@spacefast/common 0.2.2 → 0.4.1

package/dist/contracts/access-profiles.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { OAUTH_SHARED_API_RESOURCE_SCOPES } from "./oauth-resources.js";
+import { OAUTH_AGENT_DEFAULT_SCOPES, OAUTH_SHARED_API_RESOURCE_SCOPES } from "./oauth-resources.js";
 import { isTenantAdmissionAction, oauthScopeActions } from "./oauth-scope-actions.js";
 /**
  * The scopes any interactive authorization may grant — THE list every surface
@@ -23,10 +23,10 @@ export const AccessProfileIdSchema = z.enum(ACCESS_PROFILE_IDS);
 /**
  * Named grant profiles. A profile is REQUEST INTENT — one word on device start
  * with a server-owned meaning — never authority. Scopes are the grant
- * vocabulary; actions are authority. The default is deliberately the full
- * approvable set, matching what a `vercel login`/`gh auth login` grants:
- * everything the credential's holder can do, capped per team by their live
- * role at request time.
+ * vocabulary; actions are authority. Agent access grants routine capabilities by
+ * default and leaves destructive Space deletion for explicit or temporary
+ * approval. Every capability remains capped per team by the approver's live role
+ * at request time.
  */
 export const ACCESS_PROFILES = {
     // Read-only. It can open a hosted MCP session and invoke tools (each tool call
@@ -43,9 +43,9 @@ export const ACCESS_PROFILES = {
     agent: {
         id: "agent",
         label: "Agent access",
-        blurb: "Create and publish sites, manage domains and DNS, create teams, and use Spacefast tools.",
-        limits: "It can't delete sites, manage team members, change billing, or mint credentials.",
-        scopes: [...APPROVABLE_SCOPES],
+        blurb: "Create and publish sites. Manage domains and DNS. Invite team members, create teams, and use Spacefast tools.",
+        limits: "It asks for temporary approval before it deletes sites. It can't remove team members, change their roles, change billing, or mint credentials.",
+        scopes: [...OAUTH_AGENT_DEFAULT_SCOPES],
     },
 };
 export const DEFAULT_ACCESS_PROFILE_ID = "agent";

package/dist/contracts/access.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import { type GrantCapability } from "./grants.js";
+export * from "./access-core.js";
+/** The sharing preset a Space is created with, and what the dashboard offers. */
 export declare const SPACE_ACCESS_PRESETS: readonly ["private", "team", "public"];
-export declare const ACCESS_HANDOFF_MEDIA_TYPE = "application/vnd.spacefast.access-handoff+json";
 export declare const spaceAccessPresetSchema: z.ZodEnum<{
     team: "team";
     private: "private";
@@ -9,67 +9,14 @@ export declare const spaceAccessPresetSchema: z.ZodEnum<{
 }>;
 export type SpaceAccessPreset = z.infer<typeof spaceAccessPresetSchema>;
 /**
- * The sharing vocabulary. Capabilities are the ground truth; a role is a named
- * set of them, ordered from least to most. This is the product's only role enum
- * and role⇄capability mapping: every surface derives its capabilities here.
+ * Capabilities a forwardable secret (a Link, a password) can carry. It never
+ * publishes and never manages access.
  */
-export declare const ACCESS_ROLES: readonly ["viewer", "commenter", "editor", "manager"];
-export declare const accessRoleSchema: z.ZodEnum<{
-    editor: "editor";
-    viewer: "viewer";
-    commenter: "commenter";
-    manager: "manager";
-}>;
-export type AccessRole = z.infer<typeof accessRoleSchema>;
-export declare const ACCESS_ROLE_CAPABILITIES: {
-    readonly viewer: readonly ["page.view"];
-    readonly commenter: readonly ["page.view", "comments.read", "comments.write"];
-    readonly editor: readonly ["page.view", "comments.read", "comments.write", "content.publish"];
-    readonly manager: readonly ["page.view", "comments.read", "comments.write", "content.publish", "access.manage"];
-};
-export declare function accessRoleCapabilities(role: AccessRole): GrantCapability[];
-/**
- * The role a capability set amounts to: the strongest role it reaches, never
- * more. A Grant assembled capability-by-capability need not match one exactly.
- */
-export declare function accessRoleForCapabilities(capabilities: readonly GrantCapability[]): AccessRole;
-/**
- * Roles a forwardable secret (a Link, a password) can carry. It never publishes
- * and never manages access; `grantSchema` enforces that on capabilities too.
- */
-export declare const VISITOR_ACCESS_ROLES: readonly ["viewer", "commenter"];
-export type VisitorAccessRole = (typeof VISITOR_ACCESS_ROLES)[number];
 export declare const linkCapabilitySchema: z.ZodEnum<{
     "page.view": "page.view";
     "comments.read": "comments.read";
     "comments.write": "comments.write";
 }>;
-export declare function accessRoleRank(role: AccessRole): number;
-export declare function maxAccessRole(left: AccessRole | null, right: AccessRole | null): AccessRole | null;
-/**
- * Canonicalizes the URL route identity used by People, Links, requests,
- * comments, and runtime authorization.
- */
-export declare function normalizeAccessScopePath(input: string): string;
-export declare const accessScopePathSchema: z.ZodString;
-export type AccessScopePath = z.infer<typeof accessScopePathSchema>;
-export declare function accessScopeContains(scope: string, path: string): boolean;
-export declare const authorityReferenceSchema: z.ZodString;
-export type AuthorityReference = z.infer<typeof authorityReferenceSchema>;
-export declare const accountPrincipalSchema: z.ZodString;
-export type AccountPrincipal = z.infer<typeof accountPrincipalSchema>;
-export declare const identifiedPrincipalSchema: z.ZodString;
-export type IdentifiedPrincipal = z.infer<typeof identifiedPrincipalSchema>;
-export declare const accessPrincipalSchema: z.ZodUnion<readonly [z.ZodLiteral<"anonymous">, z.ZodString]>;
-export type AccessPrincipal = z.infer<typeof accessPrincipalSchema>;
-export declare function accountPrincipal(userId: string): AccountPrincipal;
-/** The user id behind an account principal; null for anonymous or malformed. */
-export declare function accountPrincipalUserId(principal: string | undefined | null): string | null;
-/**
- * The identity an authority reference names on its own, if any. The ONE place a
- * class maps to an identity: at the exchange that authenticated it, never after.
- */
-export declare function principalForAuthority(reference: AuthorityReference): IdentifiedPrincipal | undefined;
 export declare const personGrantSchema: z.ZodObject<{
     id: z.ZodString;
     scope: z.ZodString;
@@ -95,9 +42,9 @@ export declare const personGrantSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type PersonGrant = z.infer<typeof personGrantSchema>;
 export declare const spacePersonStatusSchema: z.ZodEnum<{
-    revoked: "revoked";
     pending: "pending";
     accepted: "accepted";
+    revoked: "revoked";
 }>;
 export declare const spacePersonDisplayNameSchema: z.ZodString;
 export declare function fallbackSpacePersonDisplayName(personId: string): string;
@@ -107,9 +54,9 @@ export declare const spacePersonSchema: z.ZodObject<{
     displayName: z.ZodString;
     email: z.ZodNullable<z.ZodString>;
     status: z.ZodEnum<{
-        revoked: "revoked";
         pending: "pending";
         accepted: "accepted";
+        revoked: "revoked";
     }>;
     grants: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
@@ -162,9 +109,9 @@ export declare const spacePeopleListSchema: z.ZodObject<{
         displayName: z.ZodString;
         email: z.ZodNullable<z.ZodString>;
         status: z.ZodEnum<{
-            revoked: "revoked";
             pending: "pending";
             accepted: "accepted";
+            revoked: "revoked";
         }>;
         grants: z.ZodArray<z.ZodObject<{
             id: z.ZodString;
@@ -237,6 +184,7 @@ export declare const accessShareLinkSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -284,6 +232,7 @@ export declare const accessShareLinkWithUrlSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -332,6 +281,7 @@ export declare const accessShareLinkReadSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -505,6 +455,7 @@ export declare const accessShareLinkCreateSchema: z.ZodObject<{
             excludedCountries: z.ZodOptional<z.ZodArray<z.ZodString>>;
             excludedUserAgentSubstrings: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        frameOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     target: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"live">;
@@ -536,6 +487,7 @@ export declare const accessShareLinkUpdateSchema: z.ZodObject<{
         expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         maxUses: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
         requireVerifiedEmail: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        frameOrigin: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         network: z.ZodOptional<z.ZodNullable<z.ZodObject<{
             ipCidrs: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
             countries: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
@@ -580,8 +532,8 @@ export declare const openHandoffSchema: z.ZodObject<{
     expiresAt: z.ZodString;
     kind: z.ZodEnum<{
         management: "management";
-        person: "person";
         claim_preview: "claim_preview";
+        person: "person";
     }>;
 }, z.core.$strip>;
 export declare const openLinkSchema: z.ZodObject<{
@@ -598,8 +550,8 @@ export declare const privateOpenSchema: z.ZodUnion<readonly [z.ZodObject<{
     expiresAt: z.ZodString;
     kind: z.ZodEnum<{
         management: "management";
-        person: "person";
         claim_preview: "claim_preview";
+        person: "person";
     }>;
 }, z.core.$strip>]>;
 export declare const openHandoffCreateSchema: z.ZodObject<{
@@ -623,44 +575,3 @@ export declare const teamSpaceAccessDefaultWriteSchema: z.ZodObject<{
         public: "public";
     }>;
 }, z.core.$strip>;
-export declare const ACCESS_TOKEN_KID = "spacefast-runtime-v1";
-export declare const ACCESS_TOKEN_ALG = "EdDSA";
-/**
- * The claim-schema version every platform token carries in `v`. A verifier that
- * understands v1 refuses a token minted under a later shape.
- */
-export declare const PLATFORM_TOKEN_CLAIM_VERSION: 1;
-export declare const BLOB_GATE_DOWNLOAD_TTL_SECONDS: number;
-export declare const BLOB_GATE_SCAN_TTL_SECONDS: number;
-export declare const BLOB_GATE_UPLOAD_TTL_SECONDS: number;
-export declare const RUNTIME_JWKS_WELL_KNOWN_FILENAME = "spacefast-runtime-jwks.json";
-export declare const accessTokenPublicProfileSchema: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    username: z.ZodOptional<z.ZodString>;
-    avatar_url: z.ZodOptional<z.ZodURL>;
-}, z.core.$strict>;
-export type AccessTokenPublicProfile = z.infer<typeof accessTokenPublicProfileSchema>;
-export declare const accessTokenPayloadSchema: z.ZodObject<{
-    purpose: z.ZodLiteral<"handoff">;
-    v: z.ZodLiteral<1>;
-    sub: z.ZodString;
-    principal: z.ZodOptional<z.ZodString>;
-    authorities: z.ZodArray<z.ZodString>;
-    exp: z.ZodNumber;
-    nbf: z.ZodNumber;
-    iat: z.ZodNumber;
-    iss: z.ZodString;
-    aud: z.ZodString;
-    host: z.ZodString;
-    spaceId: z.ZodString;
-    sid: z.ZodString;
-    generation: z.ZodNumber;
-    emailVerified: z.ZodDefault<z.ZodBoolean>;
-    profile: z.ZodOptional<z.ZodObject<{
-        name: z.ZodOptional<z.ZodString>;
-        username: z.ZodOptional<z.ZodString>;
-        avatar_url: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strict>>;
-    jti: z.ZodString;
-}, z.core.$strip>;
-export type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>;

package/dist/contracts/access.js

@@ -1,163 +1,19 @@
 import { z } from "zod";
-import { grantConstraintsPatchSchema, grantConstraintsSchema, grantResourceSetSchema, grantTargetSelectorSchema, } from "./grants.js";
+import { accessRoleSchema, accessScopePathSchema } from "./access-core.js";
+import { grantConstraintsPatchSchema, grantConstraintsSchema, grantResourceSetSchema, grantTargetSelectorSchema, } from "./grants-core.js";
+// Spacefast's access DIRECTORY: the people, Links, access requests and team
+// defaults behind a session. The vocabulary those records are written in — roles,
+// capabilities, scopes, principals, the handoff token — is host-agnostic and
+// lives in `./access-core.js`, which this module re-exports.
+export * from "./access-core.js";
+/** The sharing preset a Space is created with, and what the dashboard offers. */
 export const SPACE_ACCESS_PRESETS = ["private", "team", "public"];
-export const ACCESS_HANDOFF_MEDIA_TYPE = "application/vnd.spacefast.access-handoff+json";
 export const spaceAccessPresetSchema = z.enum(SPACE_ACCESS_PRESETS);
 /**
- * The sharing vocabulary. Capabilities are the ground truth; a role is a named
- * set of them, ordered from least to most. This is the product's only role enum
- * and role⇄capability mapping: every surface derives its capabilities here.
+ * Capabilities a forwardable secret (a Link, a password) can carry. It never
+ * publishes and never manages access.
  */
-export const ACCESS_ROLES = ["viewer", "commenter", "editor", "manager"];
-export const accessRoleSchema = z.enum(ACCESS_ROLES);
-export const ACCESS_ROLE_CAPABILITIES = {
-    viewer: ["page.view"],
-    commenter: ["page.view", "comments.read", "comments.write"],
-    editor: ["page.view", "comments.read", "comments.write", "content.publish"],
-    manager: ["page.view", "comments.read", "comments.write", "content.publish", "access.manage"],
-};
-export function accessRoleCapabilities(role) {
-    return [...ACCESS_ROLE_CAPABILITIES[role]];
-}
-/**
- * The role a capability set amounts to: the strongest role it reaches, never
- * more. A Grant assembled capability-by-capability need not match one exactly.
- */
-export function accessRoleForCapabilities(capabilities) {
-    if (capabilities.includes("access.manage"))
-        return "manager";
-    if (capabilities.includes("content.publish"))
-        return "editor";
-    if (capabilities.includes("comments.write"))
-        return "commenter";
-    return "viewer";
-}
-/**
- * Roles a forwardable secret (a Link, a password) can carry. It never publishes
- * and never manages access; `grantSchema` enforces that on capabilities too.
- */
-export const VISITOR_ACCESS_ROLES = [
-    "viewer",
-    "commenter",
-];
 export const linkCapabilitySchema = z.enum(["page.view", "comments.read", "comments.write"]);
-export function accessRoleRank(role) {
-    return ACCESS_ROLES.indexOf(role);
-}
-export function maxAccessRole(left, right) {
-    if (left === null)
-        return right;
-    if (right === null)
-        return left;
-    return accessRoleRank(left) >= accessRoleRank(right) ? left : right;
-}
-function hasUnsafeScopeCharacter(value) {
-    for (const character of value) {
-        const codePoint = character.codePointAt(0);
-        if (codePoint === undefined ||
-            codePoint <= 0x1f ||
-            codePoint === 0x7f ||
-            character === "\\" ||
-            character === "?" ||
-            character === "#") {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Canonicalizes the URL route identity used by People, Links, requests,
- * comments, and runtime authorization.
- */
-export function normalizeAccessScopePath(input) {
-    const value = input;
-    if (!value.startsWith("/") || value.startsWith("//") || hasUnsafeScopeCharacter(value)) {
-        throw new TypeError("scope must be a plain absolute URL path");
-    }
-    let decoded;
-    try {
-        decoded = decodeURIComponent(value);
-    }
-    catch {
-        throw new TypeError("scope contains malformed percent encoding");
-    }
-    if (/%2f|%5c/iu.test(value) || hasUnsafeScopeCharacter(decoded)) {
-        throw new TypeError("scope contains an ambiguous encoded separator");
-    }
-    const segments = [];
-    for (const rawSegment of decoded.split("/")) {
-        const segment = rawSegment.normalize("NFC");
-        if (segment === "" || segment === ".")
-            continue;
-        if (segment === "..") {
-            if (segments.length === 0) {
-                throw new TypeError("scope escapes the URL root");
-            }
-            segments.pop();
-            continue;
-        }
-        segments.push(segment);
-    }
-    if (segments.at(-1) === "index.html") {
-        segments.pop();
-    }
-    return segments.length === 0 ? "/" : `/${segments.join("/")}`;
-}
-export const accessScopePathSchema = z
-    .string()
-    .min(1)
-    .max(1024)
-    .check((context) => {
-    try {
-        context.value = normalizeAccessScopePath(context.value);
-    }
-    catch (error) {
-        context.issues.push({
-            code: "custom",
-            input: context.value,
-            message: error instanceof Error ? error.message : "invalid access scope",
-        });
-    }
-});
-export function accessScopeContains(scope, path) {
-    const canonicalScope = normalizeAccessScopePath(scope);
-    const canonicalPath = normalizeAccessScopePath(path);
-    return (canonicalScope === "/" ||
-        canonicalPath === canonicalScope ||
-        canonicalPath.startsWith(`${canonicalScope}/`));
-}
-export const authorityReferenceSchema = z
-    .string()
-    .regex(/^(member|person|link|password|machine|claim-preview|external):[A-Za-z0-9_.-]+$/);
-// WHO a session is, orthogonal to WHAT it may do. A session has exactly one
-// principal and any number of authorities; neither implies the other.
-export const accountPrincipalSchema = z.string().regex(/^account:[A-Za-z0-9_-]+$/);
-// `person:` is someone this Space invited by email and who accepted, a named
-// identity with no platform account behind it. `external:` is a subject an
-// identity connection vouched for. Every other authority class (Link, password,
-// machine, claim preview) authenticates no one and leaves the session anonymous.
-export const identifiedPrincipalSchema = z
-    .string()
-    .regex(/^(?:account|person|external):[A-Za-z0-9_.-]+$/);
-export const accessPrincipalSchema = z.union([z.literal("anonymous"), identifiedPrincipalSchema]);
-export function accountPrincipal(userId) {
-    return accountPrincipalSchema.parse(`account:${userId}`);
-}
-/** The user id behind an account principal; null for anonymous or malformed. */
-export function accountPrincipalUserId(principal) {
-    if (!principal || !accountPrincipalSchema.safeParse(principal).success)
-        return null;
-    return principal.slice("account:".length);
-}
-/**
- * The identity an authority reference names on its own, if any. The ONE place a
- * class maps to an identity: at the exchange that authenticated it, never after.
- */
-export function principalForAuthority(reference) {
-    return reference.startsWith("person:") || reference.startsWith("external:")
-        ? identifiedPrincipalSchema.parse(reference)
-        : undefined;
-}
 export const personGrantSchema = z.object({
     id: z.string().min(1),
     scope: accessScopePathSchema,
@@ -335,59 +191,3 @@ export const teamSpaceAccessDefaultSchema = z.object({
 export const teamSpaceAccessDefaultWriteSchema = z.object({
     newSpaceGrantPreset: spaceAccessPresetSchema,
 });
-export const ACCESS_TOKEN_KID = "spacefast-runtime-v1";
-export const ACCESS_TOKEN_ALG = "EdDSA";
-/**
- * The claim-schema version every platform token carries in `v`. A verifier that
- * understands v1 refuses a token minted under a later shape.
- */
-export const PLATFORM_TOKEN_CLAIM_VERSION = 1;
-export const BLOB_GATE_DOWNLOAD_TTL_SECONDS = 10 * 60;
-export const BLOB_GATE_SCAN_TTL_SECONDS = 60 * 60;
-export const BLOB_GATE_UPLOAD_TTL_SECONDS = 60 * 60;
-export const RUNTIME_JWKS_WELL_KNOWN_FILENAME = "spacefast-runtime-jwks.json";
-// Public identity, attached only when a consumer must render the person behind
-// an authority. The minting side normalizes a provider avatar or derives one
-// from the email, then drops the email. Raw email and provider-private profile
-// metadata never belong here.
-export const accessTokenPublicProfileSchema = z
-    .object({
-    name: z.string().min(1).max(120).optional(),
-    username: z.string().min(1).max(160).optional(),
-    avatar_url: z
-        .url({ protocol: /^https?$/ })
-        .max(2_048)
-        .optional(),
-})
-    .strict();
-export const accessTokenPayloadSchema = z.object({
-    // Typed purpose from the one platform signer. The runtime REQUIRES exactly
-    // this value before consuming the jti, so no other purpose signed by the same
-    // key can redeem into a visitor session.
-    purpose: z.literal("handoff"),
-    v: z.literal(PLATFORM_TOKEN_CLAIM_VERSION),
-    sub: authorityReferenceSchema,
-    // Who this handoff authenticated, when it authenticated anybody. Its absence
-    // means the runtime session is anonymous. Identity comes from here alone,
-    // never inferred from the authority classes below.
-    principal: identifiedPrincipalSchema.optional(),
-    authorities: z.array(authorityReferenceSchema).min(1).max(16),
-    exp: z.number().int().nonnegative(),
-    nbf: z.number().int().nonnegative(),
-    iat: z.number().int().nonnegative(),
-    iss: z.string().min(1),
-    // The Space this handoff belongs to. A Space keeps its id across claim,
-    // rename, and custom domains, so the audience is stable where a host is not.
-    aud: z.string().min(1),
-    // The lowercased serving host the handoff was minted for. The runtime rejects
-    // a token presented on any other host.
-    host: z.string().min(1),
-    spaceId: z.string().min(1),
-    // Shared opaque identity for the runtime session and its access-origin
-    // collaboration session. It is random per handoff and never authorizes by itself.
-    sid: z.string().regex(/^[a-f0-9]{64}$/),
-    generation: z.number().int().nonnegative(),
-    emailVerified: z.boolean().default(false),
-    profile: accessTokenPublicProfileSchema.optional(),
-    jti: z.string().min(1),
-});

package/dist/contracts/activity.d.ts

@@ -1,28 +1,31 @@
 import { z } from "zod";
-export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "feedback.lead_claim_pending", "space.transferred", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.slug_updated", "site.provision_requested", "site.burst_toggled", "space.access_logout_all", "space.access_transfer_scrub", "space.share_link_created", "space.share_link_revoked", "space.access_request_created", "space.access_request_resolved", "space.grant_created", "space.grant_updated", "space.grant_revoked", "team.access_defaults_updated", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "channel.promoted", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "domain.attached", "domain.activated", "domain.blocked", "domain.detached", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "cron.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "agent_handoff.created", "agent_handoff.redeemed", "agent_handoff.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "webhook.deleted", "team.updated", "team.slug_updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "principal.plan_reset", "principal.space_quota_exceeded", "principal.suspended", "principal.unsuspended", "principal.closed", "usage.threshold_crossed", "usage.period_finalized", "usage.corrected", "principal.notification.claim", "principal.notification.space_expiry", "principal.notification.access_invitation", "principal.notification.access_request", "principal.notification.access_verification", "principal.notification.publish_receipt", "principal.notification.comment", "comment.token_minted", "comment.created", "comment.reply_created", "comment.archived", "comment.unarchived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "claim.authority_rotated", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled", "user.password_set", "user.password_changed", "user.provider_linked", "user.provider_unlinked", "user.email_added", "user.email_removed", "user.primary_email_changed", "user.superadmin_granted", "user.superadmin_revoked", "user.privacy_updated", "user.deletion_requested", "user.deletion_completed"];
+export declare const ACTIVITY_EVENT_CODES: readonly ["space.created", "space.claimed", "space.transferred", "space.expired", "space.disabled", "space.enabled", "space.deleted", "space.config_updated", "space.slug_updated", "space.wp_cli_run", "site.provision_requested", "site.burst_toggled", "space.access_logout_all", "space.access_transfer_scrub", "space.share_link_created", "space.share_link_revoked", "space.access_request_created", "space.access_request_resolved", "space.grant_created", "space.grant_updated", "space.grant_revoked", "team.access_defaults_updated", "version.created", "version.ready", "version.warning", "version.failed", "version.expired", "version.canceled", "version.deleted", "channel.promoted", "channel.promotion_changed", "build.created", "build.succeeded", "build.failed", "build.canceled", "build.skipped", "domain.created", "domain.verified", "domain.verification_failed", "domain.control_lost", "domain.dns_updated", "domain.nameservers_updated", "domain.registration_purchased", "domain.registration_renewed", "domain.registration_expiring", "domain.registration_expired", "domain.transfer_in_started", "domain.transfer_out_started", "domain.deleted", "domain.attached", "domain.activated", "domain.blocked", "domain.detached", "transfer.requested", "transfer.confirmed", "transfer.completed", "transfer.canceled", "transfer.expired", "transfer.failed", "cron.failed", "variable.updated", "variable.deleted", "api_key.created", "api_key.updated", "api_key.revoked", "agent_handoff.created", "agent_handoff.redeemed", "agent_handoff.revoked", "webhook.created", "webhook.updated", "webhook.secret_rotated", "webhook.disabled", "webhook.deleted", "team.updated", "team.slug_updated", "team.member_added", "team.member_removed", "team.member_role_updated", "team.builds_deploys_quota_exceeded", "visitor_connection.created", "visitor_connection.revoked", "connector_binding.created", "connector_binding.removed", "connection.serving_granted", "connection.serving_revoked", "connector_policy.created", "connector_policy.updated", "connector_policy.deleted", "connector_run.parked", "connector_run.decided", "connector_run.expired", "tenant.past_due", "tenant.suspended", "tenant.reactivated", "tenant.deleted", "principal.plan_reset", "principal.space_quota_exceeded", "principal.suspended", "principal.unsuspended", "principal.closed", "usage.threshold_crossed", "usage.period_finalized", "usage.corrected", "principal.notification.claim", "principal.notification.space_expiry", "principal.notification.access_invitation", "principal.notification.access_request", "principal.notification.access_verification", "principal.notification.publish_receipt", "principal.notification.comment", "comment.token_minted", "comment.created", "comment.reply_created", "comment.archived", "comment.unarchived", "abuse_report.created", "abuse_report.updated", "claim.blocked_takedown", "claim.authority_rotated", "user.created", "user.signed_in", "user.deleted", "user.impersonation_started", "user.impersonation_stopped", "user.two_factor_enabled", "user.two_factor_disabled", "user.password_set", "user.password_changed", "user.provider_linked", "user.provider_unlinked", "user.email_added", "user.email_removed", "user.primary_email_changed", "user.superadmin_granted", "user.superadmin_revoked", "user.privacy_updated", "user.deletion_requested", "user.deletion_completed"];
 export type ActivityEventCode = (typeof ACTIVITY_EVENT_CODES)[number];
 export declare function isActivityEventCode(value: string): value is ActivityEventCode;
 export declare function isValidActivityEventFilter(filter: string): boolean;
 export declare function matchesActivityEventFilters(filters: readonly string[], code: string): boolean;
-export declare const activityActorSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    type: z.ZodLiteral<"user">;
-    id: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"api_key">;
-    id: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"partner_token">;
-    id: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"oauth_client">;
-    id: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"anonymous_claim">;
-    id: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"system">;
+export declare const ACTIVITY_ACTOR_TYPES: readonly ["visitor", "user", "api_key", "partner_token", "oauth_client", "anonymous_claim", "system"];
+export declare const activityActorTypeSchema: z.ZodEnum<{
+    system: "system";
+    user: "user";
+    visitor: "visitor";
+    api_key: "api_key";
+    partner_token: "partner_token";
+    oauth_client: "oauth_client";
+    anonymous_claim: "anonymous_claim";
+}>;
+export declare const activityActorSchema: z.ZodObject<{
+    type: z.ZodEnum<{
+        system: "system";
+        user: "user";
+        visitor: "visitor";
+        api_key: "api_key";
+        partner_token: "partner_token";
+        oauth_client: "oauth_client";
+        anonymous_claim: "anonymous_claim";
+    }>;
     id: z.ZodString;
-}, z.core.$strip>], "type">;
+}, z.core.$strip>;
 export declare const activityPrincipalSchema: z.ZodObject<{
     tenantId: z.ZodString;
     principalType: z.ZodEnum<{
@@ -48,25 +51,18 @@ export declare const activityEventSchema: z.ZodObject<{
         principalId: z.ZodString;
     }, z.core.$strip>>;
     spaceId: z.ZodNullable<z.ZodString>;
-    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        type: z.ZodLiteral<"user">;
-        id: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        type: z.ZodLiteral<"api_key">;
-        id: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        type: z.ZodLiteral<"partner_token">;
-        id: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        type: z.ZodLiteral<"oauth_client">;
-        id: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        type: z.ZodLiteral<"anonymous_claim">;
-        id: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        type: z.ZodLiteral<"system">;
+    actor: z.ZodObject<{
+        type: z.ZodEnum<{
+            system: "system";
+            user: "user";
+            visitor: "visitor";
+            api_key: "api_key";
+            partner_token: "partner_token";
+            oauth_client: "oauth_client";
+            anonymous_claim: "anonymous_claim";
+        }>;
         id: z.ZodString;
-    }, z.core.$strip>], "type">;
+    }, z.core.$strip>;
     code: z.ZodString;
     message: z.ZodString;
     details: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -81,6 +77,16 @@ export declare const activityQuerySchema: z.ZodObject<{
     }>>;
     principalId: z.ZodOptional<z.ZodString>;
     spaceId: z.ZodOptional<z.ZodString>;
+    actorType: z.ZodOptional<z.ZodEnum<{
+        system: "system";
+        user: "user";
+        visitor: "visitor";
+        api_key: "api_key";
+        partner_token: "partner_token";
+        oauth_client: "oauth_client";
+        anonymous_claim: "anonymous_claim";
+    }>>;
+    actorId: z.ZodOptional<z.ZodString>;
     code: z.ZodOptional<z.ZodString>;
     since: z.ZodOptional<z.ZodString>;
     until: z.ZodOptional<z.ZodString>;
@@ -103,25 +109,18 @@ export declare const activityListResponseSchema: z.ZodObject<{
             principalId: z.ZodString;
         }, z.core.$strip>>;
         spaceId: z.ZodNullable<z.ZodString>;
-        actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"user">;
-            id: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"api_key">;
-            id: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"partner_token">;
-            id: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"oauth_client">;
-            id: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"anonymous_claim">;
-            id: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"system">;
+        actor: z.ZodObject<{
+            type: z.ZodEnum<{
+                system: "system";
+                user: "user";
+                visitor: "visitor";
+                api_key: "api_key";
+                partner_token: "partner_token";
+                oauth_client: "oauth_client";
+                anonymous_claim: "anonymous_claim";
+            }>;
             id: z.ZodString;
-        }, z.core.$strip>], "type">;
+        }, z.core.$strip>;
         code: z.ZodString;
         message: z.ZodString;
         details: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;