@vertesia/common 1.5.0-dev.20260722.120446Z → 1.5.0-dev.20260804.124748Z

package/lib/analytics.d.ts

@@ -1,41 +1,15 @@
-export interface AnalyticsAxis {
-    environment?: string;
-    project?: string;
-    interactions?: string[];
-    models?: string[];
-    status?: string[];
-    tags?: string[];
-    selectedOnly?: boolean;
-}
-export interface RunAnalyticsQuery {
-    /** filters to apply to the query */
-    filterBy: AnalyticsAxis;
-    /** The field to group by */
-    groupBy?: RunAnalyticsGroupBy;
-    /** The start date of the query in EPOCH format */
-    from?: number;
-    /** The end date of the query in EPOCH format */
-    to?: number;
-    /** The time resolution unit of the analytics query */
-    resolution?: TimeResolution;
-    /** The step size for the resolution (e.g., 4 with resolution='hour' means 4-hour intervals). Defaults to 1. */
-    resolutionStep?: number;
-    /** The field to sort by */
-    virtual?: boolean;
-}
-export type RunAnalyticsGroupBy = 'interaction' | 'modelId' | 'project' | 'status' | 'tags' | 'environment';
-export type TimeResolution = 'minute' | 'hour' | 'day' | 'week' | 'month' | 'year';
-export interface RunAnalyticsResult {
-    date: string;
-    timestamp: string;
-    group: string;
-    count: number;
-    execution_time: {
-        avg: number;
-        min: number;
-        max: number;
-    };
-}
+import type { z } from 'zod';
+import type { AnalyticsAxisSchema, RunAnalyticsGroupBySchema, RunAnalyticsQuerySchema, RunAnalyticsResultSchema, TimeResolutionSchema } from './api-schemas/analytics.js';
+/**
+ * The five run-analytics contract types, inferred from `./api-schemas/analytics.js`. Their
+ * documentation moved with them — a doc comment here would be published on TOP of the schema's
+ * `description` and the two would drift.
+ */
+export type AnalyticsAxis = z.infer<typeof AnalyticsAxisSchema>;
+export type RunAnalyticsQuery = z.infer<typeof RunAnalyticsQuerySchema>;
+export type RunAnalyticsGroupBy = z.infer<typeof RunAnalyticsGroupBySchema>;
+export type TimeResolution = z.infer<typeof TimeResolutionSchema>;
+export type RunAnalyticsResult = z.infer<typeof RunAnalyticsResultSchema>;
 /** Entity with status breakdown */
 export interface EntityStatusCounts {
     id: string;

package/lib/analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../src/analytics.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAC9B,oCAAoC;IACpC,QAAQ,EAAE,aAAa,CAAC;IAExB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAE9B,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,sDAAsD;IACtD,UAAU,CAAC,EAAE,cAAc,CAAC;IAE5B,+GAA+G;IAC/G,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAC;AAE5G,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAEnF,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;KACf,CAAC;CACL;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IAC/B,EAAE,EAAE,MAAM,CAAC;IAEX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACjC,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,kDAAkD;IAClD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,kDAAkD;IAClD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACzC,iDAAiD;IACjD,UAAU,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC3B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,uHAAuH;AACvH,MAAM,WAAW,iBAAiB;IAC9B,aAAa,EAAE,uBAAuB,EAAE,CAAC;IACzC,UAAU,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL"}
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../src/analytics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EACR,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACvB,MAAM,4BAA4B,CAAC;AAEpC;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IAC/B,EAAE,EAAE,MAAM,CAAC;IAEX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACjC,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,kDAAkD;IAClD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,kDAAkD;IAClD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACzC,iDAAiD;IACjD,UAAU,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC3B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,uHAAuH;AACvH,MAAM,WAAW,iBAAiB;IAC9B,aAAa,EAAE,uBAAuB,EAAE,CAAC;IACzC,UAAU,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL"}

package/lib/api-schemas/access-control.d.ts

@@ -0,0 +1,215 @@
+import { z } from 'zod';
+import { AccessControlPrincipalType, AccessControlResourceType, Permission } from '../access-control-values.js';
+/**
+ * Runtime API schemas for IAM roles and access-control entries.
+ */
+/**
+ * The permission vocabulary, hoisted so `SystemRoleDefinition` publishes one reusable enum rather
+ * than an inline copy per property.
+ */
+export declare const PermissionSchema: z.ZodEnum<typeof Permission>;
+export declare const AccessControlResourceTypeSchema: z.ZodEnum<typeof AccessControlResourceType>;
+export declare const AccessControlPrincipalTypeSchema: z.ZodEnum<typeof AccessControlPrincipalType>;
+export declare const AbacScopeSchema: z.ZodEnum<{
+    document: "document";
+    collection: "collection";
+    task: "task";
+}>;
+export declare const RoleDomainSchema: z.ZodEnum<{
+    system: "system";
+    content: "content";
+    tasks: "tasks";
+}>;
+/**
+ * Deliberately unconstrained, and hoisted so the constraint's ABSENCE is stated in one place. A
+ * condition value is compared by the token and content-security evaluators, which accept literals,
+ * operator objects (`{ $gte: 5 }`) and `$principal.` cross-references — a union no schema could
+ * usefully close without freezing that vocabulary into the public contract.
+ */
+export declare const PropertyConditionValueSchema: z.ZodUnknown;
+export declare const PropertyConditionsSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+/**
+ * Closed, and that matters here: the SERVER stores two more fields inside `conditions` —
+ * `principal_name` and `resource_name` — which this component has never declared. They are display
+ * names held there until `principal`/`resource` migrate from ObjectId to string, and the handlers
+ * copy them back into `principal`/`resource` on the way out. Every response that also serialized the
+ * raw sub-document was therefore violating its own schema; the mappers now build `conditions`
+ * explicitly, so the value still reaches the client — in the field the contract declares.
+ */
+export declare const AceConditionsSchema: z.ZodObject<{
+    principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    scope: z.ZodOptional<z.ZodEnum<{
+        document: "document";
+        collection: "collection";
+        task: "task";
+    }>>;
+}, z.core.$strip>;
+/**
+ * The access control entry as it crosses the wire.
+ *
+ * `resource` and `principal` are strings here and ObjectIds in Mongo — except for the dynamic
+ * (`principal_set` / `content_set`) entries, where the stored ObjectId is meaningless and the handler
+ * substitutes the display name out of `conditions`. That substitution is the reason these endpoints
+ * need a mapper rather than a serialized document: no cast can express "this field is a different
+ * value depending on another field".
+ *
+ * The timestamps are plain strings rather than `format: date-time`, which is what the document
+ * already publishes. Unlike `User` and `UserGroup` this is NOT safe to tighten in passing: `expires_at`
+ * shares the declaration and is written from an unvalidated payload, so an existing caller could have
+ * stored a value AJV would now reject.
+ */
+export declare const AccessControlEntrySchema: z.ZodObject<{
+    role: z.ZodString;
+    resource_type: z.ZodEnum<typeof AccessControlResourceType>;
+    resource: z.ZodString;
+    principal_type: z.ZodEnum<typeof AccessControlPrincipalType>;
+    principal: z.ZodString;
+    account: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodString>;
+    conditions: z.ZodOptional<z.ZodObject<{
+        principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            document: "document";
+            collection: "collection";
+            task: "task";
+        }>>;
+    }, z.core.$strip>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expires_at: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodOptional<z.ZodString>;
+    updated_at: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const AccessControlEntryArraySchema: z.ZodArray<z.ZodObject<{
+    role: z.ZodString;
+    resource_type: z.ZodEnum<typeof AccessControlResourceType>;
+    resource: z.ZodString;
+    principal_type: z.ZodEnum<typeof AccessControlPrincipalType>;
+    principal: z.ZodString;
+    account: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodString>;
+    conditions: z.ZodOptional<z.ZodObject<{
+        principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            document: "document";
+            collection: "collection";
+            task: "task";
+        }>>;
+    }, z.core.$strip>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expires_at: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodOptional<z.ZodString>;
+    updated_at: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+}, z.core.$strip>>;
+/**
+ * Create and update payloads, picked from the entry rather than restated.
+ *
+ * `ACECreatePayload extends Omit<AccessControlEntry, 'created_at' | 'updated_at' | 'id'>` is what the
+ * hand-written types said, so `.omit()` is the literal translation — and the right operator here for
+ * the reason the guidance gives: the derived shape is almost everything. `ACEUpdatePayload` was
+ * `Partial<ACECreatePayload>`, which `.partial()` reproduces exactly.
+ */
+export declare const ACECreatePayloadSchema: z.ZodObject<{
+    project: z.ZodOptional<z.ZodString>;
+    account: z.ZodOptional<z.ZodString>;
+    resource_type: z.ZodEnum<typeof AccessControlResourceType>;
+    principal_type: z.ZodEnum<typeof AccessControlPrincipalType>;
+    role: z.ZodString;
+    resource: z.ZodString;
+    principal: z.ZodString;
+    conditions: z.ZodOptional<z.ZodObject<{
+        principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            document: "document";
+            collection: "collection";
+            task: "task";
+        }>>;
+    }, z.core.$strip>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expires_at: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const ACEUpdatePayloadSchema: z.ZodObject<{
+    project: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    account: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    resource_type: z.ZodOptional<z.ZodEnum<typeof AccessControlResourceType>>;
+    principal_type: z.ZodOptional<z.ZodEnum<typeof AccessControlPrincipalType>>;
+    role: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    principal: z.ZodOptional<z.ZodString>;
+    conditions: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            document: "document";
+            collection: "collection";
+            task: "task";
+        }>>;
+    }, z.core.$strip>>>;
+    tags: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    expires_at: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * The role catalog. Both shapes are static — computed from the in-process role registry, never read
+ * from Mongo — so these two slots carry no persistence boundary at all.
+ */
+export declare const RoleDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+    domain: z.ZodEnum<{
+        system: "system";
+        content: "content";
+        tasks: "tasks";
+    }>;
+}, z.core.$strip>;
+export declare const RoleDefinitionArraySchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+    domain: z.ZodEnum<{
+        system: "system";
+        content: "content";
+        tasks: "tasks";
+    }>;
+}, z.core.$strip>>;
+/**
+ * `.extend()` and not a second object: `SystemRoleDefinition extends RoleDefinition` narrowing
+ * `permissions`, expressed as the override it is. Overriding a property keeps its position, so the
+ * published property order is unchanged.
+ */
+export declare const SystemRoleDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    domain: z.ZodEnum<{
+        system: "system";
+        content: "content";
+        tasks: "tasks";
+    }>;
+    permissions: z.ZodArray<z.ZodEnum<typeof Permission>>;
+}, z.core.$strip>;
+export declare const SystemRoleDefinitionArraySchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    domain: z.ZodEnum<{
+        system: "system";
+        content: "content";
+        tasks: "tasks";
+    }>;
+    permissions: z.ZodArray<z.ZodEnum<typeof Permission>>;
+}, z.core.$strip>>;
+/**
+ * The public access-control types, inferred rather than written. `../access-control.ts` and
+ * `../roles/types.ts` re-export these under their public names.
+ */
+export type PropertyConditionsFromSchema = z.infer<typeof PropertyConditionsSchema>;
+export type AceConditionsFromSchema = z.infer<typeof AceConditionsSchema>;
+export type AccessControlEntryFromSchema = z.infer<typeof AccessControlEntrySchema>;
+export type AccessControlEntryArrayFromSchema = z.infer<typeof AccessControlEntryArraySchema>;
+export type ACECreatePayloadFromSchema = z.infer<typeof ACECreatePayloadSchema>;
+export type ACEUpdatePayloadFromSchema = z.infer<typeof ACEUpdatePayloadSchema>;
+export type RoleDefinitionFromSchema = z.infer<typeof RoleDefinitionSchema>;
+export type RoleDefinitionArrayFromSchema = z.infer<typeof RoleDefinitionArraySchema>;
+export type SystemRoleDefinitionFromSchema = z.infer<typeof SystemRoleDefinitionSchema>;
+export type SystemRoleDefinitionArrayFromSchema = z.infer<typeof SystemRoleDefinitionArraySchema>;
+//# sourceMappingURL=access-control.d.ts.map

package/lib/api-schemas/access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../src/api-schemas/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEH,0BAA0B,EAC1B,yBAAyB,EACzB,UAAU,EAEb,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AAEH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8BAAgD,CAAC;AAE9E,eAAO,MAAM,+BAA+B,6CAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC,8CAE3C,CAAC;AAEH,eAAO,MAAM,eAAe;;;;EAA+C,CAAC;AAE5E,eAAO,MAAM,gBAAgB;;;;EAO3B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,cAGvC,CAAC;AAEH,eAAO,MAAM,wBAAwB,wCAEE,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;iBAsB1B,CAAC;AAEP;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;iBA8BE,CAAC;AAExC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;kBAA4E,CAAC;AAEvH;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;iBAIA,CAAC;AAEpC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;iBAAoE,CAAC;AAExG;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAiB3B,CAAC;AAEP,eAAO,MAAM,yBAAyB;;;;;;;;kBAAoE,CAAC;AAE3G;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAOrC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;kBAEE,CAAC;AAE/C;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAC1E,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AACpF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAC9F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAChF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAC5E,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACtF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACxF,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/lib/api-schemas/access-control.js

@@ -0,0 +1,165 @@
+import { z } from 'zod';
+// From the values module, never from `../access-control.js` or `../roles/types.js`: both derive
+// their public types from the schemas below, so importing them here would invert the dependency.
+import { AbacScopes, AccessControlPrincipalType, AccessControlResourceType, Permission, RoleDomains, } from '../access-control-values.js';
+/**
+ * Runtime API schemas for IAM roles and access-control entries.
+ */
+/**
+ * The permission vocabulary, hoisted so `SystemRoleDefinition` publishes one reusable enum rather
+ * than an inline copy per property.
+ */
+export const PermissionSchema = z.enum(Permission).meta({ id: 'Permission' });
+export const AccessControlResourceTypeSchema = z.enum(AccessControlResourceType).meta({
+    id: 'AccessControlResourceType',
+});
+export const AccessControlPrincipalTypeSchema = z.enum(AccessControlPrincipalType).meta({
+    id: 'AccessControlPrincipalType',
+});
+export const AbacScopeSchema = z.enum(AbacScopes).meta({ id: 'AbacScope' });
+export const RoleDomainSchema = z.enum(RoleDomains).meta({
+    id: 'RoleDomain',
+    description: 'Logical grouping of roles by the service area that owns them. One domain may declare roles ' +
+        'applicable to multiple scopes (e.g. the `content` domain owns roles applicable to both `document` ' +
+        'and `collection` scopes). The `system` domain owns the built-in foundational roles (currently ' +
+        'exposed as `SystemRoles`) — registered first so domain partitions cannot shadow them.',
+});
+/**
+ * Deliberately unconstrained, and hoisted so the constraint's ABSENCE is stated in one place. A
+ * condition value is compared by the token and content-security evaluators, which accept literals,
+ * operator objects (`{ $gte: 5 }`) and `$principal.` cross-references — a union no schema could
+ * usefully close without freezing that vocabulary into the public contract.
+ */
+export const PropertyConditionValueSchema = z.unknown().meta({
+    id: 'PropertyConditionValue',
+    description: 'A single condition value. Resolved and evaluated dynamically by token/content security code.',
+});
+export const PropertyConditionsSchema = z
+    .record(z.string(), PropertyConditionValueSchema)
+    .meta({ id: 'PropertyConditions' });
+/**
+ * Closed, and that matters here: the SERVER stores two more fields inside `conditions` —
+ * `principal_name` and `resource_name` — which this component has never declared. They are display
+ * names held there until `principal`/`resource` migrate from ObjectId to string, and the handlers
+ * copy them back into `principal`/`resource` on the way out. Every response that also serialized the
+ * raw sub-document was therefore violating its own schema; the mappers now build `conditions`
+ * explicitly, so the value still reaches the client — in the field the contract declares.
+ */
+export const AceConditionsSchema = z
+    .object({
+    principal_props: PropertyConditionsSchema.meta({
+        description: 'Property conditions matched against user/group properties at token time (PrincipalSet).',
+    }).optional(),
+    resource_props: PropertyConditionsSchema.meta({
+        description: 'Property conditions matched against object properties at query time (ResourceSet).',
+    }).optional(),
+    scope: AbacScopeSchema.meta({
+        description: "Kind of object the `resource_props` matches. Used to disambiguate which partition's roles " +
+            'apply (e.g. content roles vs task roles) and to form the JWT `content_security` key prefix ' +
+            "(`{scope}:{verb}`). Absent → `'document'` (default; emits bare `read`/`write`/`delete` keys " +
+            'for backward compatibility).',
+    }).optional(),
+})
+    .meta({
+    id: 'AceConditions',
+    description: 'Conditions attached to an ACE for dynamic matching.\n' +
+        '- `principal_props`: matched against user/group properties at token time (PrincipalSet).\n' +
+        '- `resource_props`: matched against object properties at query time (ResourceSet).',
+});
+/**
+ * The access control entry as it crosses the wire.
+ *
+ * `resource` and `principal` are strings here and ObjectIds in Mongo — except for the dynamic
+ * (`principal_set` / `content_set`) entries, where the stored ObjectId is meaningless and the handler
+ * substitutes the display name out of `conditions`. That substitution is the reason these endpoints
+ * need a mapper rather than a serialized document: no cast can express "this field is a different
+ * value depending on another field".
+ *
+ * The timestamps are plain strings rather than `format: date-time`, which is what the document
+ * already publishes. Unlike `User` and `UserGroup` this is NOT safe to tighten in passing: `expires_at`
+ * shares the declaration and is written from an unvalidated payload, so an existing caller could have
+ * stored a value AJV would now reject.
+ */
+export const AccessControlEntrySchema = z
+    .object({
+    role: z.string().meta({
+        description: 'Role name. Typed as `string` because role names now span multiple partitions: `SystemRoles` ' +
+            "enum values for system-domain roles, and bare strings for ABAC-domain roles (e.g. `'content:reader'`, " +
+            "`'content:writer'`, `'content:manager'`). Mongoose schema validates the value against the " +
+            'registered role catalog via `getAllRoleNames()`.',
+    }),
+    resource_type: AccessControlResourceTypeSchema,
+    resource: z.string(),
+    principal_type: AccessControlPrincipalTypeSchema,
+    principal: z.string(),
+    account: z
+        .string()
+        .meta({ description: 'Account scope — required for principal_set/content_set ACEs.' })
+        .optional(),
+    project: z
+        .string()
+        .meta({ description: 'Project scope — narrows a principal_set/content_set ACE to a single project.' })
+        .optional(),
+    conditions: AceConditionsSchema.meta({
+        description: 'Dynamic matching conditions for principal_set/content_set ACEs.',
+    }).optional(),
+    tags: z.array(z.string()).optional(),
+    expires_at: z.string().optional(),
+    created_at: z.string().optional(),
+    updated_at: z.string().optional(),
+    id: z.string(),
+})
+    .meta({ id: 'AccessControlEntry' });
+export const AccessControlEntryArraySchema = z.array(AccessControlEntrySchema).meta({ id: 'AccessControlEntryArray' });
+/**
+ * Create and update payloads, picked from the entry rather than restated.
+ *
+ * `ACECreatePayload extends Omit<AccessControlEntry, 'created_at' | 'updated_at' | 'id'>` is what the
+ * hand-written types said, so `.omit()` is the literal translation — and the right operator here for
+ * the reason the guidance gives: the derived shape is almost everything. `ACEUpdatePayload` was
+ * `Partial<ACECreatePayload>`, which `.partial()` reproduces exactly.
+ */
+export const ACECreatePayloadSchema = AccessControlEntrySchema.omit({
+    created_at: true,
+    updated_at: true,
+    id: true,
+}).meta({ id: 'ACECreatePayload' });
+export const ACEUpdatePayloadSchema = ACECreatePayloadSchema.partial().meta({ id: 'ACEUpdatePayload' });
+/**
+ * The role catalog. Both shapes are static — computed from the in-process role registry, never read
+ * from Mongo — so these two slots carry no persistence boundary at all.
+ */
+export const RoleDefinitionSchema = z
+    .object({
+    name: z.string(),
+    permissions: z.array(z.string()),
+    domain: RoleDomainSchema,
+})
+    .meta({
+    id: 'RoleDefinition',
+    description: 'Wire shape of a role returned by the IAM `/roles` endpoint.\n\n' +
+        'Permissions are typed `string[]` because role names span multiple partitions (system, content, ' +
+        'future tasks/etc.) and each partition has its own vocabulary. For the tightly-typed system-only ' +
+        'view (with `permissions: Permission[]`) use `SystemRoleDefinition` and the `/roles/system` endpoint.\n\n' +
+        "NOTE: this interface is intentionally non-generic. The OpenAPI generator doesn't handle TypeScript " +
+        'generics cleanly in array response types and produces a degenerate `RoleDefinitionArray` schema. ' +
+        'Keeping the wire shapes concrete avoids that. `SystemRoleDefinition` extends and narrows ' +
+        '`permissions` to `Permission[]`.',
+});
+export const RoleDefinitionArraySchema = z.array(RoleDefinitionSchema).meta({ id: 'RoleDefinitionArray' });
+/**
+ * `.extend()` and not a second object: `SystemRoleDefinition extends RoleDefinition` narrowing
+ * `permissions`, expressed as the override it is. Overriding a property keeps its position, so the
+ * published property order is unchanged.
+ */
+export const SystemRoleDefinitionSchema = RoleDefinitionSchema.extend({
+    permissions: z.array(PermissionSchema),
+}).meta({
+    id: 'SystemRoleDefinition',
+    description: 'Tightly-typed view of a system-domain role: permissions are central `Permission` enum values. ' +
+        "Returned by `client.iam.roles.listSystem()` and by the server's `/roles/system` endpoint.",
+});
+export const SystemRoleDefinitionArraySchema = z
+    .array(SystemRoleDefinitionSchema)
+    .meta({ id: 'SystemRoleDefinitionArray' });
+//# sourceMappingURL=access-control.js.map

package/lib/api-schemas/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../src/api-schemas/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,gGAAgG;AAChG,iGAAiG;AACjG,OAAO,EACH,UAAU,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,UAAU,EACV,WAAW,GACd,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC;IAClF,EAAE,EAAE,2BAA2B;CAClC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC;IACpF,EAAE,EAAE,4BAA4B;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;IACrD,EAAE,EAAE,YAAY;IAChB,WAAW,EACP,6FAA6F;QAC7F,oGAAoG;QACpG,gGAAgG;QAChG,uFAAuF;CAC9F,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC;IACzD,EAAE,EAAE,wBAAwB;IAC5B,WAAW,EAAE,8FAA8F;CAC9G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACpC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC;KAChD,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACJ,eAAe,EAAE,wBAAwB,CAAC,IAAI,CAAC;QAC3C,WAAW,EAAE,yFAAyF;KACzG,CAAC,CAAC,QAAQ,EAAE;IACb,cAAc,EAAE,wBAAwB,CAAC,IAAI,CAAC;QAC1C,WAAW,EAAE,oFAAoF;KACpG,CAAC,CAAC,QAAQ,EAAE;IACb,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC;QACxB,WAAW,EACP,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,8BAA8B;KACrC,CAAC,CAAC,QAAQ,EAAE;CAChB,CAAC;KACD,IAAI,CAAC;IACF,EAAE,EAAE,eAAe;IACnB,WAAW,EACP,uDAAuD;QACvD,4FAA4F;QAC5F,oFAAoF;CAC3F,CAAC,CAAC;AAEP;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACpC,MAAM,CAAC;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAClB,WAAW,EACP,8FAA8F;YAC9F,wGAAwG;YACxG,4FAA4F;YAC5F,kDAAkD;KACzD,CAAC;IACF,aAAa,EAAE,+BAA+B;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,gCAAgC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC;SACL,MAAM,EAAE;SACR,IAAI,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;SACrF,QAAQ,EAAE;IACf,OAAO,EAAE,CAAC;SACL,MAAM,EAAE;SACR,IAAI,CAAC,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;SACrG,QAAQ,EAAE;IACf,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;QACjC,WAAW,EAAE,iEAAiE;KACjF,CAAC,CAAC,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAExC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAEvH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC,IAAI,CAAC;IAChE,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;IAChB,EAAE,EAAE,IAAI;CACX,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAExG;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAChC,MAAM,CAAC;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,gBAAgB;CAC3B,CAAC;KACD,IAAI,CAAC;IACF,EAAE,EAAE,gBAAgB;IACpB,WAAW,EACP,iEAAiE;QACjE,iGAAiG;QACjG,kGAAkG;QAClG,0GAA0G;QAC1G,qGAAqG;QACrG,mGAAmG;QACnG,2FAA2F;QAC3F,kCAAkC;CACzC,CAAC,CAAC;AAEP,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAE3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,MAAM,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACzC,CAAC,CAAC,IAAI,CAAC;IACJ,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EACP,gGAAgG;QAChG,2FAA2F;CAClG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC3C,KAAK,CAAC,0BAA0B,CAAC;KACjC,IAAI,CAAC,EAAE,EAAE,EAAE,2BAA2B,EAAE,CAAC,CAAC"}

package/lib/api-schemas/account.d.ts

@@ -0,0 +1,101 @@
+import { z } from 'zod';
+import { AccountType, BillingMethod, QuotaTier } from '../account-values.js';
+/**
+ * Runtime API schemas for the Accounts endpoints.
+ *
+ * These describe the WIRE shape — what actually crosses the HTTP boundary — which is not
+ * always what the hand-written interfaces in `user.ts` claim. Divergences are asserted in
+ * `account.contract.test.ts` rather than papered over.
+ *
+ * This module is only reachable through the `@vertesia/common/api-schemas` subpath. It must
+ * never be runtime-exported from the package root: `lib/index.js` is bundled wholesale into
+ * `lib/vertesia-common.js` and served to browsers, so a root re-export would ship zod to every
+ * UI user. The root may re-export the derived TYPES with `export type`, which tsc erases.
+ */
+/**
+ * Shared enums carry an `id` so the adapter hoists them into named components and properties
+ * reference them, rather than each property carrying its own inline copy. The distinction is
+ * invisible to JSON Schema validation and decisive for codegen: a named component becomes one
+ * reusable Java/Go enum type, while inline copies become an anonymous type per property. These
+ * names also already exist in the published spec, so keeping them avoids a breaking rename for
+ * everyone generating from it.
+ */
+export declare const BillingMethodSchema: z.ZodEnum<typeof BillingMethod>;
+export declare const AccountTypeSchema: z.ZodEnum<typeof AccountType>;
+export declare const QuotaTierSchema: z.ZodEnum<typeof QuotaTier>;
+export declare const AccountBillingSchema: z.ZodObject<{
+    method: z.ZodEnum<typeof BillingMethod>;
+    stripe_customer_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const AccountSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    namespace: z.ZodOptional<z.ZodString>;
+    app_access_message: z.ZodOptional<z.ZodString>;
+    email_domains: z.ZodArray<z.ZodString>;
+    onboarding: z.ZodObject<{
+        completed: z.ZodBoolean;
+        completed_at: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    datacenter: z.ZodString;
+    account_type: z.ZodEnum<typeof AccountType>;
+    billing: z.ZodObject<{
+        method: z.ZodEnum<typeof BillingMethod>;
+        stripe_customer_id: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    quota_tier: z.ZodOptional<z.ZodEnum<typeof QuotaTier>>;
+    feature_flags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    created_by: z.ZodString;
+    updated_by: z.ZodString;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, z.core.$strip>;
+/**
+ * No `quota_tier`. The previously published payload declared it, but `PUT /account` never applied
+ * it — the field is written only through the admin quota API. Documenting a field the handler
+ * ignores is the drift this work exists to remove, and once request validation enforces the
+ * schema, a client sending it gets an honest 400 instead of silence. It also closes the door on a
+ * future "fix" that would let an account admin raise their own rate-limit tier through the public
+ * API.
+ */
+export declare const UpdateAccountPayloadSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    app_access_message: z.ZodOptional<z.ZodString>;
+    email_domains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    billing: z.ZodOptional<z.ZodObject<{
+        method: z.ZodEnum<typeof BillingMethod>;
+        stripe_customer_id: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Stripe billing status, modelled as a real discriminated union.
+ *
+ * The hand-written `StripeBillingStatusResponse` in `meters.ts` flattens this into one object
+ * with `portal_url?` and `reason?` both optional, so a generated Java/Go client gets two
+ * unrelated optionals and no way to know which is populated. The server only ever sets
+ * `portal_url` when enabled and `reason` when disabled.
+ */
+export declare const StripeBillingEnabledSchema: z.ZodObject<{
+    status: z.ZodLiteral<"enabled">;
+    billing_method: z.ZodLiteral<BillingMethod.stripe>;
+    portal_url: z.ZodString;
+}, z.core.$strip>;
+export declare const StripeBillingDisabledSchema: z.ZodObject<{
+    status: z.ZodLiteral<"disabled">;
+    billing_method: z.ZodNullable<z.ZodEnum<typeof BillingMethod>>;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export declare const StripeBillingStatusResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"enabled">;
+    billing_method: z.ZodLiteral<BillingMethod.stripe>;
+    portal_url: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"disabled">;
+    billing_method: z.ZodNullable<z.ZodEnum<typeof BillingMethod>>;
+    reason: z.ZodString;
+}, z.core.$strip>], "status">;
+export type AccountBillingFromSchema = z.infer<typeof AccountBillingSchema>;
+export type AccountFromSchema = z.infer<typeof AccountSchema>;
+export type UpdateAccountPayloadFromSchema = z.infer<typeof UpdateAccountPayloadSchema>;
+export type StripeBillingStatusResponseFromSchema = z.infer<typeof StripeBillingStatusResponseSchema>;
+//# sourceMappingURL=account.d.ts.map

package/lib/api-schemas/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/api-schemas/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAyC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEpH;;;;;;;;;;;GAWG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,iCAAsD,CAAC;AACvF,eAAO,MAAM,iBAAiB,+BAAkD,CAAC;AACjF,eAAO,MAAM,eAAe,6BAQ1B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;iBAKE,CAAC;AAEpC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;iBAiDE,CAAC;AAE7B;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAOE,CAAC;AAE1C;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;iBAWE,CAAC;AAE1C,eAAO,MAAM,2BAA2B;;;;iBAME,CAAC;AAE3C,eAAO,MAAM,iCAAiC;;;;;;;;6BAEE,CAAC;AAEjD,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAC5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC9D,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACxF,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}