential needed) — this is the sense in
+// which **firewall ⊂ access**.
+export const passwordAuthSchema = z.object({
+    // A secret reference (e.g. "secret:site_pw"), never plaintext. The runtime
+    // resolves it from serving secrets and compares.
+    ref: z.string().min(1),
+    // `basic` = stateless HTTP Basic 401 challenge. `form` = renders the password
+    // wall, and on success mints a short-lived `pw:` grant cookie.
+    transport: z.enum(["basic", "form"]),
+    username: z.string().min(1).optional(),
+});
+export const tokenAuthSchema = z.object({
+    // ANY-OF: the visitor's verified grants must intersect this set. Entries may
+    // be globs (e.g. "email:*@acme.com").
+    requiredGrants: z.array(grantSchema).min(1),
+    // Issuer keys whose tokens are accepted for this rule. When omitted, the
+    // compiler fills in the applicable platform/registered keys. Tokens signed by
+    // a key contribute only grants within that key's `grantNamespaces`.
+    issuers: z.array(accessKeySchema).optional(),
+    // Interactive login surface the runtime 302-redirects an unsatisfied browser
+    // visitor to (with an opaque `return=` param). Absent = no interactive login
+    // (service-token-only rule) and the runtime denies a browser rather than loop.
+    loginUrl: z.string().min(1).optional(),
+    // Cookie name the runtime reads the visitor token from (default
+    // `stattic_access`); the Authorization Bearer header always takes precedence.
+    cookieName: z.string().min(1).optional(),
+});
+export const ruleAuthSchema = z
+    .object({
+    password: passwordAuthSchema.optional(),
+    token: tokenAuthSchema.optional(),
+})
+    .refine((a) => a.password !== undefined || a.token !== undefined, {
+    message: "auth must specify at least one of `password` or `token`",
+});
+// Match conditions AND together (host AND path AND channel AND ipCidrs AND …).
+// All fields optional; an empty match matches everything in scope.
+export const ruleMatchSchema = z.object({
+    host: z.string().min(1).optional(),
+    // Glob path pattern: "/docs/**" | "/docs/*" | "/x.html".
+    pathPattern: z.string().min(1).optional(),
+    // Serving context channel name (e.g. "live", "staging").
+    channel: z.string().min(1).optional(),
+    // CIDR v4/v6 list; the request IP must fall in one of these.
+    ipCidrs: z.array(z.string().min(1)).max(50).optional(),
+    // User-agent matcher (e.g. block a crawler, gate an agent).
+    agent: z.string().min(1).optional(),
+    // ISO 3166-1 alpha-2 country code matcher.
+    country: z.string().min(2).max(2).optional(),
+    // Single request-header matcher: name + expected value.
+    header: z.object({ name: z.string().min(1), value: z.string() }).optional(),
+});
+// The one Rule. `match` (AND) selects requests; `effect` is what happens on
+// match; `auth` (absent = anonymous firewall) gates `challenge`/`allow`.
+export const runtimeRuleSchema = z.object({
+    match: ruleMatchSchema.default({}),
+    effect: z.enum(["allow", "deny", "challenge"]),
+    // Absent = anonymous firewall rule (no credential required). Present = pass
+    // when the password OR token leg is satisfied.
+    auth: ruleAuthSchema.optional(),
+    // Surfaced on a `deny` (X-Spacefast-Reason header) and the rendered platform
+    // page so an operator/visitor can tell which rule fired and why.
+    reasonCode: z.string().min(1).optional(),
+    message: z.string().min(1).optional(),
+});
+// ---------------------------------------------------------------------------
+// 3b. Visitor token (the cloud "mint" half)
+// ---------------------------------------------------------------------------
+// The default cookie the runtime reads a visitor token from when a rule's token
+// leg names no explicit `cookieName` (see access-rules.php
+// `_stattic_unified_token_from_request`). The authorize endpoint sets the
+// minted token under this name so the very next request to the protected host
+// carries it.
+export const ACCESS_TOKEN_COOKIE_NAME = "stattic_access";
+// The header `kid`/`alg` the platform signs visitor tokens with. These match
+// the runtime JWKS key (`stattic-runtime-v1` / EdDSA) so the runtime's
+// JWKS-by-kid verify (access-rules.php) accepts a token the cloud minted. Do
+// NOT introduce a second key system — these constants name the existing one.
+export const ACCESS_TOKEN_KID = "stattic-runtime-v1";
+export const ACCESS_TOKEN_ALG = "EdDSA";
+// The DEDICATED `kid` Cast access tokens are signed under (CAST-NATIVE-PLAN
+// decision D-1). It is published in the SAME JWKS as the runtime key, but is
+// distinct so the runtime's JWKS-by-kid verify (which only accepts
+// `ACCESS_TOKEN_KID`) refuses a Cast token outright, decoupling Cast key
+// rotation from the runtime. Cast selects the verifying key by this `kid`.
+export const CAST_TOKEN_KID = "spacefast-cast-v1";
+// The claim set carried by a minted visitor token. `grants` are concrete
+// (no `*`), `email:`/`user:`/`team:<teamId>:<role>`/`sub-team:<subTeamId>:<role>` namespaced so they survive
+// the platform issuer's `grantNamespaces` filter at the runtime. `aud`, when
+// present, lowercases-binds the token to a single serving host.
+export const accessTokenPayloadSchema = z.object({
+    // Subject: the authenticated platform user id the token was minted for.
+    sub: z.string().min(1),
+    // Concrete (non-glob) grants. The runtime intersects these with a rule's
+    // `requiredGrants`; the visitor passes when the intersection is non-empty.
+    grants: z.array(grantSchema).default([]),
+    // Unix seconds. Mirrors the runtime's exp check (300s leeway).
+    exp: z.number().int().nonnegative(),
+    nbf: z.number().int().nonnegative().optional(),
+    iat: z.number().int().nonnegative().optional(),
+    iss: z.string().min(1).optional(),
+    // Optional host binding (lowercased) — when set the token is only accepted on
+    // that serving host.
+    aud: z.string().min(1).optional(),
+});
+// Authorize request: the bounded authenticated-team-member mint path. The
+// caller is already an authenticated session; the body only tunes the mint.
+// `setCookie` (default true) asks the endpoint to also set the access cookie so
+// the next navigation to the protected host is authorized without the client
+// re-attaching the token. `aud` optionally binds the token to one host.
+export const authorizeRequestSchema = z.object({
+    setCookie: z.boolean().default(true),
+    aud: z.string().min(1).optional(),
+});
+// Authorize response: the signed compact JWT plus its decoded claims (so a
+// caller can show/inspect the grants without re-parsing) and whether the access
+// cookie was set on the response.
+export const authorizeResponseSchema = z.object({
+    // The signed compact EdDSA JWT (`header.claims.signature`, base64url).
+    token: z.string().min(1),
+    // Decoded claims of `token` (echo of what was signed).
+    payload: accessTokenPayloadSchema,
+    // Unix seconds the token expires at (convenience mirror of `payload.exp`).
+    expiresAt: z.number().int().nonnegative(),
+    // The cookie name the token was set under, or null when `setCookie` was false.
+    cookieName: z.string().min(1).nullable().default(null),
+});
+// ---------------------------------------------------------------------------
+// 3c. Mint-time grant builders (the cloud "resolve identity → grants" half)
+// ---------------------------------------------------------------------------
+// The concrete grant a space invitee carries once they accept: a token with
+// `space:{spaceId}:viewer` intersects the `invited`-audience rule the compiler
+// emits (`requiredGrants: ["space:{spaceId}:viewer"]` + team grants, §6.3).
+// The platform issuer lists the `space:` namespace, so the runtime keeps it.
+export function spaceViewerGrant(spaceId) {
+    return `space:${spaceId}:viewer`;
+}
+// The leveled space grant an invited reviewer carries (CAST-NATIVE-PLAN D-2/
+// D-4): `space:{spaceId}:{level}` where level ∈ viewer|commenter|editor. The
+// `space:` namespace is on the platform issuer (resolve.ts `platformIssuer`), so
+// the runtime keeps it; Cast reads the level off the token to key its
+// capability table. `spaceViewerGrant` is the `viewer` special case kept for the
+// accepted-invite path; this is the general leveled form the reviewer people
+// layer reconciles and the Cast mint carries.
+export function spaceLevelGrant(spaceId, level) {
+    return `space:${spaceId}:${level}`;
+}
+// The concrete grant a share-link holder carries: a token with `link:{linkId}`
+// intersects the `shareLinks`-audience rule whose `requiredGrants` the compiler
+// fills from the ACTIVE link rows (§6.4). Revoking the link recompiles it out
+// and the token goes inert. The platform issuer lists the `link:` namespace.
+export function shareLinkGrant(linkId) {
+    return `link:${linkId}`;
+}
+// ---------------------------------------------------------------------------
+// 3d. Invite + share-link mint surface (request/response contracts)
+// ---------------------------------------------------------------------------
+//
+// ADDITIVE / NOT-YET-WIRED: the request/response shapes for the invite and
+// share-link minting endpoints described in access-management-plan.md §6.3/§6.4
+// and §9. The persistence (the `spaceInvites` / `shareLinks` tables, magic-token
+// hashing, accept/create/revoke routes, the recompile-on-revoke step, and the
+// request-access loop) needs DB migrations + email and is specified in
+// internal-docs/invite-minting-plan.md — these schemas are the contract that
+// plan's endpoints will validate against, safe to land first.
+// `POST /v1/spaces/:id/invites` body (§6.3). Invites a single email as a space
+// viewer. The email is lowercased + NFC-normalized server-side before storage.
+export const inviteCreateRequestSchema = z.object({
+    email: z.string().email(),
+    // Optional invite-link validity in days (default 7d at the route).
+    expiresInDays: z.number().int().positive().max(365).optional(),
+    // Optional note shown in the invite email.
+    message: z.string().max(300).optional(),
+});
+// A pending/accepted/revoked invite as surfaced to owners. The magic token is
+// NEVER returned — only its lifecycle. `id` is `sin_…`.
+export const spaceInviteSchema = z.object({
+    id: z.string().min(1),
+    spaceId: z.string().min(1),
+    email: z.string().email(),
+    status: z.enum(["pending", "accepted", "revoked", "expired"]),
+    // The viewer grant this invite mints on acceptance — surfaced so the owner can
+    // see exactly what it grants (`space:{spaceId}:viewer`).
+    grant: z.string().min(1),
+    invitedBy: z.string().min(1).nullable().default(null),
+    expiresAt: z.string().min(1).nullable().default(null),
+    acceptedAt: z.string().min(1).nullable().default(null),
+    revokedAt: z.string().min(1).nullable().default(null),
+    createdAt: z.string().min(1),
+});
+// `POST /v1/spaces/:id/share-links` body (§6.4). Creates an "anyone with the
+// link" grant scoped to a path prefix, with an optional expiry + label.
+export const shareLinkCreateRequestSchema = z.object({
+    // "/" = the whole space. Must be an absolute, backslash-free path.
+    pathPrefix: z
+        .string()
+        .regex(/^\/[^\\]*$/)
+        .default("/"),
+    // Absent = a non-expiring link.
+    expiresAt: z.string().min(1).optional(),
+    label: z.string().max(120).optional(),
+});
+// A share link as surfaced to owners. `url` (the token-bearing URL) is returned
+// ONLY on the create response (the runtime trades `?stattic_share=` for a
+// cookie once); list/read responses omit it and show only the lifecycle. `id`
+// is `lnk_…`; `grant` is `link:{id}`.
+export const shareLinkSchema = z.object({
+    id: z.string().min(1),
+    spaceId: z.string().min(1),
+    pathPrefix: z.string().min(1),
+    label: z.string().nullable().default(null),
+    grant: z.string().min(1),
+    // The token-bearing URL — present only on create; null on list/read.
+    url: z.string().min(1).nullable().default(null),
+    createdBy: z.string().min(1).nullable().default(null),
+    expiresAt: z.string().min(1).nullable().default(null),
+    revokedAt: z.string().min(1).nullable().default(null),
+    createdAt: z.string().min(1),
+});
+// ---------------------------------------------------------------------------
+// 4. Lanes / nouns (additive types only — not wired)
+// ---------------------------------------------------------------------------
+// A channel is a named serving lane (e.g. "live", "staging") pointing at a
+// version, with promote/rollback history.
+export const channelSchema = z.object({
+    name: z.string().min(1),
+    versionId: z.string().min(1),
+    // Newest-first promote/rollback log: which version this channel pointed at.
+    history: z
+        .array(z.object({
+        versionId: z.string().min(1),
+        at: z.string().min(1).describe("ISO 8601 timestamp."),
+    }))
+        .default([]),
+});
+// Content-lane serving config (scalar, field-ownership / SSA semantics). No
+// `spa` toggle — that mode is gone; a SPA is expressed as a `fallback`.
+export const servingConfigSchema = z.object({
+    // Directory index document (e.g. "index.html").
+    index: z.string().min(1).optional(),
+    // Single fallback document served when no file/route matches (replaces the
+    // old `spa` boolean).
+    fallback: z.string().min(1).optional(),
+    // Whether directory listings are rendered when there is no index.
+    listing: z.boolean().optional(),
+});
+// The policy-lane document: an ordered, additive list of unified Rules. This is
+// the firewall+access lane (own version + rollback, independent of content).
+export const policyDocSchema = z.object({
+    rules: z.array(runtimeRuleSchema).default([]),
+});
+// ---------------------------------------------------------------------------
+// 5. Storage + resolution shapes (additive)
+// ---------------------------------------------------------------------------
+// The CLOUD-stored policy for one space. This is the persisted, versioned form
+// of the policy lane: an ordered list of unified Rules plus a monotonic
+// `version` so the lane can promote/rollback independently of content (mirrors
+// `channelSchema.history`). `version` is bumped on every write; a write that
+// supplies a stale `version` is a lost-update and is rejected by the resolver.
+//
+// Provenance: these are the "cloud" rules. They are merged with any "file"
+// rules compiled from the space's `sf.jsonc` (which travel + roll back
+// WITH a content version) to produce the effective policy — see
+// `effectiveRuleSchema` / `effectivePolicySchema`.
+export const spacePolicySchema = z.object({
+    // Ordered, additive Rules (first-match-wins at serving compile time). Same
+    // unified Rule the runtime verifies; an absent `auth` is an anonymous
+    // firewall rule (firewall ⊂ access).
+    rules: z.array(runtimeRuleSchema).default([]),
+    // Monotonic lane version. Starts at 1 on first write; every accepted write
+    // increments it. Used for optimistic concurrency (lost-update rejection) and
+    // for rollback to a prior lane revision.
+    version: z.number().int().nonnegative().default(0),
+});
+// Where an effective rule came from. `platform` = composed by the cloud from
+// platform state (plan window, abuse/ban/billing) and PREPENDED above every
+// user-authored rule so a platform decision always wins first-match-wins; the
+// user can NEVER author a `platform` rule. `file` = compiled from the space's
+// `sf.jsonc` (timeless, rolls back with the content version). `cloud` =
+// the stored `spacePolicySchema` lane (incident interventions, password walls
+// set via the API/CLI, etc.). Provenance is surfaced so an operator reading the
+// effective policy can tell which surface to edit to change a given rule.
+export const ruleSourceSchema = z.enum(["platform", "file", "cloud"]);
+// A provenance-annotated effective Rule: the unified `runtimeRuleSchema` plus
+// the `source` it was contributed by and the `order` it occupies in the
+// resolved, first-match-wins list. This is the READ shape returned by the
+// effective-policy resolver — never stored. `order` is the 0-based index in the
+// flattened effective list (file rules then cloud rules, or whatever order the
+// resolver composes), letting a caller reconstruct match precedence.
+export const effectiveRuleSchema = runtimeRuleSchema.extend({
+    source: ruleSourceSchema,
+    order: z.number().int().nonnegative(),
+});
+// The resolved effective policy for a space: the flattened, provenance-tagged
+// rule list plus the `cloudVersion` (the `spacePolicySchema.version` the cloud
+// rules were resolved from) so a reader can detect drift / pin a write against
+// the revision it observed. `fileVersion` is the content version id the `file`
+// rules were compiled from (null when the space has no compiled file rules).
+export const effectivePolicySchema = z.object({
+    rules: z.array(effectiveRuleSchema).default([]),
+    cloudVersion: z.number().int().nonnegative().default(0),
+    fileVersion: z.string().min(1).nullable().default(null),
+    // Serving-secret map (name -> value) the resolved rules reference by
+    // `auth.password.ref` = "secret:<name>". Today this carries the space
+    // password's bcrypt verifier hash, keyed so the runtime resolves it from
+    // `serving['secrets']` and `password_verify`s against it. Never contains
+    // plaintext the visitor types — only stored verifier hashes / shared secrets.
+    secrets: z.record(z.string().min(1), z.string().min(1)).default({}),
+});

package/dist/contracts/account.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export declare const accessTokenScope: z.ZodEnum<{
+    "account:read": "account:read";
+    "account:write": "account:write";
+    "team:read": "team:read";
+    "team:write": "team:write";
+    "space:read": "space:read";
+    "space:write": "space:write";
+    "domain:read": "domain:read";
+    "domain:write": "domain:write";
+}>;
+export type AccessTokenScope = z.infer<typeof accessTokenScope>;
+export declare const ACCESS_TOKEN_SCOPE_DEFINITIONS: {
+    value: AccessTokenScope;
+    label: string;
+    description: string;
+}[];
+export declare const DEFAULT_ACCESS_TOKEN_SCOPES: AccessTokenScope[];
+export type AuthSession = {
+    session: {
+        id: string;
+    };
+    user: {
+        id: string;
+        email?: string | null | undefined;
+        name?: string | null | undefined;
+    };
+};

package/dist/contracts/account.js

@@ -0,0 +1,54 @@
+import { z } from "zod";
+export const accessTokenScope = z.enum([
+    "account:read",
+    "account:write",
+    "team:read",
+    "team:write",
+    "space:read",
+    "space:write",
+    "domain:read",
+    "domain:write",
+]);
+export const ACCESS_TOKEN_SCOPE_DEFINITIONS = [
+    {
+        value: "account:read",
+        label: "Read account",
+        description: "View account details, active sessions, and existing access tokens.",
+    },
+    {
+        value: "account:write",
+        label: "Manage account",
+        description: "Update account settings and revoke or create account-scoped credentials.",
+    },
+    {
+        value: "team:read",
+        label: "Read teams",
+        description: "View team membership, billing, activity, secrets, and settings.",
+    },
+    {
+        value: "team:write",
+        label: "Manage teams",
+        description: "Change team settings and manage members, invitations, or secrets.",
+    },
+    {
+        value: "space:read",
+        label: "Read spaces",
+        description: "View spaces, versions, diagnostics, variables, and runtime status.",
+    },
+    {
+        value: "space:write",
+        label: "Manage spaces",
+        description: "Create, update, publish, and delete spaces, versions, or variables.",
+    },
+    {
+        value: "domain:read",
+        label: "Read domains",
+        description: "Inspect custom domains, DNS state, and assignment details.",
+    },
+    {
+        value: "domain:write",
+        label: "Manage domains",
+        description: "Attach, update, verify, or remove space and team domains.",
+    },
+];
+export const DEFAULT_ACCESS_TOKEN_SCOPES = ["account:read"];

package/dist/contracts/activity.d.ts

@@ -0,0 +1,118 @@
+import { z } from "zod";
+export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "space.transferred", "space.moved", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.password_updated", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "version.retention_warning", "version.retention_deleted", "channel.promoted", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "binding.created", "binding.activated", "binding.blocked", "binding.deleted", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "team.updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "export.ready", "export.failed", "import.ready", "import.failed", "annotation.token_minted", "annotation.created", "annotation.comment_created", "annotation.resolved", "annotation.reopened", "annotation.archived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled"];
+export type ActivityEventCode = (typeof ACTIVITY_EVENT_CODES)[number];
+export declare function isActivityEventCode(value: string): value is ActivityEventCode;
+export declare function isValidActivityEventFilter(filter: string): boolean;
+export declare function matchesActivityEventFilters(filters: readonly string[], code: string): boolean;
+export declare const activityActorSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"user">;
+    id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"api_key">;
+    id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"oauth_client">;
+    id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"anonymous_claim">;
+    id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"system">;
+    id: z.ZodString;
+}, z.core.$strip>], "type">;
+export declare const activityPrincipalSchema: z.ZodObject<{
+    tenantId: z.ZodString;
+    principalType: z.ZodEnum<{
+        external: "external";
+        team: "team";
+    }>;
+    principalId: z.ZodString;
+}, z.core.$strip>;
+export declare const activityEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    sequence: z.ZodNumber;
+    tenantId: z.ZodString;
+    principal: z.ZodNullable<z.ZodObject<{
+        tenantId: z.ZodString;
+        principalType: z.ZodEnum<{
+            external: "external";
+            team: "team";
+        }>;
+        principalId: z.ZodString;
+    }, z.core.$strip>>;
+    spaceId: z.ZodNullable<z.ZodString>;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"oauth_client">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"anonymous_claim">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        id: z.ZodString;
+    }, z.core.$strip>], "type">;
+    code: z.ZodString;
+    message: z.ZodString;
+    details: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export declare const activityQuerySchema: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    principalType: z.ZodOptional<z.ZodEnum<{
+        external: "external";
+        team: "team";
+    }>>;
+    principalId: z.ZodOptional<z.ZodString>;
+    spaceId: z.ZodOptional<z.ZodString>;
+    code: z.ZodOptional<z.ZodString>;
+    since: z.ZodOptional<z.ZodString>;
+    until: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const activityListResponseSchema: z.ZodObject<{
+    data: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        sequence: z.ZodNumber;
+        tenantId: z.ZodString;
+        principal: z.ZodNullable<z.ZodObject<{
+            tenantId: z.ZodString;
+            principalType: z.ZodEnum<{
+                external: "external";
+                team: "team";
+            }>;
+            principalId: z.ZodString;
+        }, z.core.$strip>>;
+        spaceId: z.ZodNullable<z.ZodString>;
+        actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"user">;
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"api_key">;
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"oauth_client">;
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"anonymous_claim">;
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"system">;
+            id: z.ZodString;
+        }, z.core.$strip>], "type">;
+        code: z.ZodString;
+        message: z.ZodString;
+        details: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+    pagination: z.ZodObject<{
+        nextCursor: z.ZodNullable<z.ZodString>;
+        hasMore: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ActivityEvent = z.infer<typeof activityEventSchema>;