import { z } from 'zod';

// src/security/permission.zod.ts
z.string().min(2, { message: "System identifier must be at least 2 characters" }).regex(/^[a-z][a-z0-9_.]*$/, {
  message: 'System identifier must be lowercase, starting with a letter, and may contain letters, numbers, underscores, or dots (e.g., "user_profile" or "order.created")'
}).describe("System identifier (lowercase with underscores or dots)");
var SnakeCaseIdentifierSchema = z.string().min(2, { message: "Identifier must be at least 2 characters" }).regex(/^[a-z][a-z0-9_]*$/, {
  message: 'Identifier must be lowercase snake_case, starting with a letter, and may contain only letters, numbers, and underscores (e.g., "user_profile")'
}).describe("Snake case identifier (lowercase with underscores only)");
z.string().min(3, { message: "Event name must be at least 3 characters" }).regex(/^[a-z][a-z0-9_.]*$/, {
  message: 'Event name must be lowercase with dots for namespacing (e.g., "user.created", "order.paid")'
}).describe("Event name (lowercase with dot notation for namespacing)");
var RLSOperation = z.enum(["select", "insert", "update", "delete", "all"]);
var RowLevelSecurityPolicySchema = z.object({
  /**
   * Unique identifier for this policy.
   * Must be unique within the object.
   * Use snake_case following ObjectStack naming conventions.
   * 
   * @example "tenant_isolation", "owner_access", "manager_team_view"
   */
  name: z.string().regex(/^[a-z_][a-z0-9_]*$/).describe("Policy unique identifier (snake_case)"),
  /**
   * Human-readable label for the policy.
   * Used in admin UI and logs.
   * 
   * @example "Multi-Tenant Data Isolation", "Owner-Based Access"
   */
  label: z.string().optional().describe("Human-readable policy label"),
  /**
   * Description explaining what this policy does and why.
   * Helps with governance and compliance.
   * 
   * @example "Ensures users can only access records from their own tenant organization"
   */
  description: z.string().optional().describe("Policy description and business justification"),
  /**
   * Target object (table) this policy applies to.
   * Must reference a valid ObjectStack object name.
   * 
   * @example "account", "opportunity", "contact", "custom_object"
   */
  object: z.string().describe("Target object name"),
  /**
   * Database operation(s) this policy applies to.
   * 
   * - **select**: Controls read access (SELECT queries)
   * - **insert**: Controls insert access (INSERT statements)
   * - **update**: Controls update access (UPDATE statements)
   * - **delete**: Controls delete access (DELETE statements)
   * - **all**: Applies to all operations
   * 
   * @example "select" - Most common, controls what users can view
   * @example "all" - Apply same rule to all operations
   */
  operation: RLSOperation.describe("Database operation this policy applies to"),
  /**
   * USING clause - Filter condition for SELECT/UPDATE/DELETE.
   * 
   * This is a SQL-like expression evaluated for each row.
   * Only rows where this expression returns TRUE are accessible.
   * 
   * **Note**: For INSERT-only policies, USING is not required (only CHECK is needed).
   * For SELECT/UPDATE/DELETE operations, USING is required.
   * 
   * **Security Note**: RLS conditions are executed at the database level with
   * parameterized queries. The implementation must use prepared statements
   * to prevent SQL injection. Never concatenate user input directly into
   * RLS conditions.
   * 
   * **SQL Dialect**: Compatible with PostgreSQL SQL syntax. Implementations
   * may adapt to other databases (MySQL, SQL Server, etc.) but should maintain
   * semantic equivalence.
   * 
   * Available context variables:
   * - `current_user.id` - Current user's ID
   * - `current_user.tenant_id` - Current user's tenant (maps to `tenantId` in RLSUserContext)
   * - `current_user.role` - Current user's role
   * - `current_user.department` - Current user's department
   * - `current_user.*` - Any custom user field
   * - `NOW()` - Current timestamp
   * - `CURRENT_DATE` - Current date
   * - `CURRENT_TIME` - Current time
   * 
   * **Context Variable Mapping**: The RLSUserContext schema uses camelCase (e.g., `tenantId`),
   * but expressions use snake_case with `current_user.` prefix (e.g., `current_user.tenant_id`).
   * Implementations must handle this mapping.
   * 
   * Supported operators:
   * - Comparison: =, !=, <, >, <=, >=, <> (not equal)
   * - Logical: AND, OR, NOT
   * - NULL checks: IS NULL, IS NOT NULL
   * - Set operations: IN, NOT IN
   * - String: LIKE, NOT LIKE, ILIKE (case-insensitive)
   * - Pattern matching: ~ (regex), !~ (not regex)
   * - Subqueries: (SELECT ...)
   * - Array operations: ANY, ALL
   * 
   * **Prohibited**: Dynamic SQL, DDL statements, DML statements (INSERT/UPDATE/DELETE)
   * 
   * @example "tenant_id = current_user.tenant_id"
   * @example "owner_id = current_user.id OR created_by = current_user.id"
   * @example "department IN (SELECT department FROM user_departments WHERE user_id = current_user.id)"
   * @example "status = 'active' AND expiry_date > NOW()"
   */
  using: z.string().optional().describe("Filter condition for SELECT/UPDATE/DELETE (PostgreSQL SQL WHERE clause syntax with parameterized context variables). Optional for INSERT-only policies."),
  /**
   * CHECK clause - Validation for INSERT/UPDATE operations.
   * 
   * Similar to USING but applies to new/modified rows.
   * Prevents users from creating/updating rows they wouldn't be able to see.
   * 
   * **Default Behavior**: If not specified, implementations should use the
   * USING clause as the CHECK clause. This ensures data integrity by preventing
   * users from creating records they cannot view.
   * 
   * Use cases:
   * - Prevent cross-tenant data creation
   * - Enforce mandatory field values
   * - Validate data integrity rules
   * - Restrict certain operations (e.g., only allow creating "draft" status)
   * 
   * @example "tenant_id = current_user.tenant_id"
   * @example "status IN ('draft', 'pending')" - Only allow certain statuses
   * @example "created_by = current_user.id" - Must be the creator
   */
  check: z.string().optional().describe("Validation condition for INSERT/UPDATE (defaults to USING clause if not specified - enforced at application level)"),
  /**
   * Restrict this policy to specific roles.
   * If specified, only users with these roles will have this policy applied.
   * If omitted, policy applies to all users (except those with bypassRLS permission).
   * 
   * Role names must match defined roles in the system.
   * 
   * @example ["sales_rep", "account_manager"]
   * @example ["employee"] - Apply to all employees
   * @example ["guest"] - Special restrictions for guests
   */
  roles: z.array(z.string()).optional().describe("Roles this policy applies to (omit for all roles)"),
  /**
   * Whether this policy is currently active.
   * Disabled policies are not evaluated.
   * Useful for temporary policy changes without deletion.
   * 
   * @default true
   */
  enabled: z.boolean().default(true).describe("Whether this policy is active"),
  /**
   * Policy priority for conflict resolution.
   * Higher numbers = higher priority.
   * When multiple policies apply, the most permissive wins (OR logic).
   * Priority is only used for ordering evaluation (performance).
   * 
   * @default 0
   */
  priority: z.number().int().default(0).describe("Policy evaluation priority (higher = evaluated first)"),
  /**
   * Tags for policy categorization and reporting.
   * Useful for governance, compliance, and auditing.
   * 
   * @example ["compliance", "gdpr", "pci"]
   * @example ["multi-tenant", "security"]
   */
  tags: z.array(z.string()).optional().describe("Policy categorization tags")
}).superRefine((data, ctx) => {
  if (!data.using && !data.check) {
    ctx.addIssue({
      code: z.ZodIssueCode.custom,
      message: 'At least one of "using" or "check" must be specified. For SELECT/UPDATE/DELETE operations, provide "using". For INSERT operations, provide "check".'
    });
  }
});
var RLSAuditEventSchema = z.object({
  /** ISO 8601 timestamp of the evaluation */
  timestamp: z.string().describe("ISO 8601 timestamp of the evaluation"),
  /** ID of the user whose access was evaluated */
  userId: z.string().describe("User ID whose access was evaluated"),
  /** Database operation being performed */
  operation: z.enum(["select", "insert", "update", "delete"]).describe("Database operation being performed"),
  /** Target object (table) name */
  object: z.string().describe("Target object name"),
  /** Name of the RLS policy evaluated */
  policyName: z.string().describe("Name of the RLS policy evaluated"),
  /** Whether access was granted */
  granted: z.boolean().describe("Whether access was granted"),
  /** Time taken to evaluate the policy in milliseconds */
  evaluationDurationMs: z.number().describe("Policy evaluation duration in milliseconds"),
  /** Which USING/CHECK clause matched */
  matchedCondition: z.string().optional().describe("Which USING/CHECK clause matched"),
  /** Number of rows affected by the operation */
  rowCount: z.number().optional().describe("Number of rows affected"),
  /** Additional metadata for the audit event */
  metadata: z.record(z.string(), z.unknown()).optional().describe("Additional audit event metadata")
});
var RLSAuditConfigSchema = z.object({
  /** Enable RLS audit logging */
  enabled: z.boolean().describe("Enable RLS audit logging"),
  /** Which evaluations to log */
  logLevel: z.enum(["all", "denied_only", "granted_only", "none"]).describe("Which evaluations to log"),
  /** Where to send audit logs */
  destination: z.enum(["system_log", "audit_trail", "external"]).describe("Audit log destination"),
  /** Sampling rate for high-traffic environments (0-1) */
  sampleRate: z.number().min(0).max(1).describe("Sampling rate (0-1) for high-traffic environments"),
  /** Number of days to retain audit logs */
  retentionDays: z.number().int().default(90).describe("Audit log retention period in days"),
  /** Whether to include row data in audit logs (security-sensitive) */
  includeRowData: z.boolean().default(false).describe("Include row data in audit logs (security-sensitive)"),
  /** Alert when access is denied */
  alertOnDenied: z.boolean().default(true).describe("Send alerts when access is denied")
});
var RLSConfigSchema = z.object({
  /**
   * Global RLS enable/disable flag.
   * When false, all RLS policies are ignored (use with caution!).
   * 
   * @default true
   */
  enabled: z.boolean().default(true).describe("Enable RLS enforcement globally"),
  /**
   * Default behavior when no policies match.
   * 
   * - **deny**: Deny access (secure default)
   * - **allow**: Allow access (permissive mode, not recommended)
   * 
   * @default "deny"
   */
  defaultPolicy: z.enum(["deny", "allow"]).default("deny").describe("Default action when no policies match"),
  /**
   * Whether to allow superusers to bypass RLS.
   * Superusers include system administrators and service accounts.
   * 
   * @default true
   */
  allowSuperuserBypass: z.boolean().default(true).describe("Allow superusers to bypass RLS"),
  /**
   * List of roles that can bypass RLS.
   * Users with these roles see all records regardless of policies.
   * 
   * @example ["system_admin", "data_auditor"]
   */
  bypassRoles: z.array(z.string()).optional().describe("Roles that bypass RLS (see all data)"),
  /**
   * Whether to log RLS policy evaluations.
   * Useful for debugging and auditing.
   * Can impact performance if enabled globally.
   * 
   * @default false
   */
  logEvaluations: z.boolean().default(false).describe("Log RLS policy evaluations for debugging"),
  /**
   * Cache RLS policy evaluation results.
   * Can improve performance for frequently accessed records.
   * Cache is invalidated when policies change or user context changes.
   * 
   * @default true
   */
  cacheResults: z.boolean().default(true).describe("Cache RLS evaluation results"),
  /**
   * Cache TTL in seconds.
   * How long to cache RLS evaluation results.
   * 
   * @default 300 (5 minutes)
   */
  cacheTtlSeconds: z.number().int().positive().default(300).describe("Cache TTL in seconds"),
  /**
   * Performance optimization: Pre-fetch user context.
   * Load user context once per request instead of per-query.
   * 
   * @default true
   */
  prefetchUserContext: z.boolean().default(true).describe("Pre-fetch user context for performance"),
  /**
   * Audit logging configuration for RLS evaluations.
   */
  audit: RLSAuditConfigSchema.optional().describe("RLS audit logging configuration")
});
var RLSUserContextSchema = z.object({
  /**
   * User ID
   */
  id: z.string().describe("User ID"),
  /**
   * User email
   */
  email: z.string().email().optional().describe("User email"),
  /**
   * Tenant/Organization ID
   */
  tenantId: z.string().optional().describe("Tenant/Organization ID"),
  /**
   * User role(s)
   */
  role: z.union([
    z.string(),
    z.array(z.string())
  ]).optional().describe("User role(s)"),
  /**
   * User department
   */
  department: z.string().optional().describe("User department"),
  /**
   * Additional custom attributes
   * Can include any custom user fields for RLS evaluation
   */
  attributes: z.record(z.string(), z.unknown()).optional().describe("Additional custom user attributes")
});
var RLSEvaluationResultSchema = z.object({
  /**
   * Policy name that was evaluated
   */
  policyName: z.string().describe("Policy name"),
  /**
   * Whether access was granted
   */
  granted: z.boolean().describe("Whether access was granted"),
  /**
   * Evaluation duration in milliseconds
   */
  durationMs: z.number().optional().describe("Evaluation duration in milliseconds"),
  /**
   * Error message if evaluation failed
   */
  error: z.string().optional().describe("Error message if evaluation failed"),
  /**
   * Evaluated USING clause result
   */
  usingResult: z.boolean().optional().describe("USING clause evaluation result"),
  /**
   * Evaluated CHECK clause result (for INSERT/UPDATE)
   */
  checkResult: z.boolean().optional().describe("CHECK clause evaluation result")
});
var RLS = {
  /**
   * Create a simple owner-based policy
   */
  ownerPolicy: (object, ownerField = "owner_id") => ({
    name: `${object}_owner_access`,
    label: `Owner Access for ${object}`,
    object,
    operation: "all",
    using: `${ownerField} = current_user.id`,
    enabled: true,
    priority: 0
  }),
  /**
   * Create a tenant isolation policy
   */
  tenantPolicy: (object, tenantField = "tenant_id") => ({
    name: `${object}_tenant_isolation`,
    label: `Tenant Isolation for ${object}`,
    object,
    operation: "all",
    using: `${tenantField} = current_user.tenant_id`,
    check: `${tenantField} = current_user.tenant_id`,
    enabled: true,
    priority: 0
  }),
  /**
   * Create a role-based policy
   */
  rolePolicy: (object, roles, condition) => ({
    name: `${object}_${roles.join("_")}_access`,
    label: `${roles.join(", ")} Access for ${object}`,
    object,
    operation: "select",
    using: condition,
    roles,
    enabled: true,
    priority: 0
  }),
  /**
   * Create a permissive policy (allow all for specific roles)
   */
  allowAllPolicy: (object, roles) => ({
    name: `${object}_${roles.join("_")}_full_access`,
    label: `Full Access for ${roles.join(", ")}`,
    object,
    operation: "all",
    using: "1 = 1",
    // Always true
    roles,
    enabled: true,
    priority: 0
  })
};

// src/security/permission.zod.ts
var ObjectPermissionSchema = z.object({
  /** C: Create */
  allowCreate: z.boolean().default(false).describe("Create permission"),
  /** R: Read (Owned records or Shared records) */
  allowRead: z.boolean().default(false).describe("Read permission"),
  /** U: Edit (Owned records or Shared records) */
  allowEdit: z.boolean().default(false).describe("Edit permission"),
  /** D: Delete (Owned records or Shared records) */
  allowDelete: z.boolean().default(false).describe("Delete permission"),
  /** Lifecycle Operations */
  allowTransfer: z.boolean().default(false).describe("Change record ownership"),
  allowRestore: z.boolean().default(false).describe("Restore from trash (Undelete)"),
  allowPurge: z.boolean().default(false).describe("Permanently delete (Hard Delete/GDPR)"),
  /** 
   * View All Records: Super-user read access. 
   * Bypasses Sharing Rules and Ownership checks.
   * Equivalent to Microsoft Dataverse "Organization" level read access.
   */
  viewAllRecords: z.boolean().default(false).describe("View All Data (Bypass Sharing)"),
  /** 
   * Modify All Records: Super-user write access. 
   * Bypasses Sharing Rules and Ownership checks.
   * Equivalent to Microsoft Dataverse "Organization" level write access.
   */
  modifyAllRecords: z.boolean().default(false).describe("Modify All Data (Bypass Sharing)")
});
var FieldPermissionSchema = z.object({
  /** Can see this field */
  readable: z.boolean().default(true).describe("Field read access"),
  /** Can edit this field */
  editable: z.boolean().default(false).describe("Field edit access")
});
var PermissionSetSchema = z.object({
  /** Unique permission set name */
  name: SnakeCaseIdentifierSchema.describe("Permission set unique name (lowercase snake_case)"),
  /** Display label */
  label: z.string().optional().describe("Display label"),
  /** Is this a Profile? (Base set for a user) */
  isProfile: z.boolean().default(false).describe("Whether this is a user profile"),
  /** Object Permissions Map: <entity_name> -> permissions */
  objects: z.record(z.string(), ObjectPermissionSchema).describe("Entity permissions"),
  /** Field Permissions Map: <entity_name>.<field_name> -> permissions */
  fields: z.record(z.string(), FieldPermissionSchema).optional().describe("Field level security"),
  /** System permissions (e.g., "manage_users") */
  systemPermissions: z.array(z.string()).optional().describe("System level capabilities"),
  /**
   * Tab/App Visibility Permissions (Salesforce Pattern)
   * Controls which app tabs are visible, hidden, or set as default for this permission set.
   * 
   * @example
   * ```typescript
   * tabPermissions: {
   *   'app_crm': 'visible',
   *   'app_admin': 'hidden',
   *   'app_sales': 'default_on'
   * }
   * ```
   */
  tabPermissions: z.record(z.string(), z.enum(["visible", "hidden", "default_on", "default_off"])).optional().describe("App/tab visibility: visible, hidden, default_on (shown by default), default_off (available but hidden initially)"),
  /** 
   * Row-Level Security Rules
   * 
   * Row-level security policies that filter records based on user context.
   * These rules are applied in addition to object-level permissions.
   * 
   * Uses the canonical RLS protocol from rls.zod.ts for comprehensive
   * row-level security features including PostgreSQL-style USING and CHECK clauses.
   * 
   * @see {@link RowLevelSecurityPolicySchema} for full RLS specification
   * @see {@link file://./rls.zod.ts} for comprehensive RLS documentation
   * 
   * @example Multi-tenant isolation
   * ```typescript
   * rls: [{
   *   name: 'tenant_filter',
   *   object: 'account',
   *   operation: 'select',
   *   using: 'tenant_id = current_user.tenant_id'
   * }]
   * ```
   */
  rowLevelSecurity: z.array(RowLevelSecurityPolicySchema).optional().describe("Row-level security policies (see rls.zod.ts for full spec)"),
  /**
   * Context-Based Access Control Variables
   * 
   * Custom context variables that can be referenced in RLS rules.
   * These variables are evaluated at runtime based on the user's session.
   * 
   * Common context variables:
   * - `current_user.id` - Current user ID
   * - `current_user.tenant_id` - User's tenant/organization ID
   * - `current_user.department` - User's department
   * - `current_user.role` - User's role
   * - `current_user.region` - User's geographic region
   * 
   * @example Custom context
   * ```typescript
   * contextVariables: {
   *   allowed_regions: ['US', 'EU'],
   *   access_level: 2,
   *   custom_attribute: 'value'
   * }
   * ```
   */
  contextVariables: z.record(z.string(), z.unknown()).optional().describe("Context variables for RLS evaluation")
});
var OWDModel = z.enum([
  "private",
  // Only owner can see
  "public_read",
  // Everyone can see, owner can edit
  "public_read_write",
  // Everyone can see and edit
  "controlled_by_parent"
  // Access derived from parent record (Master-Detail)
]);
var SharingRuleType = z.enum([
  "owner",
  // Based on record ownership (Role Hierarchy)
  "criteria"
  // Based on field values (e.g. Status = 'Open')
]);
var SharingLevel = z.enum([
  "read",
  // Read Only
  "edit",
  // Read / Write
  "full"
  // Full Access (Transfer, Share, Delete)
]);
var ShareRecipientType = z.enum([
  "user",
  "group",
  "role",
  "role_and_subordinates",
  "guest"
  // for public sharing
]);
var BaseSharingRuleSchema = z.object({
  // Identification
  name: z.string().regex(/^[a-z_][a-z0-9_]*$/).describe("Unique rule name (snake_case)"),
  label: z.string().optional().describe("Human-readable label"),
  description: z.string().optional().describe("Administrative notes"),
  // Scope
  object: z.string().describe("Target Object Name"),
  active: z.boolean().default(true),
  // Access
  accessLevel: SharingLevel.default("read"),
  // Recipient (Whom to share with)
  sharedWith: z.object({
    type: ShareRecipientType,
    value: z.string().describe("ID or Code of the User/Group/Role")
  }).describe("The recipient of the shared access")
});
var CriteriaSharingRuleSchema = BaseSharingRuleSchema.extend({
  type: z.literal("criteria"),
  condition: z.string().describe(`Formula condition (e.g. "department = 'Sales'")`)
});
var OwnerSharingRuleSchema = BaseSharingRuleSchema.extend({
  type: z.literal("owner"),
  ownedBy: z.object({
    type: ShareRecipientType,
    value: z.string()
  }).describe("Source group/role whose records are being shared")
});
var SharingRuleSchema = z.discriminatedUnion("type", [
  CriteriaSharingRuleSchema,
  OwnerSharingRuleSchema
]);
var TerritoryType = z.enum([
  "geography",
  // Region/Country/City
  "industry",
  // Vertical
  "named_account",
  // Key Accounts
  "product_line"
  // Product Specialty
]);
var TerritoryModelSchema = z.object({
  name: z.string().describe("Model Name (e.g. FY24 Planning)"),
  state: z.enum(["planning", "active", "archived"]).default("planning"),
  startDate: z.string().optional(),
  endDate: z.string().optional()
});
var TerritorySchema = z.object({
  /** Identity */
  name: SnakeCaseIdentifierSchema.describe("Territory unique name (lowercase snake_case)"),
  label: z.string().describe('Territory Label (e.g. "West Coast")'),
  /** Structure */
  modelId: z.string().describe("Belongs to which Territory Model"),
  parent: z.string().optional().describe("Parent Territory"),
  type: TerritoryType.default("geography"),
  /** 
   * Assignment Rules (The "Magic")
   * How do accounts automatically fall into this territory?
   * e.g. "BillingCountry = 'US' AND BillingState = 'CA'"
   */
  assignmentRule: z.string().optional().describe("Criteria based assignment rule"),
  /**
   * User Assignment
   * Users assigned to work this territory.
   */
  assignedUsers: z.array(z.string()).optional(),
  /** Access Level */
  accountAccess: z.enum(["read", "edit"]).default("read"),
  opportunityAccess: z.enum(["read", "edit"]).default("read"),
  caseAccess: z.enum(["read", "edit"]).default("read")
});
var PasswordPolicySchema = z.object({
  minLength: z.number().default(8),
  requireUppercase: z.boolean().default(true),
  requireLowercase: z.boolean().default(true),
  requireNumbers: z.boolean().default(true),
  requireSymbols: z.boolean().default(false),
  expirationDays: z.number().optional().describe("Force password change every X days"),
  historyCount: z.number().default(3).describe("Prevent reusing last X passwords")
});
var NetworkPolicySchema = z.object({
  trustedRanges: z.array(z.string()).describe("CIDR ranges allowed to access (e.g. 10.0.0.0/8)"),
  blockUnknown: z.boolean().default(false).describe("Block all IPs not in trusted ranges"),
  vpnRequired: z.boolean().default(false)
});
var SessionPolicySchema = z.object({
  idleTimeout: z.number().default(30).describe("Minutes before idle session logout"),
  absoluteTimeout: z.number().default(480).describe("Max session duration (minutes)"),
  forceMfa: z.boolean().default(false).describe("Require 2FA for all users")
});
var AuditPolicySchema = z.object({
  logRetentionDays: z.number().default(180),
  sensitiveFields: z.array(z.string()).describe("Fields to redact in logs (e.g. password, ssn)"),
  captureRead: z.boolean().default(false).describe("Log read access (High volume!)")
});
var PolicySchema = z.object({
  name: z.string().regex(/^[a-z_][a-z0-9_]*$/).describe("Policy Name"),
  password: PasswordPolicySchema.optional(),
  network: NetworkPolicySchema.optional(),
  session: SessionPolicySchema.optional(),
  audit: AuditPolicySchema.optional(),
  /** Assignment */
  isDefault: z.boolean().default(false).describe("Apply to all users by default"),
  assignedProfiles: z.array(z.string()).optional().describe("Apply to specific profiles")
});

export { AuditPolicySchema, CriteriaSharingRuleSchema, FieldPermissionSchema, NetworkPolicySchema, OWDModel, ObjectPermissionSchema, OwnerSharingRuleSchema, PasswordPolicySchema, PermissionSetSchema, PolicySchema, RLS, RLSAuditConfigSchema, RLSAuditEventSchema, RLSConfigSchema, RLSEvaluationResultSchema, RLSOperation, RLSUserContextSchema, RowLevelSecurityPolicySchema, SessionPolicySchema, ShareRecipientType, SharingLevel, SharingRuleSchema, SharingRuleType, TerritoryModelSchema, TerritorySchema, TerritoryType };
//# sourceMappingURL=index.mjs.map
//# sourceMappingURL=index.mjs.map