@spacefast/common 0.2.1 → 0.4.1

package/dist/contracts/grants-core.js

@@ -0,0 +1,435 @@
+import { z } from "zod";
+import { ISO_COUNTRY_CODES } from "./countries.js";
+// The grant VOCABULARY: what an authority looks like, independent of who holds
+// one. A capability set, a resource pattern set, a target selector and the
+// constraints that fence them are the same grammar wherever a runtime enforces
+// them, so this half carries no host concepts and no host ids.
+//
+// WHO holds a grant — audiences, sources, stored Grant records, credentials,
+// identity connections — is Spacefast's sharing model and lives in `./grants.js`.
+export const GRANT_CAPABILITIES = [
+    "page.view",
+    "comments.read",
+    "comments.write",
+    "content.publish",
+    "access.manage",
+];
+export const grantCapabilitySchema = z.enum(GRANT_CAPABILITIES);
+/** An opaque reference to something a grant points at (a version, a branch, a holder). */
+export const grantReferenceSchema = z.string().trim().min(1).max(255);
+/**
+ * A verification key an external token issuer publishes: a key id and a raw
+ * Ed25519 public key, base64url-encoded. Key material, not a host concept — the
+ * same shape serves identity connections and a partner's declared issuers.
+ */
+export const identityConnectionPublicKeySchema = z
+    .object({
+    kid: z.string().min(1).max(64),
+    publicKey: z
+        .string()
+        .regex(/^[A-Za-z0-9_-]{43}$/, "publicKey must be a raw Ed25519 public key"),
+})
+    .strict();
+function hasUnsafePatternCharacter(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if (codePoint === undefined ||
+            codePoint <= 0x1f ||
+            codePoint === 0x7f ||
+            character === "\\" ||
+            character === "?" ||
+            character === "#") {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Canonical resource-pattern syntax shared by config compilation and evaluation.
+ * `*` matches one path segment and `**` matches zero or more segments. Wildcards
+ * are whole segments so a pattern can never disguise an encoded separator.
+ *
+ * Unlike URL-route canonicalization, resource patterns retain a terminal
+ * `index.html`: Grants can constrain the visitor-facing route and the artifact
+ * it resolves to independently.
+ */
+export function normalizeGrantResourcePattern(input) {
+    if (!input.startsWith("/") || input.startsWith("//") || hasUnsafePatternCharacter(input)) {
+        throw new TypeError("resource pattern must be a plain absolute URL path pattern");
+    }
+    if (/%2f|%5c|%2a/iu.test(input)) {
+        throw new TypeError("resource pattern contains an ambiguous encoded separator or wildcard");
+    }
+    let decoded;
+    try {
+        decoded = decodeURIComponent(input);
+    }
+    catch {
+        throw new TypeError("resource pattern contains malformed percent encoding");
+    }
+    if (hasUnsafePatternCharacter(decoded)) {
+        throw new TypeError("resource pattern contains an unsafe character");
+    }
+    const segments = [];
+    for (const rawSegment of decoded.split("/")) {
+        const segment = rawSegment.normalize("NFC");
+        if (segment === "" || segment === ".")
+            continue;
+        if (segment === "..") {
+            if (segments.length === 0)
+                throw new TypeError("resource pattern escapes the URL root");
+            segments.pop();
+            continue;
+        }
+        if (segment.includes("*") && segment !== "*" && segment !== "**") {
+            throw new TypeError("resource wildcards must occupy a whole path segment");
+        }
+        segments.push(segment);
+    }
+    return segments.length === 0 ? "/" : `/${segments.join("/")}`;
+}
+export const grantResourcePatternSchema = z
+    .string()
+    .min(1)
+    .max(1024)
+    .check((context) => {
+    try {
+        context.value = normalizeGrantResourcePattern(context.value);
+    }
+    catch (error) {
+        context.issues.push({
+            code: "custom",
+            input: context.value,
+            message: error instanceof Error ? error.message : "invalid resource pattern",
+        });
+    }
+});
+export function uniqueArray(values) {
+    return new Set(values).size === values.length;
+}
+export const GRANT_RESOURCE_PATTERN_LIMIT = 100;
+export const grantResourceSetSchema = z
+    .object({
+    include: z.array(grantResourcePatternSchema).min(1).max(GRANT_RESOURCE_PATTERN_LIMIT),
+    exclude: z.array(grantResourcePatternSchema).max(GRANT_RESOURCE_PATTERN_LIMIT).default([]),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.include.length + value.exclude.length > GRANT_RESOURCE_PATTERN_LIMIT) {
+        context.addIssue({
+            code: "custom",
+            message: `resource sets support up to ${GRANT_RESOURCE_PATTERN_LIMIT} patterns`,
+        });
+    }
+    if (!uniqueArray(value.include)) {
+        context.addIssue({
+            code: "custom",
+            path: ["include"],
+            message: "include patterns must be unique",
+        });
+    }
+    if (!uniqueArray(value.exclude)) {
+        context.addIssue({
+            code: "custom",
+            path: ["exclude"],
+            message: "exclude patterns must be unique",
+        });
+    }
+});
+export const GRANT_TARGET_KINDS = ["live", "version", "branch", "all_versions"];
+export const grantTargetKindSchema = z.enum(GRANT_TARGET_KINDS);
+export const grantTargetSelectorSchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("live") }).strict(),
+    z.object({ kind: z.literal("version"), versionId: grantReferenceSchema }).strict(),
+    z.object({ kind: z.literal("branch"), branch: grantReferenceSchema }).strict(),
+    z.object({ kind: z.literal("all_versions") }).strict(),
+]);
+function parseIpv4(input) {
+    const parts = input.split(".");
+    if (parts.length !== 4)
+        return null;
+    let bits = 0n;
+    for (const part of parts) {
+        if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(part))
+            return null;
+        const value = Number(part);
+        if (value > 255)
+            return null;
+        bits = (bits << 8n) | BigInt(value);
+    }
+    return { bits, width: 32 };
+}
+function parseIpv6(input) {
+    if (input === "" || input.includes("%") || input.split("::").length > 2)
+        return null;
+    let value = input.toLowerCase();
+    const ipv4Tail = value.match(/(?:^|:)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)$/u)?.[1];
+    if (ipv4Tail) {
+        const parsed = parseIpv4(ipv4Tail);
+        if (!parsed)
+            return null;
+        value = `${value.slice(0, -ipv4Tail.length)}${Number((parsed.bits >> 16n) & 0xffffn).toString(16)}:${Number(parsed.bits & 0xffffn).toString(16)}`;
+    }
+    const [leftText, rightText] = value.split("::");
+    const left = leftText ? leftText.split(":") : [];
+    const right = rightText ? rightText.split(":") : [];
+    if ([...left, ...right].some((part) => !/^[0-9a-f]{1,4}$/u.test(part)))
+        return null;
+    const compressed = value.includes("::");
+    const missing = 8 - left.length - right.length;
+    if ((!compressed && missing !== 0) || (compressed && missing < 1))
+        return null;
+    const parts = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+    if (parts.length !== 8)
+        return null;
+    return {
+        bits: parts.reduce((bits, part) => (bits << 16n) | BigInt(`0x${part}`), 0n),
+        width: 128,
+    };
+}
+function parseIpAddress(input) {
+    return parseIpv4(input) ?? parseIpv6(input);
+}
+export function normalizeGrantNetworkCidr(input) {
+    const value = input.trim().toLowerCase();
+    const separator = value.lastIndexOf("/");
+    const address = separator === -1 ? value : value.slice(0, separator);
+    const parsed = parseIpAddress(address);
+    if (!parsed)
+        throw new TypeError("network rules require a valid IPv4 or IPv6 address");
+    if (separator === -1)
+        return value;
+    const prefixText = value.slice(separator + 1);
+    if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(prefixText)) {
+        throw new TypeError("network rules require a valid CIDR prefix");
+    }
+    const prefix = Number(prefixText);
+    if (prefix > parsed.width)
+        throw new TypeError("network CIDR prefix exceeds its address width");
+    return `${address}/${prefix}`;
+}
+export function grantNetworkCidrMatches(cidr, ipAddress) {
+    let canonical;
+    try {
+        canonical = normalizeGrantNetworkCidr(cidr);
+    }
+    catch {
+        return false;
+    }
+    const separator = canonical.lastIndexOf("/");
+    const networkText = separator === -1 ? canonical : canonical.slice(0, separator);
+    const network = parseIpAddress(networkText);
+    const address = parseIpAddress(ipAddress.trim().toLowerCase());
+    if (!network || !address || network.width !== address.width)
+        return false;
+    const prefix = separator === -1 ? network.width : Number(canonical.slice(separator + 1));
+    if (prefix === 0)
+        return true;
+    const shift = BigInt(network.width - prefix);
+    return network.bits >> shift === address.bits >> shift;
+}
+const grantNetworkCidrSchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .check((context) => {
+    try {
+        context.value = normalizeGrantNetworkCidr(context.value);
+    }
+    catch (error) {
+        context.issues.push({
+            code: "custom",
+            input: context.value,
+            message: error instanceof Error ? error.message : "invalid network rule",
+        });
+    }
+});
+const grantCountrySchema = z
+    .string()
+    .length(2)
+    .overwrite((country) => country.toUpperCase())
+    .refine((country) => ISO_COUNTRY_CODES.some((candidate) => candidate === country), "Country must be an ISO 3166-1 alpha-2 code.");
+const grantConstraintDateSchema = z.string().datetime();
+const grantConstraintMaxUsesSchema = z.number().int().positive().max(1_000_000);
+const grantConstraintIpCidrsSchema = z.array(grantNetworkCidrSchema).min(1).max(50);
+const grantConstraintCountriesSchema = z.array(grantCountrySchema).min(1).max(250);
+const grantConstraintUserAgentsSchema = z.array(z.string().trim().min(1).max(200)).min(1).max(50);
+const grantNetworkConstraintsSchema = z
+    .object({
+    ipCidrs: grantConstraintIpCidrsSchema.optional(),
+    countries: grantConstraintCountriesSchema.optional(),
+    excludedCountries: grantConstraintCountriesSchema.optional(),
+    excludedUserAgentSubstrings: grantConstraintUserAgentsSchema.optional(),
+})
+    .strict()
+    .superRefine((network, context) => {
+    if (network.ipCidrs === undefined &&
+        network.countries === undefined &&
+        network.excludedCountries === undefined &&
+        network.excludedUserAgentSubstrings === undefined) {
+        context.addIssue({
+            code: "custom",
+            message: "network requires at least one IP, country, or user-agent selector",
+        });
+    }
+});
+export const grantFrameOriginSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(2_048)
+    .check((context) => {
+    let url;
+    try {
+        url = new URL(context.value);
+    }
+    catch {
+        context.issues.push({
+            code: "custom",
+            input: context.value,
+            message: "frameOrigin must be an HTTPS origin",
+        });
+        return;
+    }
+    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) ||
+        url.username ||
+        url.password ||
+        url.pathname !== "/" ||
+        url.search ||
+        url.hash) {
+        context.issues.push({
+            code: "custom",
+            input: context.value,
+            message: "frameOrigin must be an HTTPS origin without a path, query, or credentials",
+        });
+        return;
+    }
+    context.value = url.origin;
+});
+export const grantConstraintsSchema = z
+    .object({
+    notBefore: grantConstraintDateSchema.optional(),
+    expiresAt: grantConstraintDateSchema.optional(),
+    maxUses: grantConstraintMaxUsesSchema.optional(),
+    requireVerifiedEmail: z.boolean().optional(),
+    network: grantNetworkConstraintsSchema.optional(),
+    frameOrigin: grantFrameOriginSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.notBefore !== undefined &&
+        value.expiresAt !== undefined &&
+        Date.parse(value.notBefore) >= Date.parse(value.expiresAt)) {
+        context.addIssue({
+            code: "custom",
+            path: ["expiresAt"],
+            message: "expiresAt must be later than notBefore",
+        });
+    }
+});
+/** Field-scoped PATCH shape. `null` clears one constraint without replacing its siblings. */
+export const grantConstraintsPatchSchema = z
+    .object({
+    notBefore: grantConstraintDateSchema.nullable().optional(),
+    expiresAt: grantConstraintDateSchema.nullable().optional(),
+    maxUses: grantConstraintMaxUsesSchema.nullable().optional(),
+    requireVerifiedEmail: z.boolean().nullable().optional(),
+    frameOrigin: grantFrameOriginSchema.nullable().optional(),
+    network: z
+        .object({
+        ipCidrs: grantConstraintIpCidrsSchema.nullable().optional(),
+        countries: grantConstraintCountriesSchema.nullable().optional(),
+        excludedCountries: grantConstraintCountriesSchema.nullable().optional(),
+        excludedUserAgentSubstrings: grantConstraintUserAgentsSchema.nullable().optional(),
+    })
+        .strict()
+        .nullable()
+        .optional(),
+})
+    .strict();
+export function diffGrantConstraints(original, draft) {
+    let network;
+    if (JSON.stringify(original.network) === JSON.stringify(draft.network)) {
+        network = undefined;
+    }
+    else if (draft.network === undefined) {
+        network = null;
+    }
+    else {
+        const changedNetwork = {};
+        if (JSON.stringify(original.network?.ipCidrs) !== JSON.stringify(draft.network.ipCidrs)) {
+            changedNetwork.ipCidrs = draft.network.ipCidrs ?? null;
+        }
+        if (JSON.stringify(original.network?.countries) !== JSON.stringify(draft.network.countries)) {
+            changedNetwork.countries = draft.network.countries ?? null;
+        }
+        if (JSON.stringify(original.network?.excludedCountries) !==
+            JSON.stringify(draft.network.excludedCountries)) {
+            changedNetwork.excludedCountries = draft.network.excludedCountries ?? null;
+        }
+        if (JSON.stringify(original.network?.excludedUserAgentSubstrings) !==
+            JSON.stringify(draft.network.excludedUserAgentSubstrings)) {
+            changedNetwork.excludedUserAgentSubstrings =
+                draft.network.excludedUserAgentSubstrings ?? null;
+        }
+        network = changedNetwork;
+    }
+    const patch = {};
+    if (original.notBefore !== draft.notBefore) {
+        patch.notBefore = draft.notBefore ?? null;
+    }
+    if (original.expiresAt !== draft.expiresAt) {
+        patch.expiresAt = draft.expiresAt ?? null;
+    }
+    if (original.maxUses !== draft.maxUses) {
+        patch.maxUses = draft.maxUses ?? null;
+    }
+    if (original.requireVerifiedEmail !== draft.requireVerifiedEmail) {
+        patch.requireVerifiedEmail = draft.requireVerifiedEmail ?? null;
+    }
+    if (network !== undefined) {
+        patch.network = network;
+    }
+    if (original.frameOrigin !== draft.frameOrigin) {
+        patch.frameOrigin = draft.frameOrigin ?? null;
+    }
+    return Object.keys(patch).length === 0 ? undefined : patch;
+}
+export function applyGrantConstraintsPatch(current, patch) {
+    let network = current.network;
+    if (patch.network === null) {
+        network = undefined;
+    }
+    else if (patch.network !== undefined) {
+        network = { ...current.network };
+        if (patch.network.ipCidrs !== undefined) {
+            network.ipCidrs = patch.network.ipCidrs ?? undefined;
+        }
+        if (patch.network.countries !== undefined) {
+            network.countries = patch.network.countries ?? undefined;
+        }
+        if (patch.network.excludedCountries !== undefined) {
+            network.excludedCountries = patch.network.excludedCountries ?? undefined;
+        }
+        if (patch.network.excludedUserAgentSubstrings !== undefined) {
+            network.excludedUserAgentSubstrings = patch.network.excludedUserAgentSubstrings ?? undefined;
+        }
+    }
+    const compactNetwork = network && Object.values(network).some((value) => value !== undefined) ? network : undefined;
+    const next = {
+        ...current,
+        frameOrigin: patch.frameOrigin === undefined ? current.frameOrigin : (patch.frameOrigin ?? undefined),
+        network: compactNetwork,
+    };
+    if (patch.notBefore !== undefined)
+        next.notBefore = patch.notBefore ?? undefined;
+    if (patch.expiresAt !== undefined)
+        next.expiresAt = patch.expiresAt ?? undefined;
+    if (patch.maxUses !== undefined)
+        next.maxUses = patch.maxUses ?? undefined;
+    if (patch.requireVerifiedEmail !== undefined) {
+        next.requireVerifiedEmail = patch.requireVerifiedEmail ?? undefined;
+    }
+    return grantConstraintsSchema.parse(next);
+}

package/dist/contracts/grants.d.ts

@@ -1,13 +1,5 @@
 import { z } from "zod";
-export declare const GRANT_CAPABILITIES: readonly ["page.view", "comments.read", "comments.write", "content.publish", "access.manage"];
-export declare const grantCapabilitySchema: z.ZodEnum<{
-    "page.view": "page.view";
-    "comments.read": "comments.read";
-    "comments.write": "comments.write";
-    "content.publish": "content.publish";
-    "access.manage": "access.manage";
-}>;
-export type GrantCapability = z.infer<typeof grantCapabilitySchema>;
+export * from "./grants-core.js";
 export declare const GRANT_AUDIENCE_KINDS: readonly ["public", "team", "person", "link", "password", "machine", "external"];
 export declare const grantAudienceKindSchema: z.ZodEnum<{
     link: "link";
@@ -42,75 +34,6 @@ export declare const grantAudienceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     subject: z.ZodString;
 }, z.core.$strict>], "kind">;
 export type GrantAudience = z.infer<typeof grantAudienceSchema>;
-/**
- * Canonical resource-pattern syntax shared by config compilation and evaluation.
- * `*` matches one path segment and `**` matches zero or more segments. Wildcards
- * are whole segments so a pattern can never disguise an encoded separator.
- *
- * Unlike URL-route canonicalization, resource patterns retain a terminal
- * `index.html`: Grants can constrain the visitor-facing route and the artifact
- * it resolves to independently.
- */
-export declare function normalizeGrantResourcePattern(input: string): string;
-export declare const grantResourcePatternSchema: z.ZodString;
-export type GrantResourcePattern = z.infer<typeof grantResourcePatternSchema>;
-export declare const GRANT_RESOURCE_PATTERN_LIMIT = 100;
-export declare const grantResourceSetSchema: z.ZodObject<{
-    include: z.ZodArray<z.ZodString>;
-    exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-export type GrantResourceSet = z.infer<typeof grantResourceSetSchema>;
-export declare const GRANT_TARGET_KINDS: readonly ["live", "version", "branch", "all_versions"];
-export declare const grantTargetKindSchema: z.ZodEnum<{
-    live: "live";
-    version: "version";
-    branch: "branch";
-    all_versions: "all_versions";
-}>;
-export type GrantTargetKind = z.infer<typeof grantTargetKindSchema>;
-export declare const grantTargetSelectorSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kind: z.ZodLiteral<"live">;
-}, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodLiteral<"version">;
-    versionId: z.ZodString;
-}, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodLiteral<"branch">;
-    branch: z.ZodString;
-}, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodLiteral<"all_versions">;
-}, z.core.$strict>], "kind">;
-export type GrantTargetSelector = z.infer<typeof grantTargetSelectorSchema>;
-export declare function normalizeGrantNetworkCidr(input: string): string;
-export declare function grantNetworkCidrMatches(cidr: string, ipAddress: string): boolean;
-export declare const grantConstraintsSchema: z.ZodObject<{
-    notBefore: z.ZodOptional<z.ZodString>;
-    expiresAt: z.ZodOptional<z.ZodString>;
-    maxUses: z.ZodOptional<z.ZodNumber>;
-    requireVerifiedEmail: z.ZodOptional<z.ZodBoolean>;
-    network: z.ZodOptional<z.ZodObject<{
-        ipCidrs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        countries: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-export type GrantConstraints = z.infer<typeof grantConstraintsSchema>;
-/** Field-scoped PATCH shape. `null` clears one constraint without replacing its siblings. */
-export declare const grantConstraintsPatchSchema: z.ZodObject<{
-    notBefore: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    maxUses: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
-    requireVerifiedEmail: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
-    network: z.ZodOptional<z.ZodNullable<z.ZodObject<{
-        ipCidrs: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-        countries: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-        excludedCountries: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-        excludedUserAgentSubstrings: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
-    }, z.core.$strict>>>;
-}, z.core.$strict>;
-export type GrantConstraintsPatch = z.infer<typeof grantConstraintsPatchSchema>;
-export declare function diffGrantConstraints(original: GrantConstraints, draft: GrantConstraints): GrantConstraintsPatch | undefined;
-export declare function applyGrantConstraintsPatch(current: GrantConstraints, patch: GrantConstraintsPatch): GrantConstraints;
 export declare const GRANT_SOURCE_KINDS: readonly ["config", "managed", "system"];
 export declare const grantSourceKindSchema: z.ZodEnum<{
     config: "config";
@@ -180,6 +103,7 @@ export declare const grantSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -249,6 +173,7 @@ export declare const managedGrantWriteSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -292,6 +217,7 @@ export declare const directManagedGrantWriteSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -339,6 +265,7 @@ export declare const spaceGrantCreateSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -423,6 +350,7 @@ export declare const spaceGrantSchema: z.ZodObject<{
                 excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
             }, z.core.$strict>>;
+            frameOrigin: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         target: z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"live">;
@@ -593,6 +521,7 @@ export declare const grantCheckSchema: z.ZodObject<{
                         excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
                         excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     }, z.core.$strict>>;
+                    frameOrigin: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
                 target: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     kind: z.ZodLiteral<"live">;
@@ -685,6 +614,7 @@ export declare const grantCheckSchema: z.ZodObject<{
                         excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
                         excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     }, z.core.$strict>>;
+                    frameOrigin: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
                 target: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     kind: z.ZodLiteral<"live">;
@@ -762,6 +692,7 @@ export declare const passwordCredentialCreateSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -804,6 +735,7 @@ export declare const machineCredentialCreateSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -867,6 +799,7 @@ export declare const passwordCredentialSchema: z.ZodObject<{
                     excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 }, z.core.$strict>>;
+                frameOrigin: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             target: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 kind: z.ZodLiteral<"live">;
@@ -957,6 +890,7 @@ export declare const machineCredentialSchema: z.ZodObject<{
                     excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 }, z.core.$strict>>;
+                frameOrigin: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             target: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 kind: z.ZodLiteral<"live">;
@@ -1049,6 +983,7 @@ export declare const machineCredentialSecretSchema: z.ZodObject<{
                         excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
                         excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     }, z.core.$strict>>;
+                    frameOrigin: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
                 target: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     kind: z.ZodLiteral<"live">;
@@ -1118,11 +1053,6 @@ export declare const credentialRevocationSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const IDENTITY_CONNECTION_DEFAULT_TTL_SECONDS: number;
 export declare const EXTERNAL_IDENTITY_MAX_TTL_SECONDS: number;
-export declare const identityConnectionPublicKeySchema: z.ZodObject<{
-    kid: z.ZodString;
-    publicKey: z.ZodString;
-}, z.core.$strict>;
-export type IdentityConnectionPublicKey = z.infer<typeof identityConnectionPublicKeySchema>;
 /**
  * Issuers the platform stamps on its own external Grants. A Team-configured
  * connection may not claim one: the authority reference an external audience
@@ -1184,4 +1114,3 @@ export declare const identityConnectionSchema: z.ZodObject<{
     revokedAt: z.ZodNullable<z.ZodString>;
 }, z.core.$strict>;
 export type IdentityConnection = z.infer<typeof identityConnectionSchema>;
-export {};