alepha 0.22.0 → 0.24.0

package/dist/api/audits/index.d.ts

@@ -3,11 +3,22 @@ import { Page } from "alepha/orm";
 import { ServerRequest } from "alepha/server";
 import { BuildExtraConfigColumns, SQL } from "drizzle-orm";
 import { PgColumnBuilderBase, PgSequenceOptions, PgTableExtraConfigValue, UpdateDeleteAction } from "drizzle-orm/pg-core";
+import "drizzle-orm/pg-core/foreign-keys";
+import "alepha/datetime";
+import "drizzle-orm/pg-core/session";
+import "alepha/crypto";
+import "drizzle-kit/api";
+import "drizzle-orm/d1";
+import "drizzle-orm/sqlite-core";
 //#region ../../src/api/audits/entities/audits.d.ts
 /**
  * Audit severity levels for categorizing events.
  */
-declare const auditSeveritySchema: import("typebox").TUnsafe<"info" | "warning" | "critical">;
+declare const auditSeveritySchema: import("zod").ZodDefault<import("zod").ZodEnum<{
+  critical: "critical";
+  info: "info";
+  warning: "warning";
+}>>;
 type AuditSeverity = Static<typeof auditSeveritySchema>;
 /**
  * Audit log entity for tracking important system events.
@@ -18,262 +29,135 @@ type AuditSeverity = Static<typeof auditSeveritySchema>;
  * - When it happened (createdAt)
  * - Context and details (metadata, ipAddress, userAgent)
  */
-declare const audits: import("alepha/orm").EntityPrimitive<import("typebox").TObject<{
-  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-  /**
-   * Audit event type (e.g., "auth", "user", "payment", "system").
-   * Used for categorizing and filtering audit events.
-   */
-  type: import("typebox").TString;
-  /**
-   * Specific action performed (e.g., "login", "logout", "create", "update", "delete").
-   */
-  action: import("typebox").TString;
-  /**
-   * Severity level of the event.
-   */
-  severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-  /**
-   * User ID who performed the action (null for system events).
-   */
-  userId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * User realm for multi-tenant support.
-   */
-  userRealm: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * User email at the time of the event (denormalized for history).
-   */
-  userEmail: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Resource type affected (e.g., "user", "order", "file").
-   */
-  resourceType: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Resource ID affected.
-   */
-  resourceId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Human-readable description of the event.
-   */
-  description: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Additional metadata/context as JSON.
-   */
-  metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  /**
-   * Client IP address.
-   */
-  ipAddress: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Client user agent.
-   */
-  userAgent: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Session ID if applicable.
-   */
-  sessionId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Request ID for correlation.
-   */
-  requestId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Whether the action was successful.
-   */
-  success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-  /**
-   * Error message if the action failed.
-   */
-  errorMessage: import("typebox").TOptional<import("typebox").TString>;
-}>>;
-declare const auditEntitySchema: import("typebox").TObject<{
-  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-  /**
-   * Audit event type (e.g., "auth", "user", "payment", "system").
-   * Used for categorizing and filtering audit events.
-   */
-  type: import("typebox").TString;
-  /**
-   * Specific action performed (e.g., "login", "logout", "create", "update", "delete").
-   */
-  action: import("typebox").TString;
-  /**
-   * Severity level of the event.
-   */
-  severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-  /**
-   * User ID who performed the action (null for system events).
-   */
-  userId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * User realm for multi-tenant support.
-   */
-  userRealm: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * User email at the time of the event (denormalized for history).
-   */
-  userEmail: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Resource type affected (e.g., "user", "order", "file").
-   */
-  resourceType: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Resource ID affected.
-   */
-  resourceId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Human-readable description of the event.
-   */
-  description: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Additional metadata/context as JSON.
-   */
-  metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  /**
-   * Client IP address.
-   */
-  ipAddress: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Client user agent.
-   */
-  userAgent: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Session ID if applicable.
-   */
-  sessionId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Request ID for correlation.
-   */
-  requestId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Whether the action was successful.
-   */
-  success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-  /**
-   * Error message if the action failed.
-   */
-  errorMessage: import("typebox").TOptional<import("typebox").TString>;
-}>;
-declare const auditEntityInsertSchema: import("alepha/orm").TObjectInsert<import("typebox").TObject<{
-  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-  /**
-   * Audit event type (e.g., "auth", "user", "payment", "system").
-   * Used for categorizing and filtering audit events.
-   */
-  type: import("typebox").TString;
-  /**
-   * Specific action performed (e.g., "login", "logout", "create", "update", "delete").
-   */
-  action: import("typebox").TString;
-  /**
-   * Severity level of the event.
-   */
-  severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-  /**
-   * User ID who performed the action (null for system events).
-   */
-  userId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * User realm for multi-tenant support.
-   */
-  userRealm: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * User email at the time of the event (denormalized for history).
-   */
-  userEmail: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Resource type affected (e.g., "user", "order", "file").
-   */
-  resourceType: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Resource ID affected.
-   */
-  resourceId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Human-readable description of the event.
-   */
-  description: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Additional metadata/context as JSON.
-   */
-  metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  /**
-   * Client IP address.
-   */
-  ipAddress: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Client user agent.
-   */
-  userAgent: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Session ID if applicable.
-   */
-  sessionId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Request ID for correlation.
-   */
-  requestId: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Whether the action was successful.
-   */
-  success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-  /**
-   * Error message if the action failed.
-   */
-  errorMessage: import("typebox").TOptional<import("typebox").TString>;
-}>>;
+declare const audits: import("alepha/orm").EntityPrimitive<import("zod").ZodObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+  type: import("zod").ZodString;
+  action: import("zod").ZodString;
+  severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+    critical: "critical";
+    info: "info";
+    warning: "warning";
+  }>>, typeof import("alepha/orm").PG_DEFAULT>;
+  userId: import("zod").ZodOptional<import("zod").ZodString>;
+  userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+  userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+  description: import("zod").ZodOptional<import("zod").ZodString>;
+  metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+  userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+  sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+  requestId: import("zod").ZodOptional<import("zod").ZodString>;
+  success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+  errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>>;
+declare const auditEntitySchema: import("zod").ZodObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+  type: import("zod").ZodString;
+  action: import("zod").ZodString;
+  severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+    critical: "critical";
+    info: "info";
+    warning: "warning";
+  }>>, typeof import("alepha/orm").PG_DEFAULT>;
+  userId: import("zod").ZodOptional<import("zod").ZodString>;
+  userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+  userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+  description: import("zod").ZodOptional<import("zod").ZodString>;
+  metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+  userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+  sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+  requestId: import("zod").ZodOptional<import("zod").ZodString>;
+  success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+  errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
+declare const auditEntityInsertSchema: import("alepha/orm").TObjectInsert<import("zod").ZodObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+  type: import("zod").ZodString;
+  action: import("zod").ZodString;
+  severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+    critical: "critical";
+    info: "info";
+    warning: "warning";
+  }>>, typeof import("alepha/orm").PG_DEFAULT>;
+  userId: import("zod").ZodOptional<import("zod").ZodString>;
+  userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+  userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+  description: import("zod").ZodOptional<import("zod").ZodString>;
+  metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+  userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+  sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+  requestId: import("zod").ZodOptional<import("zod").ZodString>;
+  success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+  errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>>;
 type AuditEntity = Static<typeof audits.schema>;
 //#endregion
 //#region ../../src/api/audits/schemas/auditQuerySchema.d.ts
 /**
  * Query schema for searching and filtering audit logs.
  */
-declare const auditQuerySchema: import("typebox").TObject<{
-  page: import("typebox").TOptional<import("typebox").TInteger>;
-  size: import("typebox").TOptional<import("typebox").TInteger>;
-  sort: import("typebox").TOptional<import("typebox").TString>;
-  type: import("typebox").TOptional<import("typebox").TString>;
-  action: import("typebox").TOptional<import("typebox").TString>;
-  severity: import("typebox").TOptional<import("typebox").TUnsafe<"info" | "warning" | "critical">>;
-  userId: import("typebox").TOptional<import("typebox").TString>;
-  userRealm: import("typebox").TOptional<import("typebox").TString>;
-  resourceType: import("typebox").TOptional<import("typebox").TString>;
-  resourceId: import("typebox").TOptional<import("typebox").TString>;
-  success: import("typebox").TOptional<import("typebox").TBoolean>;
-  from: import("typebox").TOptional<import("typebox").TString>;
-  to: import("typebox").TOptional<import("typebox").TString>;
-  search: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const auditQuerySchema: import("zod").ZodObject<{
+  page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+  size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+  sort: import("zod").ZodOptional<import("zod").ZodString>;
+  type: import("zod").ZodOptional<import("zod").ZodString>;
+  action: import("zod").ZodOptional<import("zod").ZodString>;
+  severity: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+    critical: "critical";
+    info: "info";
+    warning: "warning";
+  }>>>;
+  userId: import("zod").ZodOptional<import("zod").ZodString>;
+  userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+  success: import("zod").ZodOptional<import("zod").ZodBoolean>;
+  from: import("zod").ZodOptional<import("zod").ZodString>;
+  to: import("zod").ZodOptional<import("zod").ZodString>;
+  search: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type AuditQuery = Static<typeof auditQuerySchema>;
 //#endregion
 //#region ../../src/api/audits/schemas/createAuditSchema.d.ts
 /**
  * Schema for creating a new audit log entry.
  */
-declare const createAuditSchema: import("typebox").TObject<{
-  type: import("typebox").TString;
-  action: import("typebox").TString;
-  severity: import("typebox").TOptional<import("typebox").TUnsafe<"info" | "warning" | "critical">>;
-  userId: import("typebox").TOptional<import("typebox").TString>;
-  userRealm: import("typebox").TOptional<import("typebox").TString>;
-  userEmail: import("typebox").TOptional<import("typebox").TString>;
-  resourceType: import("typebox").TOptional<import("typebox").TString>;
-  resourceId: import("typebox").TOptional<import("typebox").TString>;
-  description: import("typebox").TOptional<import("typebox").TString>;
-  metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  ipAddress: import("typebox").TOptional<import("typebox").TString>;
-  userAgent: import("typebox").TOptional<import("typebox").TString>;
-  sessionId: import("typebox").TOptional<import("typebox").TString>;
-  requestId: import("typebox").TOptional<import("typebox").TString>;
-  success: import("typebox").TOptional<import("typebox").TBoolean>;
-  errorMessage: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const createAuditSchema: import("zod").ZodObject<{
+  type: import("zod").ZodString;
+  action: import("zod").ZodString;
+  severity: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+    critical: "critical";
+    info: "info";
+    warning: "warning";
+  }>>>;
+  userId: import("zod").ZodOptional<import("zod").ZodString>;
+  userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+  userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+  description: import("zod").ZodOptional<import("zod").ZodString>;
+  metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+  userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+  sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+  requestId: import("zod").ZodOptional<import("zod").ZodString>;
+  success: import("zod").ZodOptional<import("zod").ZodBoolean>;
+  errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type CreateAudit = Static<typeof createAuditSchema>;
 //#endregion
 //#region ../../src/api/audits/services/AuditService.d.ts
@@ -284,6 +168,13 @@ interface AuditTypeDefinition {
   type: string;
   description?: string;
   actions: string[];
+  /**
+   * Dedicated retention (in days) for this audit type.
+   *
+   * Overrides the global default applied by the cleanup job. `0` keeps entries
+   * forever. When `undefined`, the global default retention applies.
+   */
+  retentionDays?: number;
 }
 /**
  * Service for managing audit logs.
@@ -297,27 +188,31 @@ interface AuditTypeDefinition {
 declare class AuditService {
   protected readonly alepha: Alepha;
   protected readonly log: import("alepha/logger").Logger;
-  protected readonly repo: import("alepha/orm").Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-    type: import("typebox").TString;
-    action: import("typebox").TString;
-    severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-    userId: import("typebox").TOptional<import("typebox").TString>;
-    userRealm: import("typebox").TOptional<import("typebox").TString>;
-    userEmail: import("typebox").TOptional<import("typebox").TString>;
-    resourceType: import("typebox").TOptional<import("typebox").TString>;
-    resourceId: import("typebox").TOptional<import("typebox").TString>;
-    description: import("typebox").TOptional<import("typebox").TString>;
-    metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-    ipAddress: import("typebox").TOptional<import("typebox").TString>;
-    userAgent: import("typebox").TOptional<import("typebox").TString>;
-    sessionId: import("typebox").TOptional<import("typebox").TString>;
-    requestId: import("typebox").TOptional<import("typebox").TString>;
-    success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-    errorMessage: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
+  protected readonly repo: import("alepha/orm").Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+    type: import("zod").ZodString;
+    action: import("zod").ZodString;
+    severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+      critical: "critical";
+      info: "info";
+      warning: "warning";
+    }>>, typeof import("alepha/orm").PG_DEFAULT>;
+    userId: import("zod").ZodOptional<import("zod").ZodString>;
+    userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+    userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+    resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+    resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+    description: import("zod").ZodOptional<import("zod").ZodString>;
+    metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+    ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+    userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+    sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+    requestId: import("zod").ZodOptional<import("zod").ZodString>;
+    success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
   /**
    * Registry of audit types and their allowed actions.
    */
@@ -377,9 +272,27 @@ declare class AuditService {
     userRealm?: string;
   }): Promise<AuditStats>;
   /**
-   * Delete old audit entries (for retention policy).
+   * Delete audit entries created before the given date (retention policy).
+   *
+   * @returns number of deleted entries.
    */
   deleteOlderThan(date: Date): Promise<number>;
+  /**
+   * Delete audit entries that have outlived their retention window.
+   *
+   * Each registered audit type that declares a dedicated `retentionDays` is
+   * pruned using its own window; every other type — including unregistered or
+   * legacy types — falls back to `defaultRetentionDays`. A retention of `0`
+   * (per-type or default) keeps that scope forever.
+   *
+   * `now` is injected rather than read from the clock so the policy is
+   * deterministic and testable.
+   *
+   * @param now - reference "now" used to compute cutoff dates.
+   * @param defaultRetentionDays - global default for types without an override.
+   * @returns total number of deleted entries.
+   */
+  deleteExpired(now: Date, defaultRetentionDays: number): Promise<number>;
 }
 /**
  * Audit statistics summary.
@@ -406,311 +319,434 @@ declare class AdminAuditController {
   protected readonly url = "/audits";
   protected readonly group = "admin:audits";
   protected readonly auditService: AuditService;
-  protected readonly repo: import("alepha/orm").Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-    type: import("typebox").TString;
-    action: import("typebox").TString;
-    severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-    userId: import("typebox").TOptional<import("typebox").TString>;
-    userRealm: import("typebox").TOptional<import("typebox").TString>;
-    userEmail: import("typebox").TOptional<import("typebox").TString>;
-    resourceType: import("typebox").TOptional<import("typebox").TString>;
-    resourceId: import("typebox").TOptional<import("typebox").TString>;
-    description: import("typebox").TOptional<import("typebox").TString>;
-    metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-    ipAddress: import("typebox").TOptional<import("typebox").TString>;
-    userAgent: import("typebox").TOptional<import("typebox").TString>;
-    sessionId: import("typebox").TOptional<import("typebox").TString>;
-    requestId: import("typebox").TOptional<import("typebox").TString>;
-    success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-    errorMessage: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
+  protected readonly repo: import("alepha/orm").Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+    type: import("zod").ZodString;
+    action: import("zod").ZodString;
+    severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+      critical: "critical";
+      info: "info";
+      warning: "warning";
+    }>>, typeof import("alepha/orm").PG_DEFAULT>;
+    userId: import("zod").ZodOptional<import("zod").ZodString>;
+    userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+    userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+    resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+    resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+    description: import("zod").ZodOptional<import("zod").ZodString>;
+    metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+    ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+    userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+    sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+    requestId: import("zod").ZodOptional<import("zod").ZodString>;
+    success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
   /**
    * Find audit entries with filtering and pagination.
    */
   readonly findAudits: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      page: import("typebox").TOptional<import("typebox").TInteger>;
-      size: import("typebox").TOptional<import("typebox").TInteger>;
-      sort: import("typebox").TOptional<import("typebox").TString>;
-      type: import("typebox").TOptional<import("typebox").TString>;
-      action: import("typebox").TOptional<import("typebox").TString>;
-      severity: import("typebox").TOptional<import("typebox").TUnsafe<"info" | "warning" | "critical">>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      resourceType: import("typebox").TOptional<import("typebox").TString>;
-      resourceId: import("typebox").TOptional<import("typebox").TString>;
-      success: import("typebox").TOptional<import("typebox").TBoolean>;
-      from: import("typebox").TOptional<import("typebox").TString>;
-      to: import("typebox").TOptional<import("typebox").TString>;
-      search: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("alepha").TPage<import("typebox").TObject<{
-      id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-      createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-      organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-      type: import("typebox").TString;
-      action: import("typebox").TString;
-      severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      userEmail: import("typebox").TOptional<import("typebox").TString>;
-      resourceType: import("typebox").TOptional<import("typebox").TString>;
-      resourceId: import("typebox").TOptional<import("typebox").TString>;
-      description: import("typebox").TOptional<import("typebox").TString>;
-      metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-      ipAddress: import("typebox").TOptional<import("typebox").TString>;
-      userAgent: import("typebox").TOptional<import("typebox").TString>;
-      sessionId: import("typebox").TOptional<import("typebox").TString>;
-      requestId: import("typebox").TOptional<import("typebox").TString>;
-      success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-      errorMessage: import("typebox").TOptional<import("typebox").TString>;
-    }>>;
+    query: import("zod").ZodObject<{
+      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      sort: import("zod").ZodOptional<import("zod").ZodString>;
+      type: import("zod").ZodOptional<import("zod").ZodString>;
+      action: import("zod").ZodOptional<import("zod").ZodString>;
+      severity: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+        critical: "critical";
+        info: "info";
+        warning: "warning";
+      }>>>;
+      userId: import("zod").ZodOptional<import("zod").ZodString>;
+      userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+      success: import("zod").ZodOptional<import("zod").ZodBoolean>;
+      from: import("zod").ZodOptional<import("zod").ZodString>;
+      to: import("zod").ZodOptional<import("zod").ZodString>;
+      search: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      content: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+        createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+        organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+        type: import("zod").ZodString;
+        action: import("zod").ZodString;
+        severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+          critical: "critical";
+          info: "info";
+          warning: "warning";
+        }>>, typeof import("alepha/orm").PG_DEFAULT>;
+        userId: import("zod").ZodOptional<import("zod").ZodString>;
+        userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+        userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+        description: import("zod").ZodOptional<import("zod").ZodString>;
+        metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+        ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+        userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+        sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+        requestId: import("zod").ZodOptional<import("zod").ZodString>;
+        success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+        errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      page: import("zod").ZodObject<{
+        number: import("zod").ZodInt;
+        size: import("zod").ZodInt;
+        offset: import("zod").ZodInt;
+        numberOfElements: import("zod").ZodInt;
+        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
+        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
+        isEmpty: import("zod").ZodBoolean;
+        isFirst: import("zod").ZodBoolean;
+        isLast: import("zod").ZodBoolean;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Get a single audit entry by ID.
    */
   readonly getAudit: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      id: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-      createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-      organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-      type: import("typebox").TString;
-      action: import("typebox").TString;
-      severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      userEmail: import("typebox").TOptional<import("typebox").TString>;
-      resourceType: import("typebox").TOptional<import("typebox").TString>;
-      resourceId: import("typebox").TOptional<import("typebox").TString>;
-      description: import("typebox").TOptional<import("typebox").TString>;
-      metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-      ipAddress: import("typebox").TOptional<import("typebox").TString>;
-      userAgent: import("typebox").TOptional<import("typebox").TString>;
-      sessionId: import("typebox").TOptional<import("typebox").TString>;
-      requestId: import("typebox").TOptional<import("typebox").TString>;
-      success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-      errorMessage: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    params: import("zod").ZodObject<{
+      id: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+      createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+      organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+      type: import("zod").ZodString;
+      action: import("zod").ZodString;
+      severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+        critical: "critical";
+        info: "info";
+        warning: "warning";
+      }>>, typeof import("alepha/orm").PG_DEFAULT>;
+      userId: import("zod").ZodOptional<import("zod").ZodString>;
+      userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+      userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+      description: import("zod").ZodOptional<import("zod").ZodString>;
+      metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+      ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+      userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+      sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+      requestId: import("zod").ZodOptional<import("zod").ZodString>;
+      success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+      errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Delete many audit entries by id in one repository call. Use with care —
    * audit logs are usually retained for compliance reasons.
    */
   readonly deleteAudits: import("alepha/server").ActionPrimitiveFn<{
-    body: import("typebox").TObject<{
-      ids: import("typebox").TArray<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      deleted: import("typebox").TArray<import("typebox").TString>;
-    }>;
+    body: import("zod").ZodObject<{
+      ids: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      deleted: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Create a new audit entry.
    * System-only — this permission should never be assigned to human roles.
    */
   readonly createAudit: import("alepha/server").ActionPrimitiveFn<{
-    body: import("typebox").TObject<{
-      type: import("typebox").TString;
-      action: import("typebox").TString;
-      severity: import("typebox").TOptional<import("typebox").TUnsafe<"info" | "warning" | "critical">>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      userEmail: import("typebox").TOptional<import("typebox").TString>;
-      resourceType: import("typebox").TOptional<import("typebox").TString>;
-      resourceId: import("typebox").TOptional<import("typebox").TString>;
-      description: import("typebox").TOptional<import("typebox").TString>;
-      metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-      ipAddress: import("typebox").TOptional<import("typebox").TString>;
-      userAgent: import("typebox").TOptional<import("typebox").TString>;
-      sessionId: import("typebox").TOptional<import("typebox").TString>;
-      requestId: import("typebox").TOptional<import("typebox").TString>;
-      success: import("typebox").TOptional<import("typebox").TBoolean>;
-      errorMessage: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-      createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-      organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-      type: import("typebox").TString;
-      action: import("typebox").TString;
-      severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      userEmail: import("typebox").TOptional<import("typebox").TString>;
-      resourceType: import("typebox").TOptional<import("typebox").TString>;
-      resourceId: import("typebox").TOptional<import("typebox").TString>;
-      description: import("typebox").TOptional<import("typebox").TString>;
-      metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-      ipAddress: import("typebox").TOptional<import("typebox").TString>;
-      userAgent: import("typebox").TOptional<import("typebox").TString>;
-      sessionId: import("typebox").TOptional<import("typebox").TString>;
-      requestId: import("typebox").TOptional<import("typebox").TString>;
-      success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-      errorMessage: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    body: import("zod").ZodObject<{
+      type: import("zod").ZodString;
+      action: import("zod").ZodString;
+      severity: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+        critical: "critical";
+        info: "info";
+        warning: "warning";
+      }>>>;
+      userId: import("zod").ZodOptional<import("zod").ZodString>;
+      userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+      userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+      description: import("zod").ZodOptional<import("zod").ZodString>;
+      metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+      ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+      userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+      sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+      requestId: import("zod").ZodOptional<import("zod").ZodString>;
+      success: import("zod").ZodOptional<import("zod").ZodBoolean>;
+      errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+      createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+      organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+      type: import("zod").ZodString;
+      action: import("zod").ZodString;
+      severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+        critical: "critical";
+        info: "info";
+        warning: "warning";
+      }>>, typeof import("alepha/orm").PG_DEFAULT>;
+      userId: import("zod").ZodOptional<import("zod").ZodString>;
+      userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+      userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+      description: import("zod").ZodOptional<import("zod").ZodString>;
+      metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+      ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+      userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+      sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+      requestId: import("zod").ZodOptional<import("zod").ZodString>;
+      success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+      errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Get audit entries for a specific user.
    */
   readonly findByUser: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      userId: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      type: import("typebox").TOptional<import("typebox").TString>;
-      search: import("typebox").TOptional<import("typebox").TString>;
-      action: import("typebox").TOptional<import("typebox").TString>;
-      severity: import("typebox").TOptional<import("typebox").TUnsafe<"info" | "warning" | "critical">>;
-      sort: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      resourceType: import("typebox").TOptional<import("typebox").TString>;
-      resourceId: import("typebox").TOptional<import("typebox").TString>;
-      success: import("typebox").TOptional<import("typebox").TBoolean>;
-      page: import("typebox").TOptional<import("typebox").TInteger>;
-      size: import("typebox").TOptional<import("typebox").TInteger>;
-      from: import("typebox").TOptional<import("typebox").TString>;
-      to: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("alepha").TPage<import("typebox").TObject<{
-      id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-      createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-      organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-      type: import("typebox").TString;
-      action: import("typebox").TString;
-      severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      userEmail: import("typebox").TOptional<import("typebox").TString>;
-      resourceType: import("typebox").TOptional<import("typebox").TString>;
-      resourceId: import("typebox").TOptional<import("typebox").TString>;
-      description: import("typebox").TOptional<import("typebox").TString>;
-      metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-      ipAddress: import("typebox").TOptional<import("typebox").TString>;
-      userAgent: import("typebox").TOptional<import("typebox").TString>;
-      sessionId: import("typebox").TOptional<import("typebox").TString>;
-      requestId: import("typebox").TOptional<import("typebox").TString>;
-      success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-      errorMessage: import("typebox").TOptional<import("typebox").TString>;
-    }>>;
+    params: import("zod").ZodObject<{
+      userId: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      sort: import("zod").ZodOptional<import("zod").ZodString>;
+      type: import("zod").ZodOptional<import("zod").ZodString>;
+      action: import("zod").ZodOptional<import("zod").ZodString>;
+      severity: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+        critical: "critical";
+        info: "info";
+        warning: "warning";
+      }>>>;
+      userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+      resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+      success: import("zod").ZodOptional<import("zod").ZodBoolean>;
+      from: import("zod").ZodOptional<import("zod").ZodString>;
+      to: import("zod").ZodOptional<import("zod").ZodString>;
+      search: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      content: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+        createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+        organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+        type: import("zod").ZodString;
+        action: import("zod").ZodString;
+        severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+          critical: "critical";
+          info: "info";
+          warning: "warning";
+        }>>, typeof import("alepha/orm").PG_DEFAULT>;
+        userId: import("zod").ZodOptional<import("zod").ZodString>;
+        userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+        userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+        description: import("zod").ZodOptional<import("zod").ZodString>;
+        metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+        ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+        userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+        sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+        requestId: import("zod").ZodOptional<import("zod").ZodString>;
+        success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+        errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      page: import("zod").ZodObject<{
+        number: import("zod").ZodInt;
+        size: import("zod").ZodInt;
+        offset: import("zod").ZodInt;
+        numberOfElements: import("zod").ZodInt;
+        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
+        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
+        isEmpty: import("zod").ZodBoolean;
+        isFirst: import("zod").ZodBoolean;
+        isLast: import("zod").ZodBoolean;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Get audit entries for a specific resource.
    */
   readonly findByResource: import("alepha/server").ActionPrimitiveFn<{
-    params: import("typebox").TObject<{
-      resourceType: import("typebox").TString;
-      resourceId: import("typebox").TString;
-    }>;
-    query: import("typebox").TObject<{
-      type: import("typebox").TOptional<import("typebox").TString>;
-      search: import("typebox").TOptional<import("typebox").TString>;
-      action: import("typebox").TOptional<import("typebox").TString>;
-      severity: import("typebox").TOptional<import("typebox").TUnsafe<"info" | "warning" | "critical">>;
-      sort: import("typebox").TOptional<import("typebox").TString>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      success: import("typebox").TOptional<import("typebox").TBoolean>;
-      page: import("typebox").TOptional<import("typebox").TInteger>;
-      size: import("typebox").TOptional<import("typebox").TInteger>;
-      from: import("typebox").TOptional<import("typebox").TString>;
-      to: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("alepha").TPage<import("typebox").TObject<{
-      id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-      createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-      organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-      type: import("typebox").TString;
-      action: import("typebox").TString;
-      severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-      userId: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-      userEmail: import("typebox").TOptional<import("typebox").TString>;
-      resourceType: import("typebox").TOptional<import("typebox").TString>;
-      resourceId: import("typebox").TOptional<import("typebox").TString>;
-      description: import("typebox").TOptional<import("typebox").TString>;
-      metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-      ipAddress: import("typebox").TOptional<import("typebox").TString>;
-      userAgent: import("typebox").TOptional<import("typebox").TString>;
-      sessionId: import("typebox").TOptional<import("typebox").TString>;
-      requestId: import("typebox").TOptional<import("typebox").TString>;
-      success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-      errorMessage: import("typebox").TOptional<import("typebox").TString>;
-    }>>;
+    params: import("zod").ZodObject<{
+      resourceType: import("zod").ZodString;
+      resourceId: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    query: import("zod").ZodObject<{
+      page: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      size: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodInt>>;
+      sort: import("zod").ZodOptional<import("zod").ZodString>;
+      type: import("zod").ZodOptional<import("zod").ZodString>;
+      action: import("zod").ZodOptional<import("zod").ZodString>;
+      severity: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+        critical: "critical";
+        info: "info";
+        warning: "warning";
+      }>>>;
+      userId: import("zod").ZodOptional<import("zod").ZodString>;
+      userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+      success: import("zod").ZodOptional<import("zod").ZodBoolean>;
+      from: import("zod").ZodOptional<import("zod").ZodString>;
+      to: import("zod").ZodOptional<import("zod").ZodString>;
+      search: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      content: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+        createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+        organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+        type: import("zod").ZodString;
+        action: import("zod").ZodString;
+        severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+          critical: "critical";
+          info: "info";
+          warning: "warning";
+        }>>, typeof import("alepha/orm").PG_DEFAULT>;
+        userId: import("zod").ZodOptional<import("zod").ZodString>;
+        userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+        userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+        description: import("zod").ZodOptional<import("zod").ZodString>;
+        metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+        ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+        userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+        sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+        requestId: import("zod").ZodOptional<import("zod").ZodString>;
+        success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+        errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      page: import("zod").ZodObject<{
+        number: import("zod").ZodInt;
+        size: import("zod").ZodInt;
+        offset: import("zod").ZodInt;
+        numberOfElements: import("zod").ZodInt;
+        totalElements: import("zod").ZodOptional<import("zod").ZodInt>;
+        totalPages: import("zod").ZodOptional<import("zod").ZodInt>;
+        isEmpty: import("zod").ZodBoolean;
+        isFirst: import("zod").ZodBoolean;
+        isLast: import("zod").ZodBoolean;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Get audit statistics.
    */
   readonly getAuditStats: import("alepha/server").ActionPrimitiveFn<{
-    query: import("typebox").TObject<{
-      from: import("typebox").TOptional<import("typebox").TString>;
-      to: import("typebox").TOptional<import("typebox").TString>;
-      userRealm: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      total: import("typebox").TInteger;
-      byType: import("typebox").TRecord<"^.*$", import("typebox").TInteger>;
-      bySeverity: import("typebox").TObject<{
-        info: import("typebox").TInteger;
-        warning: import("typebox").TInteger;
-        critical: import("typebox").TInteger;
-      }>;
-      successRate: import("typebox").TNumber;
-      recentFailures: import("typebox").TArray<import("typebox").TObject<{
-        id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-        createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-        organizationId: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_ORGANIZATION>;
-        type: import("typebox").TString;
-        action: import("typebox").TString;
-        severity: import("alepha/orm").PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof import("alepha/orm").PG_DEFAULT>;
-        userId: import("typebox").TOptional<import("typebox").TString>;
-        userRealm: import("typebox").TOptional<import("typebox").TString>;
-        userEmail: import("typebox").TOptional<import("typebox").TString>;
-        resourceType: import("typebox").TOptional<import("typebox").TString>;
-        resourceId: import("typebox").TOptional<import("typebox").TString>;
-        description: import("typebox").TOptional<import("typebox").TString>;
-        metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-        ipAddress: import("typebox").TOptional<import("typebox").TString>;
-        userAgent: import("typebox").TOptional<import("typebox").TString>;
-        sessionId: import("typebox").TOptional<import("typebox").TString>;
-        requestId: import("typebox").TOptional<import("typebox").TString>;
-        success: import("alepha/orm").PgAttr<import("typebox").TBoolean, typeof import("alepha/orm").PG_DEFAULT>;
-        errorMessage: import("typebox").TOptional<import("typebox").TString>;
-      }>>;
-    }>;
+    query: import("zod").ZodObject<{
+      from: import("zod").ZodOptional<import("zod").ZodString>;
+      to: import("zod").ZodOptional<import("zod").ZodString>;
+      userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      total: import("zod").ZodInt;
+      byType: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodInt>;
+      bySeverity: import("zod").ZodObject<{
+        info: import("zod").ZodInt;
+        warning: import("zod").ZodInt;
+        critical: import("zod").ZodInt;
+      }, import("zod/v4/core").$strip>;
+      successRate: import("zod").ZodNumber;
+      recentFailures: import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+        createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+        organizationId: import("alepha/orm").PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof import("alepha/orm").PG_ORGANIZATION>;
+        type: import("zod").ZodString;
+        action: import("zod").ZodString;
+        severity: import("alepha/orm").PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+          critical: "critical";
+          info: "info";
+          warning: "warning";
+        }>>, typeof import("alepha/orm").PG_DEFAULT>;
+        userId: import("zod").ZodOptional<import("zod").ZodString>;
+        userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+        userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+        description: import("zod").ZodOptional<import("zod").ZodString>;
+        metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+        ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+        userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+        sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+        requestId: import("zod").ZodOptional<import("zod").ZodString>;
+        success: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+        errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * List distinct action names present in the audit log (for filters).
    */
   readonly getAuditActions: import("alepha/server").ActionPrimitiveFn<{
-    response: import("typebox").TArray<import("typebox").TString>;
+    response: import("zod").ZodArray<import("zod").ZodString>;
   }>;
   /**
    * Get registered audit types.
    */
   readonly getTypes: import("alepha/server").ActionPrimitiveFn<{
-    response: import("typebox").TArray<import("typebox").TObject<{
-      type: import("typebox").TString;
-      description: import("typebox").TOptional<import("typebox").TString>;
-      actions: import("typebox").TArray<import("typebox").TString>;
-    }>>;
+    response: import("zod").ZodArray<import("zod").ZodObject<{
+      type: import("zod").ZodString;
+      description: import("zod").ZodOptional<import("zod").ZodString>;
+      actions: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
   }>;
   /**
    * Get distinct values for filters.
    */
   readonly getFilterOptions: import("alepha/server").ActionPrimitiveFn<{
-    response: import("typebox").TObject<{
-      types: import("typebox").TArray<import("typebox").TString>;
-      actions: import("typebox").TArray<import("typebox").TString>;
-      resourceTypes: import("typebox").TArray<import("typebox").TString>;
-      userRealms: import("typebox").TArray<import("typebox").TString>;
-    }>;
+    response: import("zod").ZodObject<{
+      types: import("zod").ZodArray<import("zod").ZodString>;
+      actions: import("zod").ZodArray<import("zod").ZodString>;
+      resourceTypes: import("zod").ZodArray<import("zod").ZodString>;
+      userRealms: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+  }>;
+}
+//#endregion
+//#region ../../src/api/audits/parameters/AuditParameters.d.ts
+/**
+ * Audit module configuration atom.
+ */
+declare const auditOptions: import("alepha").Atom<import("zod").ZodObject<{
+  retentionDays: import("zod").ZodDefault<import("zod").ZodInt>;
+}, import("zod/v4/core").$strip>, "alepha.api.audits.options">;
+type AuditOptions = Static<typeof auditOptions.schema>;
+declare module "alepha" {
+  interface State {
+    [auditOptions.key]: AuditOptions;
+  }
+}
+/**
+ * Typed accessor for audit module configuration ({@link auditOptions}).
+ */
+declare class AuditParameters {
+  protected readonly options: Readonly<{
+    retentionDays: number;
   }>;
+  get<K extends keyof AuditOptions>(key: K): AuditOptions[K];
+}
+//#endregion
+//#region ../../src/api/audits/jobs/AuditJobs.d.ts
+/**
+ * Scheduled enforcement of the audit retention policy.
+ */
+declare class AuditJobs {
+  protected readonly auditService: AuditService;
+  protected readonly auditParameters: AuditParameters;
+  /**
+   * Delete audit entries that have outlived their retention window.
+   *
+   * Runs daily and applies each audit type's dedicated `retentionDays` plus the
+   * global default (`auditOptions.retentionDays`). A default of `0` disables
+   * cleanup for types without a dedicated retention.
+   */
+  readonly cleanExpired: import("alepha/scheduler").SchedulerPrimitive;
 }
 //#endregion
 //#region ../../src/api/audits/primitives/$audit.d.ts
@@ -730,6 +766,21 @@ interface AuditPrimitiveOptions {
    * List of allowed actions for this audit type.
    */
   actions: string[];
+  /**
+   * Number of days entries of this audit type are retained before the periodic
+   * cleanup job deletes them.
+   *
+   * Overrides the global default retention (see `auditOptions.retentionDays` in
+   * `AuditParameters`). Set to `0` to keep this type's entries forever,
+   * regardless of the global default. When omitted, the global default applies.
+   *
+   * @example
+   * ```ts
+   * // Keep security audits for two years, ignoring the global default.
+   * $audit({ type: "security", actions: ["login"], retentionDays: 730 });
+   * ```
+   */
+  retentionDays?: number;
 }
 /**
  * Audit type primitive for registering domain-specific audit events.
@@ -771,6 +822,10 @@ declare class AuditPrimitive extends Primitive<AuditPrimitiveOptions> {
    * The allowed actions for this audit type.
    */
   get actions(): string[];
+  /**
+   * The dedicated retention (in days) for this audit type, if set.
+   */
+  get retentionDays(): number | undefined;
   /**
    * Log an audit event for this type.
    */
@@ -836,15 +891,13 @@ declare const $audit: {
  * Before: { name: string; age: number(default=0); fullName: generated }
  * After:  { name: string; age?: number; }
  */
-type TObjectInsert<T extends TObject> = TObject<{ [K in keyof T["properties"] as T["properties"][K] extends {
+type TObjectInsert<T extends TObject> = TObject<{ [K in keyof T["shape"] as T["shape"][K] extends {
   [PG_GENERATED]: any;
-} ? never : K]: T["properties"][K] extends {
+} ? never : K]: T["shape"][K] extends {
   [PG_DEFAULT]: any;
 } | {
   [PG_ORGANIZATION]: any;
-} | {
-  "~optional": true;
-} ? TOptional<T["properties"][K]> : T["properties"][K] }>;
+} ? TOptional<Extract<T["shape"][K], TSchema>> : T["shape"][K]; }>;
 //#endregion
 //#region ../../src/orm/core/schemas/updateSchema.d.ts
 /**
@@ -856,9 +909,9 @@ type TObjectInsert<T extends TObject> = TObject<{ [K in keyof T["properties"] as
  * Before: { name?: string; age: number; fullName: generated }
  * After:  { name?: string | null; age: number; }
  */
-type TObjectUpdate<T extends TObject> = TObject<{ [K in keyof T["properties"] as T["properties"][K] extends {
+type TObjectUpdate<T extends TObject> = TObject<{ [K in keyof T["shape"] as T["shape"][K] extends {
   [PG_GENERATED]: any;
-} ? never : K]: T["properties"][K] extends TOptional<infer U> ? TOptional<TUnion<[U, TNull]>> : T["properties"][K] }>;
+} ? never : K]: T["shape"][K] extends TOptional<infer U extends TSchema> ? TOptional<TUnion<[U, TNull]>> : T["shape"][K]; }>;
 //#endregion
 //#region ../../src/orm/core/primitives/$entity.d.ts
 interface EntityPrimitiveOptions<T extends TObject, Keys = keyof Static<T>> {
@@ -1018,18 +1071,20 @@ declare class EntityPrimitive<T extends TObject = TObject> {
   get cols(): EntityColumns<T>;
   get name(): string;
   get schema(): T;
+  protected _insertSchema?: TObjectInsert<T>;
   get insertSchema(): TObjectInsert<T>;
+  protected _updateSchema?: TObjectUpdate<T>;
   get updateSchema(): TObjectUpdate<T>;
 }
 /**
  * Convert a schema to columns.
  */
-type FromSchema<T extends TObject> = { [key in keyof T["properties"]]: PgColumnBuilderBase };
+type FromSchema<T extends TObject> = { [key in keyof T["properties"]]: PgColumnBuilderBase; };
 type EntityColumn<T extends TObject> = {
   name: string;
   entity: EntityPrimitive<T>;
 };
-type EntityColumns<T extends TObject> = { [key in keyof T["properties"]]: EntityColumn<T> };
+type EntityColumns<T extends TObject> = { [key in keyof T["properties"]]: EntityColumn<T>; };
 //#endregion
 //#region ../../src/orm/core/constants/PG_SYMBOLS.d.ts
 declare const PG_DEFAULT: unique symbol;
@@ -1058,13 +1113,24 @@ type PgSymbols = {
   [PG_REF]: PgRefOptions;
   [PG_ENUM]: PgEnumOptions;
   [PG_GENERATED]: PgGeneratedOptions;
-  [PG_ORGANIZATION]: {};
+  [PG_ORGANIZATION]: PgOrganizationOptions;
   /**
    * @deprecated Use `PG_IDENTITY` instead.
    */
   [PG_SERIAL]: {};
 };
 type PgSymbolKeys = keyof PgSymbols;
+interface PgOrganizationOptions {
+  /**
+   * Fail-closed tenant scoping. When `true`, the repository (a) refuses any
+   * read/write with no resolved tenant instead of falling through to an
+   * unfiltered "see/write everything" query, and (b) drops the
+   * `OR organizationId IS NULL` "global row" escape — a scoped tenant never
+   * sees NULL/global rows. Use for security-sensitive tables. Defaults to
+   * `false` (the historic fail-open semantics).
+   */
+  strict?: boolean;
+}
 type PgIdentityOptions = {
   mode: "always" | "byDefault";
 } & PgSequenceOptions & {
@@ -1101,7 +1167,7 @@ interface PgRefOptions {
 /**
  * Type representation.
  */
-type PgAttr<T extends TSchema, TAttr extends PgSymbolKeys> = T & { [K in TAttr]: PgSymbols[K] };
+type PgAttr<T extends TSchema, TAttr extends PgSymbolKeys> = T & { [K in TAttr]: PgSymbols[K]; };
 //#endregion
 //#region ../../src/orm/core/schemas/databaseEnvSchema.d.ts
 /**
@@ -1117,46 +1183,43 @@ type PgAttr<T extends TSchema, TAttr extends PgSymbolKeys> = T & { [K in TAttr]:
  * - `d1://BINDING_NAME` — Cloudflare D1
  * - `hyperdrive://BINDING_NAME` — Cloudflare Hyperdrive
  */
-declare const databaseEnvSchema: import("typebox").TObject<{
-  DATABASE_URL: import("typebox").TOptional<import("typebox").TString>;
-  /**
-   * Enable or disable push-based schema synchronization (drizzle-kit push).
-   *
-   * Defaults to `true` in development and test, `false` in production.
-   * Set to `false` in development to skip automatic schema sync
-   * (e.g. when managing migrations manually).
-   */
-  DATABASE_SYNC: import("typebox").TOptional<import("typebox").TBoolean>;
-}>;
+declare const databaseEnvSchema: import("zod").ZodObject<{
+  DATABASE_URL: import("zod").ZodOptional<import("zod").ZodString>;
+  DATABASE_SYNC: import("zod").ZodOptional<import("zod").ZodBoolean>;
+}, import("zod/v4/core").$strip>;
 declare module "alepha" {
   interface Env extends Partial<Static<typeof databaseEnvSchema>> {}
-} //# sourceMappingURL=databaseEnvSchema.d.ts.map
+}
 //#endregion
 //#region ../../src/api/audits/schemas/auditResourceSchema.d.ts
 /**
  * Resource schema for audit log responses.
  */
-declare const auditResourceSchema: import("typebox").TObject<{
-  id: PgAttr<PgAttr<import("typebox").TString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
-  createdAt: PgAttr<PgAttr<import("typebox").TString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
-  organizationId: PgAttr<import("typebox").TString, typeof PG_ORGANIZATION>;
-  type: import("typebox").TString;
-  action: import("typebox").TString;
-  severity: PgAttr<import("typebox").TUnsafe<"info" | "warning" | "critical">, typeof PG_DEFAULT>;
-  userId: import("typebox").TOptional<import("typebox").TString>;
-  userRealm: import("typebox").TOptional<import("typebox").TString>;
-  userEmail: import("typebox").TOptional<import("typebox").TString>;
-  resourceType: import("typebox").TOptional<import("typebox").TString>;
-  resourceId: import("typebox").TOptional<import("typebox").TString>;
-  description: import("typebox").TOptional<import("typebox").TString>;
-  metadata: import("typebox").TOptional<import("typebox").TRecord<string, import("typebox").TAny>>;
-  ipAddress: import("typebox").TOptional<import("typebox").TString>;
-  userAgent: import("typebox").TOptional<import("typebox").TString>;
-  sessionId: import("typebox").TOptional<import("typebox").TString>;
-  requestId: import("typebox").TOptional<import("typebox").TString>;
-  success: PgAttr<import("typebox").TBoolean, typeof PG_DEFAULT>;
-  errorMessage: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const auditResourceSchema: import("zod").ZodObject<{
+  id: PgAttr<PgAttr<import("zod").ZodString, typeof PG_PRIMARY_KEY>, typeof PG_DEFAULT>;
+  createdAt: PgAttr<PgAttr<import("zod").ZodString, typeof PG_CREATED_AT>, typeof PG_DEFAULT>;
+  organizationId: PgAttr<import("zod").ZodOptional<import("zod").ZodString> | import("zod").ZodString, typeof PG_ORGANIZATION>;
+  type: import("zod").ZodString;
+  action: import("zod").ZodString;
+  severity: PgAttr<import("zod").ZodDefault<import("zod").ZodEnum<{
+    critical: "critical";
+    info: "info";
+    warning: "warning";
+  }>>, typeof PG_DEFAULT>;
+  userId: import("zod").ZodOptional<import("zod").ZodString>;
+  userRealm: import("zod").ZodOptional<import("zod").ZodString>;
+  userEmail: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+  resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+  description: import("zod").ZodOptional<import("zod").ZodString>;
+  metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+  ipAddress: import("zod").ZodOptional<import("zod").ZodString>;
+  userAgent: import("zod").ZodOptional<import("zod").ZodString>;
+  sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+  requestId: import("zod").ZodOptional<import("zod").ZodString>;
+  success: PgAttr<import("zod").ZodBoolean, typeof PG_DEFAULT>;
+  errorMessage: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type AuditResource = Static<typeof auditResourceSchema>;
 //#endregion
 //#region ../../src/api/audits/index.d.ts
@@ -1168,10 +1231,11 @@ type AuditResource = Static<typeof auditResourceSchema>;
  * - Audit event logging
  * - Filtering and searching
  * - User action tracking
+ * - Retention policy with a default + per-type TTL ({@link AuditParameters}, {@link AuditJobs})
  *
  * @module alepha.api.audits
  */
 declare const AlephaApiAudits: import("alepha").Service<import("alepha").Module>;
 //#endregion
-export { $audit, AdminAuditController, AlephaApiAudits, AuditEntity, AuditLogOptions, AuditPrimitive, AuditPrimitiveOptions, AuditQuery, AuditResource, AuditService, AuditSeverity, AuditStats, AuditTypeDefinition, CreateAudit, auditEntityInsertSchema, auditEntitySchema, auditQuerySchema, auditResourceSchema, auditSeveritySchema, audits, createAuditSchema };
+export { $audit, AdminAuditController, AlephaApiAudits, AuditEntity, AuditJobs, AuditLogOptions, AuditOptions, AuditParameters, AuditPrimitive, AuditPrimitiveOptions, AuditQuery, AuditResource, AuditService, AuditSeverity, AuditStats, AuditTypeDefinition, CreateAudit, auditEntityInsertSchema, auditEntitySchema, auditOptions, auditQuerySchema, auditResourceSchema, auditSeveritySchema, audits, createAuditSchema };
 //# sourceMappingURL=index.d.ts.map