@spacefast/common 0.0.3 → 0.0.6

package/dist/contracts/access.d.ts

@@ -1,11 +1,17 @@
 import { z } from "zod";
 export declare const grantSchema: z.ZodString;
 export type Grant = z.infer<typeof grantSchema>;
-export declare const GRANT_NAMESPACES: readonly ["email:", "team:", "sub-team:", "user:", "svc:", "ext:", "email-domain:", "space:", "link:", "sso:", "pw:"];
-export type GrantNamespace = (typeof GRANT_NAMESPACES)[number];
+export declare const GRANT_NAMESPACES: readonly ["email:", "team:", "sub-team:", "user:", "space:", "link:", "invite:", "svc:", "sso:", "ext:", "pw:"];
 export declare function isWellFormedGrant(grant: string): boolean;
 export declare const requiredGrantSchema: z.ZodString;
-export type RequiredGrant = z.infer<typeof requiredGrantSchema>;
+export declare const SPACE_LEVELS: readonly ["viewer", "commenter", "editor", "admin"];
+export declare const spaceLevelSchema: z.ZodEnum<{
+    viewer: "viewer";
+    commenter: "commenter";
+    editor: "editor";
+    admin: "admin";
+}>;
+export type SpaceLevel = z.infer<typeof spaceLevelSchema>;
 export declare const accessKeySchema: z.ZodObject<{
     kid: z.ZodString;
     alg: z.ZodLiteral<"EdDSA">;
@@ -13,7 +19,139 @@ export declare const accessKeySchema: z.ZodObject<{
     grantNamespaces: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;
 export type AccessKey = z.infer<typeof accessKeySchema>;
-export declare const passwordAuthSchema: z.ZodObject<{
+export declare const ACCESS_CONNECTION_TYPES: readonly ["oidc", "external"];
+export declare const accessConnectionTypeSchema: z.ZodEnum<{
+    external: "external";
+    oidc: "oidc";
+}>;
+export declare const OIDC_CONNECTION_DEFAULT_TTL_SECONDS: number;
+export declare const EXTERNAL_CONNECTION_DEFAULT_TTL_SECONDS: number;
+export declare const EXTERNAL_TOKEN_MAX_TTL_SECONDS: number;
+export declare function ssoGrant(connectionId: string): string;
+export declare function externalGrantNamespace(connectionId: string): string;
+export declare function externalGrant(connectionId: string, tag: string): string;
+export declare function connectionAcquireRef(connectionId: string): string;
+export declare function parseConnectionAcquireRef(url: string): string | null;
+export declare function referencedConnectionIds(input: {
+    requiredGrants?: string[] | undefined;
+    acquire?: Array<{
+        type: string;
+        url?: string;
+    }> | undefined;
+}): string[];
+export declare const externalConnectionPublicKeySchema: z.ZodObject<{
+    kid: z.ZodString;
+    publicKey: z.ZodString;
+}, z.core.$strip>;
+export type ExternalConnectionPublicKey = z.infer<typeof externalConnectionPublicKeySchema>;
+export declare const accessConnectionSchema: z.ZodObject<{
+    id: z.ZodString;
+    teamId: z.ZodString;
+    type: z.ZodEnum<{
+        external: "external";
+        oidc: "oidc";
+    }>;
+    name: z.ZodString;
+    issuer: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    clientId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    clientSecretSet: z.ZodDefault<z.ZodBoolean>;
+    authorizeUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    publicKeys: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        publicKey: z.ZodString;
+    }, z.core.$strip>>>;
+    sessionTtlSeconds: z.ZodNumber;
+    guestEmailDomains: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    createdAt: z.ZodString;
+    revokedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    active: z.ZodBoolean;
+}, z.core.$strip>;
+export type AccessConnection = z.infer<typeof accessConnectionSchema>;
+export declare const oidcConnectionCreateSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oidc">;
+    name: z.ZodString;
+    issuer: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+    guestEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const externalConnectionCreateSchema: z.ZodObject<{
+    type: z.ZodLiteral<"external">;
+    name: z.ZodString;
+    authorizeUrl: z.ZodString;
+    publicKeys: z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        publicKey: z.ZodString;
+    }, z.core.$strip>>;
+    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+    guestEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const accessConnectionCreateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"oidc">;
+    name: z.ZodString;
+    issuer: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+    guestEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"external">;
+    name: z.ZodString;
+    authorizeUrl: z.ZodString;
+    publicKeys: z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        publicKey: z.ZodString;
+    }, z.core.$strip>>;
+    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+    guestEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>], "type">;
+export type AccessConnectionCreate = z.infer<typeof accessConnectionCreateSchema>;
+export declare const accessConnectionUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    issuer: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    authorizeUrl: z.ZodOptional<z.ZodString>;
+    publicKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        publicKey: z.ZodString;
+    }, z.core.$strip>>>;
+    sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+    guestEmailDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+}, z.core.$strip>;
+export type AccessConnectionUpdate = z.infer<typeof accessConnectionUpdateSchema>;
+export declare const accessConnectionRevokeResultSchema: z.ZodObject<{
+    connection: z.ZodObject<{
+        id: z.ZodString;
+        teamId: z.ZodString;
+        type: z.ZodEnum<{
+            external: "external";
+            oidc: "oidc";
+        }>;
+        name: z.ZodString;
+        issuer: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        clientId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        clientSecretSet: z.ZodDefault<z.ZodBoolean>;
+        authorizeUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        publicKeys: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            kid: z.ZodString;
+            publicKey: z.ZodString;
+        }, z.core.$strip>>>;
+        sessionTtlSeconds: z.ZodNumber;
+        guestEmailDomains: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        createdAt: z.ZodString;
+        revokedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        active: z.ZodBoolean;
+    }, z.core.$strip>;
+    disabledRules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        spaceId: z.ZodString;
+        ruleId: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type AccessConnectionRevokeResult = z.infer<typeof accessConnectionRevokeResultSchema>;
+export declare const passwordAcquireSchema: z.ZodObject<{
+    type: z.ZodLiteral<"password">;
     ref: z.ZodString;
     transport: z.ZodEnum<{
         basic: "basic";
@@ -21,8 +159,26 @@ export declare const passwordAuthSchema: z.ZodObject<{
     }>;
     username: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-export type PasswordAuth = z.infer<typeof passwordAuthSchema>;
-export declare const tokenAuthSchema: z.ZodObject<{
+export declare const loginAcquireSchema: z.ZodObject<{
+    type: z.ZodLiteral<"login">;
+    url: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const acquireSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"password">;
+    ref: z.ZodString;
+    transport: z.ZodEnum<{
+        basic: "basic";
+        form: "form";
+    }>;
+    username: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"login">;
+    url: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "type">;
+export type Acquire = z.infer<typeof acquireSchema>;
+export declare const ruleAuthSchema: z.ZodObject<{
     requiredGrants: z.ZodArray<z.ZodString>;
     issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
         kid: z.ZodString;
@@ -30,34 +186,25 @@ export declare const tokenAuthSchema: z.ZodObject<{
         publicKey: z.ZodString;
         grantNamespaces: z.ZodArray<z.ZodString>;
     }, z.core.$strip>>>;
-    loginUrl: z.ZodOptional<z.ZodString>;
-    cookieName: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type TokenAuth = z.infer<typeof tokenAuthSchema>;
-export declare const ruleAuthSchema: z.ZodObject<{
-    password: z.ZodOptional<z.ZodObject<{
+    acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"password">;
         ref: z.ZodString;
         transport: z.ZodEnum<{
             basic: "basic";
             form: "form";
         }>;
         username: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-    token: z.ZodOptional<z.ZodObject<{
-        requiredGrants: z.ZodArray<z.ZodString>;
-        issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            kid: z.ZodString;
-            alg: z.ZodLiteral<"EdDSA">;
-            publicKey: z.ZodString;
-            grantNamespaces: z.ZodArray<z.ZodString>;
-        }, z.core.$strip>>>;
-        loginUrl: z.ZodOptional<z.ZodString>;
-        cookieName: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"login">;
+        url: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "type">>>;
 }, z.core.$strip>;
 export type RuleAuth = z.infer<typeof ruleAuthSchema>;
 export declare const ruleMatchSchema: z.ZodObject<{
     host: z.ZodOptional<z.ZodString>;
+    hostPattern: z.ZodOptional<z.ZodString>;
+    hostTemplate: z.ZodOptional<z.ZodString>;
     pathPattern: z.ZodOptional<z.ZodString>;
     channel: z.ZodOptional<z.ZodString>;
     ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -68,10 +215,21 @@ export declare const ruleMatchSchema: z.ZodObject<{
         value: z.ZodString;
     }, z.core.$strip>>;
 }, z.core.$strip>;
-export type RuleMatch = z.infer<typeof ruleMatchSchema>;
+export declare const MANAGED_BY_VALUES: readonly ["sharing", "firewall", "file_share", "cast_reviewer", "team_default"];
+export declare const managedBySchema: z.ZodEnum<{
+    sharing: "sharing";
+    firewall: "firewall";
+    file_share: "file_share";
+    cast_reviewer: "cast_reviewer";
+    team_default: "team_default";
+}>;
+export type ManagedBy = z.infer<typeof managedBySchema>;
 export declare const runtimeRuleSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
     match: z.ZodDefault<z.ZodObject<{
         host: z.ZodOptional<z.ZodString>;
+        hostPattern: z.ZodOptional<z.ZodString>;
+        hostTemplate: z.ZodOptional<z.ZodString>;
         pathPattern: z.ZodOptional<z.ZodString>;
         channel: z.ZodOptional<z.ZodString>;
         ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -88,34 +246,43 @@ export declare const runtimeRuleSchema: z.ZodObject<{
         challenge: "challenge";
     }>;
     auth: z.ZodOptional<z.ZodObject<{
-        password: z.ZodOptional<z.ZodObject<{
+        requiredGrants: z.ZodArray<z.ZodString>;
+        issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            kid: z.ZodString;
+            alg: z.ZodLiteral<"EdDSA">;
+            publicKey: z.ZodString;
+            grantNamespaces: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+        acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"password">;
             ref: z.ZodString;
             transport: z.ZodEnum<{
                 basic: "basic";
                 form: "form";
             }>;
             username: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
-        token: z.ZodOptional<z.ZodObject<{
-            requiredGrants: z.ZodArray<z.ZodString>;
-            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                kid: z.ZodString;
-                alg: z.ZodLiteral<"EdDSA">;
-                publicKey: z.ZodString;
-                grantNamespaces: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>>>;
-            loginUrl: z.ZodOptional<z.ZodString>;
-            cookieName: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"login">;
+            url: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>], "type">>>;
     }, z.core.$strip>>;
+    managedBy: z.ZodOptional<z.ZodEnum<{
+        sharing: "sharing";
+        firewall: "firewall";
+        file_share: "file_share";
+        cast_reviewer: "cast_reviewer";
+        team_default: "team_default";
+    }>>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
     reasonCode: z.ZodOptional<z.ZodString>;
     message: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type RuntimeRule = z.infer<typeof runtimeRuleSchema>;
-export declare const ACCESS_TOKEN_COOKIE_NAME = "stattic_access";
-export declare const ACCESS_TOKEN_KID = "stattic-runtime-v1";
+export declare const ACCESS_TOKEN_KID = "spacefast-runtime-v1";
 export declare const ACCESS_TOKEN_ALG = "EdDSA";
-export declare const CAST_TOKEN_KID = "spacefast-cast-v1";
+export declare const RUNTIME_JWKS_WELL_KNOWN_FILENAME = "spacefast-runtime-jwks.json";
+export declare const LOCAL_PW_TOKEN_KID = "spacefast-local-pw-v1";
 export declare const accessTokenPayloadSchema: z.ZodObject<{
     sub: z.ZodString;
     grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -124,13 +291,13 @@ export declare const accessTokenPayloadSchema: z.ZodObject<{
     iat: z.ZodOptional<z.ZodNumber>;
     iss: z.ZodOptional<z.ZodString>;
     aud: z.ZodOptional<z.ZodString>;
+    sv: z.ZodOptional<z.ZodNumber>;
+    jti: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>;
 export declare const authorizeRequestSchema: z.ZodObject<{
-    setCookie: z.ZodDefault<z.ZodBoolean>;
     aud: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-export type AuthorizeRequest = z.infer<typeof authorizeRequestSchema>;
 export declare const authorizeResponseSchema: z.ZodObject<{
     token: z.ZodString;
     payload: z.ZodObject<{
@@ -141,57 +308,460 @@ export declare const authorizeResponseSchema: z.ZodObject<{
         iat: z.ZodOptional<z.ZodNumber>;
         iss: z.ZodOptional<z.ZodString>;
         aud: z.ZodOptional<z.ZodString>;
+        sv: z.ZodOptional<z.ZodNumber>;
+        jti: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     expiresAt: z.ZodNumber;
-    cookieName: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
-export type AuthorizeResponse = z.infer<typeof authorizeResponseSchema>;
-export declare function spaceViewerGrant(spaceId: string): string;
-export declare function spaceLevelGrant(spaceId: string, level: string): string;
+export declare const accessEventSchema: z.ZodObject<{
+    sub: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    grantsHash: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    ruleId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    effect: z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+        challenge: "challenge";
+    }>;
+    reasonCode: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    host: z.ZodString;
+    path: z.ZodString;
+    ts: z.ZodNumber;
+}, z.core.$strip>;
+export type AccessEvent = z.infer<typeof accessEventSchema>;
+export declare function spaceLevelGrant(spaceId: string, level: SpaceLevel): string;
 export declare function shareLinkGrant(linkId: string): string;
-export declare const inviteCreateRequestSchema: z.ZodObject<{
-    email: z.ZodString;
-    expiresInDays: z.ZodOptional<z.ZodNumber>;
-    message: z.ZodOptional<z.ZodString>;
+export declare function inviteGrant(inviteId: string): string;
+export declare function serviceTokenGrant(tokenId: string): string;
+export declare const SHARE_LINK_TOKEN_MAX_TTL_SECONDS: number;
+export declare const shareLinkSchema: z.ZodObject<{
+    id: z.ZodString;
+    spaceId: z.ZodString;
+    label: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    path: z.ZodString;
+    createdBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    useCount: z.ZodDefault<z.ZodNumber>;
+    active: z.ZodBoolean;
+}, z.core.$strip>;
+export type ShareLink = z.infer<typeof shareLinkSchema>;
+export declare const shareLinkCreateSchema: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ShareLinkCreate = z.infer<typeof shareLinkCreateSchema>;
+export declare const shareLinkWithUrlSchema: z.ZodObject<{
+    id: z.ZodString;
+    spaceId: z.ZodString;
+    label: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    path: z.ZodString;
+    createdBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    useCount: z.ZodDefault<z.ZodNumber>;
+    active: z.ZodBoolean;
+    url: z.ZodString;
+}, z.core.$strip>;
+export type ShareLinkWithUrl = z.infer<typeof shareLinkWithUrlSchema>;
+export declare const GENERAL_ACCESS_MODES: readonly ["public", "password", "link", "people"];
+export declare const generalAccessModeSchema: z.ZodEnum<{
+    link: "link";
+    password: "password";
+    public: "public";
+    people: "people";
+}>;
+export type GeneralAccessMode = z.infer<typeof generalAccessModeSchema>;
+export declare const sharingConnectionAudienceSchema: z.ZodObject<{
+    connectionId: z.ZodString;
+    tag: z.ZodOptional<z.ZodString>;
+    emailDomain: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SharingConnectionAudience = z.infer<typeof sharingConnectionAudienceSchema>;
+export declare const generalAccessWriteSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        link: "link";
+        password: "password";
+        public: "public";
+        people: "people";
+    }>;
+    password: z.ZodOptional<z.ZodString>;
+    audiences: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        tag: z.ZodOptional<z.ZodString>;
+        emailDomain: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare const sharingAudienceSchema: z.ZodObject<{
+    connectionId: z.ZodString;
+    type: z.ZodEnum<{
+        external: "external";
+        oidc: "oidc";
+    }>;
+    name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    tag: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    emailDomain: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    grant: z.ZodString;
+}, z.core.$strip>;
+export type SharingAudience = z.infer<typeof sharingAudienceSchema>;
+export declare const sharingPersonSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        team_member: "team_member";
+        invitee: "invitee";
+    }>;
+    userId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    email: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    teamRole: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    level: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+        viewer: "viewer";
+        commenter: "commenter";
+        editor: "editor";
+        admin: "admin";
+    }>>>;
+    inviteId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    status: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+        expired: "expired";
+        pending: "pending";
+        accepted: "accepted";
+    }>>>;
+    lastViewedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
-export type InviteCreateRequest = z.infer<typeof inviteCreateRequestSchema>;
+export type SharingPerson = z.infer<typeof sharingPersonSchema>;
+export declare const INVITE_ACCEPT_LINK_TTL_SECONDS: number;
+export declare const INVITE_TOKEN_TTL_SECONDS: number;
+export declare const ACCESS_MESSAGE_MAX_LENGTH = 280;
+export declare const INVITE_STATUSES: readonly ["pending", "accepted", "expired", "revoked"];
+export declare const inviteStatusSchema: z.ZodEnum<{
+    expired: "expired";
+    pending: "pending";
+    accepted: "accepted";
+    revoked: "revoked";
+}>;
+export type InviteStatus = z.infer<typeof inviteStatusSchema>;
 export declare const spaceInviteSchema: z.ZodObject<{
     id: z.ZodString;
     spaceId: z.ZodString;
-    email: z.ZodString;
+    email: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    invitedBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    message: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     status: z.ZodEnum<{
+        expired: "expired";
         pending: "pending";
         accepted: "accepted";
         revoked: "revoked";
-        expired: "expired";
     }>;
-    grant: z.ZodString;
-    invitedBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    expiresAt: z.ZodNumber;
     acceptedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    revokedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     createdAt: z.ZodString;
+    lastViewedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export type SpaceInvite = z.infer<typeof spaceInviteSchema>;
-export declare const shareLinkCreateRequestSchema: z.ZodObject<{
-    pathPrefix: z.ZodDefault<z.ZodString>;
-    expiresAt: z.ZodOptional<z.ZodString>;
-    label: z.ZodOptional<z.ZodString>;
+export declare const spaceInviteCreateSchema: z.ZodObject<{
+    email: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-export type ShareLinkCreateRequest = z.infer<typeof shareLinkCreateRequestSchema>;
-export declare const shareLinkSchema: z.ZodObject<{
+export declare const ACCESS_REQUEST_STATUSES: readonly ["pending", "approved", "denied"];
+export declare const accessRequestStatusSchema: z.ZodEnum<{
+    pending: "pending";
+    approved: "approved";
+    denied: "denied";
+}>;
+export declare const accessRequestSchema: z.ZodObject<{
     id: z.ZodString;
     spaceId: z.ZodString;
-    pathPrefix: z.ZodString;
-    label: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    grant: z.ZodString;
-    url: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    createdBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    revokedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    email: z.ZodString;
+    userId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    host: z.ZodString;
+    path: z.ZodString;
+    message: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    status: z.ZodEnum<{
+        pending: "pending";
+        approved: "approved";
+        denied: "denied";
+    }>;
+    resolvedBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    resolvedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     createdAt: z.ZodString;
 }, z.core.$strip>;
-export type ShareLink = z.infer<typeof shareLinkSchema>;
+export type AccessRequest = z.infer<typeof accessRequestSchema>;
+export declare const accessRequestCreateSchema: z.ZodObject<{
+    space: z.ZodString;
+    host: z.ZodString;
+    path: z.ZodDefault<z.ZodString>;
+    nonce: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const accessRequestApproveSchema: z.ZodObject<{
+    as: z.ZodDefault<z.ZodEnum<{
+        team: "team";
+        invite: "invite";
+    }>>;
+}, z.core.$strip>;
+export declare const FILE_SHARE_AUDIENCES: readonly ["public", "people"];
+export declare const fileShareAudienceSchema: z.ZodEnum<{
+    public: "public";
+    people: "people";
+}>;
+export type FileShareAudience = z.infer<typeof fileShareAudienceSchema>;
+export declare const fileShareSchema: z.ZodObject<{
+    path: z.ZodString;
+    audience: z.ZodEnum<{
+        public: "public";
+        people: "people";
+    }>;
+    grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    patterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type FileShare = z.infer<typeof fileShareSchema>;
+export declare const fileShareWriteSchema: z.ZodObject<{
+    path: z.ZodString;
+    audience: z.ZodEnum<{
+        public: "public";
+        people: "people";
+    }>;
+    grants: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const sharingRequestSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    message: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    createdAt: z.ZodString;
+    host: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    path: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type SharingRequest = z.infer<typeof sharingRequestSchema>;
+export declare const SERVICE_TOKEN_DEFAULT_TTL_SECONDS: number;
+export declare const SERVICE_TOKEN_AUDIENCES: readonly ["viewers"];
+export declare const serviceTokenAudienceSchema: z.ZodEnum<{
+    viewers: "viewers";
+}>;
+export declare const serviceTokenActsAsSchema: z.ZodObject<{
+    audiences: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        viewers: "viewers";
+    }>>>;
+}, z.core.$strip>;
+export type ServiceTokenActsAs = z.infer<typeof serviceTokenActsAsSchema>;
+export declare const serviceTokenSchema: z.ZodObject<{
+    id: z.ZodString;
+    teamId: z.ZodString;
+    spaceId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    name: z.ZodString;
+    actsAs: z.ZodObject<{
+        audiences: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            viewers: "viewers";
+        }>>>;
+    }, z.core.$strip>;
+    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    createdAt: z.ZodString;
+    active: z.ZodBoolean;
+}, z.core.$strip>;
+export type ServiceToken = z.infer<typeof serviceTokenSchema>;
+export declare const serviceTokenCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    spaceId: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    actsAs: z.ZodOptional<z.ZodObject<{
+        audiences: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            viewers: "viewers";
+        }>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ServiceTokenCreate = z.infer<typeof serviceTokenCreateSchema>;
+export declare const serviceTokenWithSecretSchema: z.ZodObject<{
+    id: z.ZodString;
+    teamId: z.ZodString;
+    spaceId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    name: z.ZodString;
+    actsAs: z.ZodObject<{
+        audiences: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            viewers: "viewers";
+        }>>>;
+    }, z.core.$strip>;
+    expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    createdAt: z.ZodString;
+    active: z.ZodBoolean;
+    token: z.ZodString;
+}, z.core.$strip>;
+export type ServiceTokenWithSecret = z.infer<typeof serviceTokenWithSecretSchema>;
+export declare const FIREWALL_EFFECTS: readonly ["deny", "challenge"];
+export declare const firewallEffectSchema: z.ZodEnum<{
+    deny: "deny";
+    challenge: "challenge";
+}>;
+export type FirewallEffect = z.infer<typeof firewallEffectSchema>;
+export declare const firewallCountriesSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        allow: "allow";
+        block: "block";
+    }>;
+    list: z.ZodArray<z.ZodString>;
+    effect: z.ZodDefault<z.ZodEnum<{
+        deny: "deny";
+        challenge: "challenge";
+    }>>;
+}, z.core.$strip>;
+export type FirewallCountries = z.infer<typeof firewallCountriesSchema>;
+export declare const firewallIpEntrySchema: z.ZodObject<{
+    cidr: z.ZodString;
+    effect: z.ZodDefault<z.ZodEnum<{
+        deny: "deny";
+        challenge: "challenge";
+    }>>;
+}, z.core.$strip>;
+export type FirewallIpEntry = z.infer<typeof firewallIpEntrySchema>;
+export declare const firewallBotEntrySchema: z.ZodObject<{
+    agent: z.ZodString;
+    effect: z.ZodDefault<z.ZodEnum<{
+        deny: "deny";
+        challenge: "challenge";
+    }>>;
+}, z.core.$strip>;
+export type FirewallBotEntry = z.infer<typeof firewallBotEntrySchema>;
+export declare const firewallWriteSchema: z.ZodObject<{
+    countries: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        mode: z.ZodEnum<{
+            allow: "allow";
+            block: "block";
+        }>;
+        list: z.ZodArray<z.ZodString>;
+        effect: z.ZodDefault<z.ZodEnum<{
+            deny: "deny";
+            challenge: "challenge";
+        }>>;
+    }, z.core.$strip>>>;
+    ipCidrs: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        cidr: z.ZodString;
+        effect: z.ZodDefault<z.ZodEnum<{
+            deny: "deny";
+            challenge: "challenge";
+        }>>;
+    }, z.core.$strip>>>;
+    bots: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        agent: z.ZodString;
+        effect: z.ZodDefault<z.ZodEnum<{
+            deny: "deny";
+            challenge: "challenge";
+        }>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type FirewallWrite = z.infer<typeof firewallWriteSchema>;
+export declare const spaceFirewallSchema: z.ZodObject<{
+    countries: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        mode: z.ZodEnum<{
+            allow: "allow";
+            block: "block";
+        }>;
+        list: z.ZodArray<z.ZodString>;
+        effect: z.ZodDefault<z.ZodEnum<{
+            deny: "deny";
+            challenge: "challenge";
+        }>>;
+    }, z.core.$strip>>>;
+    ipCidrs: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        cidr: z.ZodString;
+        effect: z.ZodDefault<z.ZodEnum<{
+            deny: "deny";
+            challenge: "challenge";
+        }>>;
+    }, z.core.$strip>>>;
+    bots: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        agent: z.ZodString;
+        effect: z.ZodDefault<z.ZodEnum<{
+            deny: "deny";
+            challenge: "challenge";
+        }>>;
+    }, z.core.$strip>>>;
+    custom: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type SpaceFirewall = z.infer<typeof spaceFirewallSchema>;
+export declare const TEAM_PREVIEW_LOCK_LIVE_RULE_ID = "team-preview-lock:live";
+export declare const TEAM_PREVIEW_LOCK_RULE_ID = "team-preview-lock";
+export declare function teamPreviewLockRules(teamId: string): RuntimeRule[];
+export declare function isTeamPreviewLockRule(rule: Pick<RuntimeRule, "id">): boolean;
+export declare function teamPreviewLockActive(rules: ReadonlyArray<Pick<RuntimeRule, "id">>): boolean;
+export declare function withTeamPreviewLock(rules: RuntimeRule[], teamId: string, enabled: boolean): RuntimeRule[];
+export declare const spaceSharingSchema: z.ZodObject<{
+    generalAccess: z.ZodObject<{
+        mode: z.ZodEnum<{
+            link: "link";
+            password: "password";
+            public: "public";
+            people: "people";
+        }>;
+        hasPassword: z.ZodBoolean;
+    }, z.core.$strip>;
+    people: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            team_member: "team_member";
+            invitee: "invitee";
+        }>;
+        userId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        email: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        teamRole: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        level: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+            viewer: "viewer";
+            commenter: "commenter";
+            editor: "editor";
+            admin: "admin";
+        }>>>;
+        inviteId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        status: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+            expired: "expired";
+            pending: "pending";
+            accepted: "accepted";
+        }>>>;
+        lastViewedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    audiences: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        type: z.ZodEnum<{
+            external: "external";
+            oidc: "oidc";
+        }>;
+        name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        tag: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        emailDomain: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        grant: z.ZodString;
+    }, z.core.$strip>>>;
+    links: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        spaceId: z.ZodString;
+        label: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        path: z.ZodString;
+        createdBy: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        expiresAt: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+        createdAt: z.ZodString;
+        lastUsedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        useCount: z.ZodDefault<z.ZodNumber>;
+        active: z.ZodBoolean;
+    }, z.core.$strip>>>;
+    fileShares: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        audience: z.ZodEnum<{
+            public: "public";
+            people: "people";
+        }>;
+        grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        patterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    requests: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        message: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        createdAt: z.ZodString;
+        host: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        path: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+    customRulesActive: z.ZodBoolean;
+    accessExceedsPlan: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type SpaceSharing = z.infer<typeof spaceSharingSchema>;
 export declare const channelSchema: z.ZodObject<{
     name: z.ZodString;
     versionId: z.ZodString;
@@ -206,11 +776,13 @@ export declare const servingConfigSchema: z.ZodObject<{
     fallback: z.ZodOptional<z.ZodString>;
     listing: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
-export type ServingConfig = z.infer<typeof servingConfigSchema>;
 export declare const policyDocSchema: z.ZodObject<{
     rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
         match: z.ZodDefault<z.ZodObject<{
             host: z.ZodOptional<z.ZodString>;
+            hostPattern: z.ZodOptional<z.ZodString>;
+            hostTemplate: z.ZodOptional<z.ZodString>;
             pathPattern: z.ZodOptional<z.ZodString>;
             channel: z.ZodOptional<z.ZodString>;
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -227,35 +799,54 @@ export declare const policyDocSchema: z.ZodObject<{
             challenge: "challenge";
         }>;
         auth: z.ZodOptional<z.ZodObject<{
-            password: z.ZodOptional<z.ZodObject<{
+            requiredGrants: z.ZodArray<z.ZodString>;
+            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                kid: z.ZodString;
+                alg: z.ZodLiteral<"EdDSA">;
+                publicKey: z.ZodString;
+                grantNamespaces: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"password">;
                 ref: z.ZodString;
                 transport: z.ZodEnum<{
                     basic: "basic";
                     form: "form";
                 }>;
                 username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
-            token: z.ZodOptional<z.ZodObject<{
-                requiredGrants: z.ZodArray<z.ZodString>;
-                issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                    kid: z.ZodString;
-                    alg: z.ZodLiteral<"EdDSA">;
-                    publicKey: z.ZodString;
-                    grantNamespaces: z.ZodArray<z.ZodString>;
-                }, z.core.$strip>>>;
-                loginUrl: z.ZodOptional<z.ZodString>;
-                cookieName: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"login">;
+                url: z.ZodString;
+                label: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>], "type">>>;
         }, z.core.$strip>>;
+        managedBy: z.ZodOptional<z.ZodEnum<{
+            sharing: "sharing";
+            firewall: "firewall";
+            file_share: "file_share";
+            cast_reviewer: "cast_reviewer";
+            team_default: "team_default";
+        }>>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
         reasonCode: z.ZodOptional<z.ZodString>;
         message: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
+    issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        alg: z.ZodLiteral<"EdDSA">;
+        publicKey: z.ZodString;
+        grantNamespaces: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+    sessionVersion: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type PolicyDoc = z.infer<typeof policyDocSchema>;
 export declare const spacePolicySchema: z.ZodObject<{
     rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
         match: z.ZodDefault<z.ZodObject<{
             host: z.ZodOptional<z.ZodString>;
+            hostPattern: z.ZodOptional<z.ZodString>;
+            hostTemplate: z.ZodOptional<z.ZodString>;
             pathPattern: z.ZodOptional<z.ZodString>;
             channel: z.ZodOptional<z.ZodString>;
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -272,26 +863,35 @@ export declare const spacePolicySchema: z.ZodObject<{
             challenge: "challenge";
         }>;
         auth: z.ZodOptional<z.ZodObject<{
-            password: z.ZodOptional<z.ZodObject<{
+            requiredGrants: z.ZodArray<z.ZodString>;
+            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                kid: z.ZodString;
+                alg: z.ZodLiteral<"EdDSA">;
+                publicKey: z.ZodString;
+                grantNamespaces: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"password">;
                 ref: z.ZodString;
                 transport: z.ZodEnum<{
                     basic: "basic";
                     form: "form";
                 }>;
                 username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
-            token: z.ZodOptional<z.ZodObject<{
-                requiredGrants: z.ZodArray<z.ZodString>;
-                issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                    kid: z.ZodString;
-                    alg: z.ZodLiteral<"EdDSA">;
-                    publicKey: z.ZodString;
-                    grantNamespaces: z.ZodArray<z.ZodString>;
-                }, z.core.$strip>>>;
-                loginUrl: z.ZodOptional<z.ZodString>;
-                cookieName: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"login">;
+                url: z.ZodString;
+                label: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>], "type">>>;
         }, z.core.$strip>>;
+        managedBy: z.ZodOptional<z.ZodEnum<{
+            sharing: "sharing";
+            firewall: "firewall";
+            file_share: "file_share";
+            cast_reviewer: "cast_reviewer";
+            team_default: "team_default";
+        }>>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
         reasonCode: z.ZodOptional<z.ZodString>;
         message: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
@@ -299,14 +899,16 @@ export declare const spacePolicySchema: z.ZodObject<{
 }, z.core.$strip>;
 export type SpacePolicy = z.infer<typeof spacePolicySchema>;
 export declare const ruleSourceSchema: z.ZodEnum<{
+    cloud: "cloud";
     file: "file";
     platform: "platform";
-    cloud: "cloud";
 }>;
-export type RuleSource = z.infer<typeof ruleSourceSchema>;
 export declare const effectiveRuleSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
     match: z.ZodDefault<z.ZodObject<{
         host: z.ZodOptional<z.ZodString>;
+        hostPattern: z.ZodOptional<z.ZodString>;
+        hostTemplate: z.ZodOptional<z.ZodString>;
         pathPattern: z.ZodOptional<z.ZodString>;
         channel: z.ZodOptional<z.ZodString>;
         ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -323,40 +925,52 @@ export declare const effectiveRuleSchema: z.ZodObject<{
         challenge: "challenge";
     }>;
     auth: z.ZodOptional<z.ZodObject<{
-        password: z.ZodOptional<z.ZodObject<{
+        requiredGrants: z.ZodArray<z.ZodString>;
+        issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            kid: z.ZodString;
+            alg: z.ZodLiteral<"EdDSA">;
+            publicKey: z.ZodString;
+            grantNamespaces: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+        acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"password">;
             ref: z.ZodString;
             transport: z.ZodEnum<{
                 basic: "basic";
                 form: "form";
             }>;
             username: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
-        token: z.ZodOptional<z.ZodObject<{
-            requiredGrants: z.ZodArray<z.ZodString>;
-            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                kid: z.ZodString;
-                alg: z.ZodLiteral<"EdDSA">;
-                publicKey: z.ZodString;
-                grantNamespaces: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>>>;
-            loginUrl: z.ZodOptional<z.ZodString>;
-            cookieName: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"login">;
+            url: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>], "type">>>;
     }, z.core.$strip>>;
+    managedBy: z.ZodOptional<z.ZodEnum<{
+        sharing: "sharing";
+        firewall: "firewall";
+        file_share: "file_share";
+        cast_reviewer: "cast_reviewer";
+        team_default: "team_default";
+    }>>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
     reasonCode: z.ZodOptional<z.ZodString>;
     message: z.ZodOptional<z.ZodString>;
     source: z.ZodEnum<{
+        cloud: "cloud";
         file: "file";
         platform: "platform";
-        cloud: "cloud";
     }>;
     order: z.ZodNumber;
 }, z.core.$strip>;
 export type EffectiveRule = z.infer<typeof effectiveRuleSchema>;
 export declare const effectivePolicySchema: z.ZodObject<{
     rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
         match: z.ZodDefault<z.ZodObject<{
             host: z.ZodOptional<z.ZodString>;
+            hostPattern: z.ZodOptional<z.ZodString>;
+            hostTemplate: z.ZodOptional<z.ZodString>;
             pathPattern: z.ZodOptional<z.ZodString>;
             channel: z.ZodOptional<z.ZodString>;
             ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -373,37 +987,123 @@ export declare const effectivePolicySchema: z.ZodObject<{
             challenge: "challenge";
         }>;
         auth: z.ZodOptional<z.ZodObject<{
-            password: z.ZodOptional<z.ZodObject<{
+            requiredGrants: z.ZodArray<z.ZodString>;
+            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                kid: z.ZodString;
+                alg: z.ZodLiteral<"EdDSA">;
+                publicKey: z.ZodString;
+                grantNamespaces: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"password">;
                 ref: z.ZodString;
                 transport: z.ZodEnum<{
                     basic: "basic";
                     form: "form";
                 }>;
                 username: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
-            token: z.ZodOptional<z.ZodObject<{
-                requiredGrants: z.ZodArray<z.ZodString>;
-                issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                    kid: z.ZodString;
-                    alg: z.ZodLiteral<"EdDSA">;
-                    publicKey: z.ZodString;
-                    grantNamespaces: z.ZodArray<z.ZodString>;
-                }, z.core.$strip>>>;
-                loginUrl: z.ZodOptional<z.ZodString>;
-                cookieName: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"login">;
+                url: z.ZodString;
+                label: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>], "type">>>;
         }, z.core.$strip>>;
+        managedBy: z.ZodOptional<z.ZodEnum<{
+            sharing: "sharing";
+            firewall: "firewall";
+            file_share: "file_share";
+            cast_reviewer: "cast_reviewer";
+            team_default: "team_default";
+        }>>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
         reasonCode: z.ZodOptional<z.ZodString>;
         message: z.ZodOptional<z.ZodString>;
         source: z.ZodEnum<{
+            cloud: "cloud";
             file: "file";
             platform: "platform";
-            cloud: "cloud";
         }>;
         order: z.ZodNumber;
     }, z.core.$strip>>>;
+    issuers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        alg: z.ZodLiteral<"EdDSA">;
+        publicKey: z.ZodString;
+        grantNamespaces: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
     cloudVersion: z.ZodDefault<z.ZodNumber>;
     fileVersion: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     secrets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    sessionVersion: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strip>;
 export type EffectivePolicy = z.infer<typeof effectivePolicySchema>;
+export declare const accessSimulateResultSchema: z.ZodObject<{
+    verdict: z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+        challenge: "challenge";
+    }>;
+    matchedRule: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        match: z.ZodDefault<z.ZodObject<{
+            host: z.ZodOptional<z.ZodString>;
+            hostPattern: z.ZodOptional<z.ZodString>;
+            hostTemplate: z.ZodOptional<z.ZodString>;
+            pathPattern: z.ZodOptional<z.ZodString>;
+            channel: z.ZodOptional<z.ZodString>;
+            ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            agent: z.ZodOptional<z.ZodString>;
+            country: z.ZodOptional<z.ZodString>;
+            header: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+            challenge: "challenge";
+        }>;
+        auth: z.ZodOptional<z.ZodObject<{
+            requiredGrants: z.ZodArray<z.ZodString>;
+            issuers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                kid: z.ZodString;
+                alg: z.ZodLiteral<"EdDSA">;
+                publicKey: z.ZodString;
+                grantNamespaces: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            acquire: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"password">;
+                ref: z.ZodString;
+                transport: z.ZodEnum<{
+                    basic: "basic";
+                    form: "form";
+                }>;
+                username: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"login">;
+                url: z.ZodString;
+                label: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>], "type">>>;
+        }, z.core.$strip>>;
+        managedBy: z.ZodOptional<z.ZodEnum<{
+            sharing: "sharing";
+            firewall: "firewall";
+            file_share: "file_share";
+            cast_reviewer: "cast_reviewer";
+            team_default: "team_default";
+        }>>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+        reasonCode: z.ZodOptional<z.ZodString>;
+        message: z.ZodOptional<z.ZodString>;
+        source: z.ZodEnum<{
+            cloud: "cloud";
+            file: "file";
+            platform: "platform";
+        }>;
+        order: z.ZodNumber;
+    }, z.core.$strip>>>;
+    why: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    whoWouldPass: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type AccessSimulateResult = z.infer<typeof accessSimulateResultSchema>;