Platform schema reference

AnalyticsMetricType = z.enum([
  'requests',
  'storage',
  'compute',
  'vector_searches',
  'graph_queries',
  'hrm_inferences',
  'api_keys',
  'users',
  'tenants',
  'organizations',
  'billing',
  'errors',
])

export type AnalyticsMetricType = z.infer<typeof AnalyticsMetricType>

AnalyticsTimePeriod = z.enum([
  '1h',
  '24h',
  '7d',
  '30d',
  '90d',
  '1y',
])

export type AnalyticsTimePeriod = z.infer<typeof AnalyticsTimePeriod>

AnalyticsAggregationType = z.enum([
  'sum',
  'avg',
  'min',
  'max',
  'count',
  'p95',
  'p99',
])

export type AnalyticsAggregationType = z.infer<typeof AnalyticsAggregationType>

AnalyticsDataPoint = z.object({
  timestamp: z.string().datetime(),
  value: z.number(),
  metadata: z.record(z.unknown()).optional(),
})

export type AnalyticsDataPoint = z.infer<typeof AnalyticsDataPoint>

AnalyticsMetric = z.object({
  name: z.string(),
  type: AnalyticsMetricType,
  aggregation: AnalyticsAggregationType,
  data_points: z.array(AnalyticsDataPoint),
  total: z.number().optional(),
  average: z.number().optional(),
  min: z.number().optional(),
  max: z.number().optional(),
})

export type AnalyticsMetric = z.infer<typeof AnalyticsMetric>

AnalyticsQuery = z.object({
  tenant_id: z.string().optional(),
  organization_id: z.string().optional(),
  metric_types: z.array(AnalyticsMetricType).optional(),
  period: AnalyticsTimePeriod.optional().default('24h'),
  aggregation: AnalyticsAggregationType.optional().default('sum'),
  start_date: z.string().datetime().optional(),
  end_date: z.string().datetime().optional(),
  group_by: z.array(z.string()).optional(),
  limit: z.coerce.number().int().min(1).max(1000).default(100),
})

export type AnalyticsQuery = z.infer<typeof AnalyticsQuery>

AnalyticsResponse = z.object({
  metrics: z.array(AnalyticsMetric),
  period: z.object({
    start: z.string().datetime(),
    end: z.string().datetime(),
  }),
  total_points: z.number().int(),
})

export type AnalyticsResponse = z.infer<typeof AnalyticsResponse>

AnalyticsDashboard = z.object({
  id: z.string(),
  name: z.string(),
  description: z.string().optional(),
  user_id: z.string().optional(),
  organization_id: z.string().optional(),
  widgets: z.array(z.object({
    id: z.string(),
    type: z.string(),
    title: z.string(),
    metric_type: AnalyticsMetricType,
    aggregation: AnalyticsAggregationType,
    period: AnalyticsTimePeriod,
    position: z.object({
      x: z.number().int(),
      y: z.number().int(),
      width: z.number().int(),
      height: z.number().int(),
    }),
    config: z.record(z.unknown()).optional(),
  })),
  created_at: z.string().datetime(),
  updated_at: z.string().datetime(),
})

export type AnalyticsDashboard = z.infer<typeof AnalyticsDashboard>

CreateAnalyticsDashboardRequest = z.object({
  name: z.string().min(1).max(100),
  description: z.string().max(500).optional(),
  organization_id: z.string().optional(),
  widgets: z.array(z.object({
    type: z.string(),
    title: z.string(),
    metric_type: AnalyticsMetricType,
    aggregation: AnalyticsAggregationType,
    period: AnalyticsTimePeriod,
    position: z.object({
      x: z.number().int(),
      y: z.number().int(),
      width: z.number().int(),
      height: z.number().int(),
    }),
    config: z.record(z.unknown()).optional(),
  })).optional(),
})

export type CreateAnalyticsDashboardRequest = z.infer<typeof CreateAnalyticsDashboardRequest>

UpdateAnalyticsDashboardRequest = z.object({
  name: z.string().min(1).max(100).optional(),
  description: z.string().max(500).optional(),
  widgets: z.array(z.object({
    id: z.string().optional(),
    type: z.string(),
    title: z.string(),
    metric_type: AnalyticsMetricType,
    aggregation: AnalyticsAggregationType,
    period: AnalyticsTimePeriod,
    position: z.object({
      x: z.number().int(),
      y: z.number().int(),
      width: z.number().int(),
      height: z.number().int(),
    }),
    config: z.record(z.unknown()).optional(),
  })).optional(),
})

export type UpdateAnalyticsDashboardRequest = z.infer<typeof UpdateAnalyticsDashboardRequest>

ListAnalyticsDashboardsResponse = z.object({
  dashboards: z.array(AnalyticsDashboard),
})

export type ListAnalyticsDashboardsResponse = z.infer<typeof ListAnalyticsDashboardsResponse>

AnalyticsReport = z.object({
  id: z.string(),
  name: z.string(),
  description: z.string().optional(),
  user_id: z.string().optional(),
  organization_id: z.string().optional(),
  metric_types: z.array(AnalyticsMetricType),
  period: AnalyticsTimePeriod,
  aggregation: AnalyticsAggregationType,
  schedule: z.object({
    frequency: z.enum(['daily', 'weekly', 'monthly']),
    time: z.string(), // HH:MM format
    timezone: z.string(),
  }).optional(),
  recipients: z.array(z.string().email()),
  format: z.enum(['pdf', 'csv', 'json']),
  enabled: z.boolean(),
  last_generated: z.string().datetime().nullable(),
  next_generation: z.string().datetime().nullable(),
  created_at: z.string().datetime(),
  updated_at: z.string().datetime(),
})

export type AnalyticsReport = z.infer<typeof AnalyticsReport>

CreateAnalyticsReportRequest = z.object({
  name: z.string().min(1).max(100),
  description: z.string().max(500).optional(),
  organization_id: z.string().optional(),
  metric_types: z.array(AnalyticsMetricType).min(1),
  period: AnalyticsTimePeriod,
  aggregation: AnalyticsAggregationType.optional().default('sum'),
  schedule: z.object({
    frequency: z.enum(['daily', 'weekly', 'monthly']),
    time: z.string(),
    timezone: z.string(),
  }).optional(),
  recipients: z.array(z.string().email()).min(1),
  format: z.enum(['pdf', 'csv', 'json']).optional().default('pdf'),
})

export type CreateAnalyticsReportRequest = z.infer<typeof CreateAnalyticsReportRequest>

UpdateAnalyticsReportRequest = z.object({
  name: z.string().min(1).max(100).optional(),
  description: z.string().max(500).optional(),
  metric_types: z.array(AnalyticsMetricType).optional(),
  period: AnalyticsTimePeriod.optional(),
  aggregation: AnalyticsAggregationType.optional(),
  schedule: z.object({
    frequency: z.enum(['daily', 'weekly', 'monthly']),
    time: z.string(),
    timezone: z.string(),
  }).optional(),
  recipients: z.array(z.string().email()).optional(),
  format: z.enum(['pdf', 'csv', 'json']).optional(),
  enabled: z.boolean().optional(),
})

export type UpdateAnalyticsReportRequest = z.infer<typeof UpdateAnalyticsReportRequest>

ListAnalyticsReportsResponse = z.object({
  reports: z.array(AnalyticsReport),
})

export type ListAnalyticsReportsResponse = z.infer<typeof ListAnalyticsReportsResponse>

AnalyticsExportRequest = z.object({
  metric_types: z.array(AnalyticsMetricType).min(1),
  period: AnalyticsTimePeriod,
  aggregation: AnalyticsAggregationType.optional().default('sum'),
  start_date: z.string().datetime().optional(),
  end_date: z.string().datetime().optional(),
  format: z.enum(['csv', 'json', 'xlsx']),
  tenant_id: z.string().optional(),
  organization_id: z.string().optional(),
})

export type AnalyticsExportRequest = z.infer<typeof AnalyticsExportRequest>

AnalyticsExportResponse = z.object({
  export_id: z.string(),
  format: z.enum(['csv', 'json', 'xlsx']),
  status: z.enum(['processing', 'completed', 'failed']),
  download_url: z.string().url().optional(),
  expires_at: z.string().datetime().optional(),
  created_at: z.string().datetime(),
})

export type AnalyticsExportResponse = z.infer<typeof AnalyticsExportResponse>

AnalyticsSummary = z.object({
  total_requests: z.number().int(),
  total_storage_gb: z.number(),
  total_compute_hours: z.number(),
  total_vector_searches: z.number().int(),
  total_graph_queries: z.number().int(),
  total_hrm_inferences: z.number().int(),
  active_users: z.number().int(),
  active_tenants: z.number().int(),
  active_organizations: z.number().int(),
  period_start: z.string().datetime(),
  period_end: z.string().datetime(),
})

export type AnalyticsSummary = z.infer<typeof AnalyticsSummary>

GetAnalyticsSummaryResponse = z.object({
  summary: AnalyticsSummary,
  period: z.object({
    start: z.string().datetime(),
    end: z.string().datetime(),
  }),
})

export type GetAnalyticsSummaryResponse = z.infer<typeof GetAnalyticsSummaryResponse>

AnalyticsAlert = z.object({
  id: z.string(),
  name: z.string(),
  metric_type: AnalyticsMetricType,
  threshold: z.number(),
  operator: z.enum(['gt', 'gte', 'lt', 'lte', 'eq', 'neq']),
  period: AnalyticsTimePeriod,
  aggregation: AnalyticsAggregationType,
  tenant_id: z.string().optional(),
  organization_id: z.string().optional(),
  enabled: z.boolean(),
  last_triggered: z.string().datetime().nullable(),
  trigger_count: z.number().int(),
  created_at: z.string().datetime(),
  updated_at: z.string().datetime(),
})

export type AnalyticsAlert = z.infer<typeof AnalyticsAlert>

CreateAnalyticsAlertRequest = z.object({
  name: z.string().min(1).max(100),
  metric_type: AnalyticsMetricType,
  threshold: z.number(),
  operator: z.enum(['gt', 'gte', 'lt', 'lte', 'eq', 'neq']),
  period: AnalyticsTimePeriod,
  aggregation: AnalyticsAggregationType.optional().default('sum'),
  tenant_id: z.string().optional(),
  organization_id: z.string().optional(),
})

export type CreateAnalyticsAlertRequest = z.infer<typeof CreateAnalyticsAlertRequest>

UpdateAnalyticsAlertRequest = z.object({
  name: z.string().min(1).max(100).optional(),
  threshold: z.number().optional(),
  operator: z.enum(['gt', 'gte', 'lt', 'lte', 'eq', 'neq']).optional(),
  period: AnalyticsTimePeriod.optional(),
  aggregation: AnalyticsAggregationType.optional(),
  enabled: z.boolean().optional(),
})

export type UpdateAnalyticsAlertRequest = z.infer<typeof UpdateAnalyticsAlertRequest>

ListAnalyticsAlertsResponse = z.object({
  alerts: z.array(AnalyticsAlert),
})

export type ListAnalyticsAlertsResponse = z.infer<typeof ListAnalyticsAlertsResponse>

ApiKey = z.object({
  id: z.string(),
  tenant_id: z.string(),
  name: z.string(),
  description: z.string().optional(),
  key_hash: z.string(), // SHA-256 hash of the actual key
  permissions: z.array(z.string()), // Permission strings
  enabled: z.boolean(),
  expires_at: z.string().datetime().nullable(),
  last_used_at: z.string().datetime().nullable(),
  usage_count: z.number().int(),
  created_at: z.string().datetime(),
  updated_at: z.string().datetime(),
})

export type ApiKey = z.infer<typeof ApiKey>

CreateApiKeyRequest = z.object({
  name: z.string().min(1).max(100),
  description: z.string().max(500).optional(),
  permissions: z.array(z.string()).optional(),
  expires_at: z.string().datetime().optional(),
})

export type CreateApiKeyRequest = z.infer<typeof CreateApiKeyRequest>

CreateApiKeyResponse = z.object({
  api_key_id: z.string(),
  key: z.string(), // Only returned on creation
  name: z.string(),
  permissions: z.array(z.string()),
  expires_at: z.string().datetime().nullable(),
  created_at: z.string().datetime(),
})

export type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponse>

UpdateApiKeyRequest = z.object({
  name: z.string().min(1).max(100).optional(),
  description: z.string().max(500).optional(),
  permissions: z.array(z.string()).optional(),
  enabled: z.boolean().optional(),
})

export type UpdateApiKeyRequest = z.infer<typeof UpdateApiKeyRequest>

ListApiKeysResponse = z.object({
  api_keys: z.array(
    ApiKey.omit({
      key_hash: true, // Never expose the hash
    }),
  ),
})

export type ListApiKeysResponse = z.infer<typeof ListApiKeysResponse>

ApiKeyUsage = z.object({
  api_key_id: z.string(),
  requests_total: z.number().int(),
  requests_last_24h: z.number().int(),
  last_used_at: z.string().datetime().nullable(),
  top_endpoints: z.array(
    z.object({
      endpoint: z.string(),
      count: z.number().int(),
    }),
  ),
})

export type ApiKeyUsage = z.infer<typeof ApiKeyUsage>

GetApiKeyUsageResponse = z.object({
  usage: ApiKeyUsage,
  period: z.object({
    start: z.string().datetime(),
    end: z.string().datetime(),
  }),
})

export type GetApiKeyUsageResponse = z.infer<typeof GetApiKeyUsageResponse>

ApiKeyPermission = z.object({
  name: z.string(),
  description: z.string(),
  category: z.string(),
  required_for: z.array(z.string()).optional(),
})

export type ApiKeyPermission = z.infer<typeof ApiKeyPermission>

ListApiKeyPermissionsResponse = z.object({
  permissions: z.array(ApiKeyPermission),
})

export type ListApiKeyPermissionsResponse = z.infer<typeof ListApiKeyPermissionsResponse>

ApiKeyRateLimit = z.object({
  requests_per_minute: z.number().int().min(1),
  burst: z.number().int().min(1).optional(),
})

export type ApiKeyRateLimit = z.infer<typeof ApiKeyRateLimit>

SetApiKeyRateLimitRequest = z.object({
  rate_limit: ApiKeyRateLimit,
})

export type SetApiKeyRateLimitRequest = z.infer<typeof SetApiKeyRateLimitRequest>

ApiKeyValidation = z.object({
  valid: z.boolean(),
  api_key_id: z.string().optional(),
  tenant_id: z.string().optional(),
  permissions: z.array(z.string()).optional(),
  rate_limit: ApiKeyRateLimit.optional(),
  error: z.string().optional(),
})

export type ApiKeyValidation = z.infer<typeof ApiKeyValidation>

ApiKeyAuditLog = z.object({
  id: z.string(),
  api_key_id: z.string(),
  action: z.enum(['created', 'updated', 'deleted', 'enabled', 'disabled', 'used']),
  user_id: z.string().optional(),
  ip_address: z.string().optional(),
  user_agent: z.string().optional(),
  metadata: z.record(z.unknown()).optional(),
  created_at: z.string().datetime(),
})

export type ApiKeyAuditLog = z.infer<typeof ApiKeyAuditLog>

ListApiKeyAuditLogsQuery = z.object({
  limit: z.coerce.number().int().min(1).max(100).default(20),
  offset: z.coerce.number().int().min(0).default(0),
  action: z.enum(['created', 'updated', 'deleted', 'enabled', 'disabled', 'used']).optional(),
})

export type ListApiKeyAuditLogsQuery = z.infer<typeof ListApiKeyAuditLogsQuery>

ListApiKeyAuditLogsResponse = z.object({
  audit_logs: z.array(ApiKeyAuditLog),
  pagination: z.object({
    total: z.number().int(),
    limit: z.number().int(),
    offset: z.number().int(),
  }),
})

export type ListApiKeyAuditLogsResponse = z.infer<typeof ListApiKeyAuditLogsResponse>

AuditAction = z.enum([
  'create',
  'read',
  'update',
  'delete',
  'login',
  'logout',
  'permission_granted',
  'permission_revoked',
  'api_key_created',
  'api_key_revoked',
  'backup_created',
  'backup_restored',
  'tenant_provisioned',
  'tenant_suspended',
  'tenant_deleted',
  'subscription_created',
  'subscription_canceled',
  'payment_processed',
  'webhook_triggered',
  'export_data',
  'import_data',
])

export type AuditAction = z.infer<typeof AuditAction>

AuditResourceType = z.enum([
  'tenant',
  'organization',
  'user',
  'api_key',
  'backup',
  'subscription',
  'invoice',
  'webhook',
  'service',
  'bundle',
  'usage_record',
  'payment_method',
])

export type AuditResourceType = z.infer<typeof AuditResourceType>

AuditLog = z.object({
  id: z.string(),
  user_id: z.string().optional(),
  session_id: z.string().optional(),
  api_key_id: z.string().optional(),
  action: AuditAction,
  resource_type: AuditResourceType.optional(),
  resource_id: z.string().optional(),
  tenant_id: z.string().optional(),
  organization_id: z.string().optional(),
  ip_address: z.string().optional(),
  user_agent: z.string().optional(),
  request_id: z.string().optional(),
  status_code: z.number().int().optional(),
  message: z.string().optional(),
  metadata: z.record(z.unknown()).optional(),
  created_at: z.string().datetime(),
})

export type AuditLog = z.infer<typeof AuditLog>

ListAuditLogsQuery = z.object({
  limit: z.coerce.number().int().min(1).max(1000).default(100),
  offset: z.coerce.number().int().min(0).default(0),
  user_id: z.string().optional(),
  action: AuditAction.optional(),
  resource_type: AuditResourceType.optional(),
  resource_id: z.string().optional(),
  tenant_id: z.string().optional(),
  organization_id: z.string().optional(),
  start_date: z.string().datetime().optional(),
  end_date: z.string().datetime().optional(),
  ip_address: z.string().optional(),
  status_code: z.number().int().optional(),
})

export type ListAuditLogsQuery = z.infer<typeof ListAuditLogsQuery>

ListAuditLogsResponse = z.object({
  audit_logs: z.array(AuditLog),
  pagination: z.object({
    total: z.number().int(),
    limit: z.number().int(),
    offset: z.number().int(),
  }),
})

export type ListAuditLogsResponse = z.infer<typeof ListAuditLogsResponse>

AuditLogSummary = z.object({
  total_actions: z.number().int(),
  unique_users: z.number().int(),
  unique_tenants: z.number().int(),
  unique_organizations: z.number().int(),
  action_breakdown: z.record(z.number().int()),
  resource_type_breakdown: z.record(z.number().int()),
  period_start: z.string().datetime(),
  period_end: z.string().datetime(),
})

export type AuditLogSummary = z.infer<typeof AuditLogSummary>

GetAuditLogSummaryResponse = z.object({
  summary: AuditLogSummary,
  period: z.object({
    start: z.string().datetime(),
    end: z.string().datetime(),
  }),
})

export type GetAuditLogSummaryResponse = z.infer<typeof GetAuditLogSummaryResponse>

AuditLogExportRequest = z.object({
  format: z.enum(['json', 'csv', 'xlsx']),
  start_date: z.string().datetime(),
  end_date: z.string().datetime(),
  filters: z.object({
    user_id: z.string().optional(),
    action: AuditAction.optional(),
    resource_type: AuditResourceType.optional(),
    tenant_id: z.string().optional(),
    organization_id: z.string().optional(),
  }).optional(),
})

export type AuditLogExportRequest = z.infer<typeof AuditLogExportRequest>

AuditLogExportResponse = z.object({
  export_id: z.string(),
  format: z.enum(['json', 'csv', 'xlsx']),
  status: z.enum(['processing', 'completed', 'failed']),
  download_url: z.string().url().optional(),
  expires_at: z.string().datetime().optional(),
  created_at: z.string().datetime(),
})

export type AuditLogExportResponse = z.infer<typeof AuditLogExportResponse>

AuditLogRetentionPolicy = z.object({
  id: z.string(),
  organization_id: z.string().optional(),
  retention_days: z.number().int().min(1).max(2555), // Max 7 years
  archive_after_days: z.number().int().min(1).optional(),
  enabled: z.boolean(),
  created_at: z.string().datetime(),
  updated_at: z.string().datetime(),
})

export type AuditLogRetentionPolicy = z.infer<typeof AuditLogRetentionPolicy>

CreateAuditLogRetentionPolicyRequest = z.object({
  organization_id: z.string().optional(),
  retention_days: z.number().int().min(1).max(2555),
  archive_after_days: z.number().int().min(1).optional(),
})

export type CreateAuditLogRetentionPolicyRequest = z.infer<typeof CreateAuditLogRetentionPolicyRequest>

UpdateAuditLogRetentionPolicyRequest = z.object({
  retention_days: z.number().int().min(1).max(2555).optional(),
  archive_after_days: z.number().int().min(1).optional(),
  enabled: z.boolean().optional(),
})

export type UpdateAuditLogRetentionPolicyRequest = z.infer<typeof UpdateAuditLogRetentionPolicyRequest>

ListAuditLogRetentionPoliciesResponse = z.object({
  policies: z.array(AuditLogRetentionPolicy),
})

export type ListAuditLogRetentionPoliciesResponse = z.infer<typeof ListAuditLogRetentionPoliciesResponse>

AuditLogComplianceReport = z.object({
  report_id: z.string(),
  organization_id: z.string().optional(),
  report_type: z.enum(['sox', 'pci', 'gdpr', 'hipaa', 'custom']),
  period_start: z.string().datetime(),
  period_end: z.string().datetime(),
  total_events: z.number().int(),
  compliance_score: z.number().min(0).max(100),
  violations: z.array(z.object({
    type: z.string(),
    count: z.number().int(),
    severity: z.enum(['low', 'medium', 'high', 'critical']),
  })),
  recommendations: z.array(z.string()),
  generated_at: z.string().datetime(),
  generated_by: z.string(),
})

export type AuditLogComplianceReport = z.infer<typeof AuditLogComplianceReport>

GenerateAuditLogComplianceReportRequest = z.object({
  organization_id: z.string().optional(),
  report_type: z.enum(['sox', 'pci', 'gdpr', 'hipaa', 'custom']),
  period_start: z.string().datetime(),
  period_end: z.string().datetime(),
  custom_criteria: z.record(z.unknown()).optional(),
})

export type GenerateAuditLogComplianceReportRequest = z.infer<typeof GenerateAuditLogComplianceReportRequest>

GenerateAuditLogComplianceReportResponse = z.object({
  report_id: z.string(),
  status: z.enum(['processing', 'completed', 'failed']),
  download_url: z.string().url().optional(),
  expires_at: z.string().datetime().optional(),
  created_at: z.string().datetime(),
})

export type GenerateAuditLogComplianceReportResponse = z.infer<typeof GenerateAuditLogComplianceReportResponse>

AuditLogAlert = z.object({
  id: z.string(),
  alert_type: z.enum(['suspicious_activity', 'failed_login', 'privilege_escalation', 'data_export', 'custom']),
  severity: z.enum(['low', 'medium', 'high', 'critical']),
  title: z.string(),
  description: z.string(),
  triggered_by: z.string().optional(),
  user_id: z.string().optional(),
  tenant_id: z.string().optional(),
  organization_id: z.string().optional(),
  metadata: z.record(z.unknown()).optional(),
  acknowledged: z.boolean(),
  acknowledged_by: z.string().optional(),
  acknowledged_at: z.string().datetime().optional(),
  resolved: z.boolean(),
  resolved_at: z.string().datetime().optional(),
  created_at: z.string().datetime(),
})

export type AuditLogAlert = z.infer<typeof AuditLogAlert>

ListAuditLogAlertsQuery = z.object({
  limit: z.coerce.number().int().min(1).max(100).default(20),
  offset: z.coerce.number().int().min(0).default(0),
  alert_type: z.enum(['suspicious_activity', 'failed_login', 'privilege_escalation', 'data_export', 'custom']).optional(),
  severity: z.enum(['low', 'medium', 'high', 'critical']).optional(),
  acknowledged: z.boolean().optional(),
  resolved: z.boolean().optional(),
})

export type ListAuditLogAlertsQuery = z.infer<typeof ListAuditLogAlertsQuery>

ListAuditLogAlertsResponse = z.object({
  alerts: z.array(AuditLogAlert),
  pagination: z.object({
    total: z.number().int(),
    limit: z.number().int(),
    offset: z.number().int(),
  }),
})

export type ListAuditLogAlertsResponse = z.infer<typeof ListAuditLogAlertsResponse>

AcknowledgeAuditLogAlertRequest = z.object({
  message: z.string().max(500).optional(),
})

export type AcknowledgeAuditLogAlertRequest = z.infer<typeof AcknowledgeAuditLogAlertRequest>

AcknowledgeAuditLogAlertResponse = z.object({
  alert_id: z.string(),
  acknowledged: z.boolean(),
  acknowledged_by: z.string(),
  acknowledged_at: z.string().datetime(),
})

export type AcknowledgeAuditLogAlertResponse = z.infer<typeof AcknowledgeAuditLogAlertResponse>

export interface Session {
  user: {
    id: string;
    email: string;
    name?: string;
    image?: string;
    emailVerified: boolean;
  };
  sessionId: string;
  expiresAt: Date;
  createdAt: Date;
  orgMemberships: OrgMembership[];
  tenantMemberships: TenantMembership[];
  defaultOrgId?: string;
  hmr?: HmrSessionContext;
}

export interface HmrSessionContext {
  did: string;
  tenantId: string;
  tenantDid: string;
  kratosIdentityId: string;
  aoDids: string[];
  mhrDids: string[];
  cached: boolean;
}

export interface OrgMembership {
  orgId: string;
  userId: string;
  role: OrgRole;
  createdAt: Date;
  active: boolean;
  organization: {
    id: string;
    name: string;
    slug: string;
  };
  invitedBy?: string;
}

export type OrgRole = 'owner' | 'admin' | 'member' | 'billing';

export interface TenantMembership {
  tenantId: string;
  tenantSlug: string;
  tenantName: string;
  orgId: string;
  role: TenantRole;
  plan: TenantPlan;
  productType: ProductType;
  projectId?: string;
  planMemoryLimit?: number | null;
  planRetrievalQuota?: number | null;
  planGraphEnabled: boolean;
  planNodePartitioning: boolean;
  active: boolean;
  createdAt: Date;
}

export interface TenantAccessToken {
  // Standard JWT claims
  iss: string;           // Issuer: "https://akasha.ooo"
  sub: string;           // Subject: user ID
  aud: string;           // Audience: tenant ID
  exp: number;           // Expiration: Unix timestamp
  iat: number;           // Issued at: Unix timestamp
  jti: string;           // JWT ID: unique token ID

  // AKASHA-specific claims
  tenant_id: string;     // Tenant UUID
  tenant_slug: string;   // Tenant subdomain slug
  org_id: string;        // Organization UUID
  user_id: string;       // User UUID
  user_email: string;    // User email

  // Namespace hierarchy
  namespace: {
    tenant: string;      // Tenant ID
    reservoir?: string;  // Optional: reservoir ID
    agent?: string;      // Optional: agent ID
    dataspace?: string;  // Optional: dataspace ID
  };

  // Permissions (ACL)
  permissions: Permission[];
  tenant_role?: TenantRole;

  // Plan-based limits
  plan: TenantPlan;
  quota: TenantQuota;
}

export type Permission = import('@/lib/auth/permissions').Permission

export interface TenantQuota {
  storage_gb: number;
  requests_per_day: number;
  hrm_inferences_per_day: number;
  memory_entries?: number | null;
  retrieval_calls?: number | null;
  graph_enabled?: boolean;
  node_partitioning?: boolean;
}

export type TenantRole = 'owner' | 'admin' | 'developer' | 'viewer';

export interface ApiKey {
  id: string;
  key: string;              // Hashed in database
  name: string;
  description?: string;
  tenantId: string;
  enabled: boolean;
  permissions: Permission[];
  rateLimit?: {
    requests_per_minute: number;
    burst?: number;
  };
  role?: TenantRole;
  expiresAt?: Date;
  createdAt: Date;
  lastUsedAt?: Date;
  usageCount: number;
  metadata?: Record<string, any>;
  tenant?: {
    orgId: string;
    ownerId: string;
    tenantSlug: string;
    tenantName: string;
    plan: TenantPlan;
    status: TenantStatus;
  };
}

export interface AuthContext {
  // User authentication
  user: {
    id: string;
    email: string;
    name?: string;
  };
  subjectType: 'session' | 'apiKey' | 'jwt';

  // Session info
  sessionId?: string;       // From BetterAuth session
  apiKeyId?: string;        // From API key auth

  // Tenant context
  tenantId?: string;        // Current tenant being accessed
  tenantSlug?: string;
  orgId: string;            // Primary organization for request
  orgIds: string[];         // All organizations available to subject
  orgMemberships: OrgMembership[];
  tenantMemberships: TenantMembership[];

  // Permissions
  permissions: Permission[];
  tenantRole?: TenantRole;
  orgRole: OrgRole;
  plan?: TenantPlan;
  apiKeyRateLimit?: {
    requests_per_minute: number;
    burst?: number;
  };

  // Request metadata
  requestId: string;
  ip: string;
  userAgent: string;
}

export enum AuthErrorCode {
  // Authentication errors
  NO_AUTH = 'NO_AUTH',
  INVALID_TOKEN = 'INVALID_TOKEN',
  TOKEN_EXPIRED = 'TOKEN_EXPIRED',
  SESSION_EXPIRED = 'SESSION_EXPIRED',
  INVALID_API_KEY = 'INVALID_API_KEY',

  // Authorization errors
  PERMISSION_DENIED = 'PERMISSION_DENIED',
  INSUFFICIENT_PERMISSIONS = 'INSUFFICIENT_PERMISSIONS',
  TENANT_ACCESS_DENIED = 'TENANT_ACCESS_DENIED',
  ORG_ACCESS_DENIED = 'ORG_ACCESS_DENIED',

  // Rate limiting
  RATE_LIMIT_EXCEEDED = 'RATE_LIMIT_EXCEEDED',
  QUOTA_EXCEEDED = 'QUOTA_EXCEEDED',
}

export interface HydraOIDCConfig {
  issuer: string;
  clientId: string;
  clientSecret: string;
  redirectUri: string;
  scopes: string[];
}

export interface KongConsumerMapping {
  username: string;      // Tenant slug
  custom_id: string;     // Tenant ID
  apiKeys: string[];     // Associated API keys
  acl_groups: string[];  // ACL groups (e.g., "tenant:{tenant_id}")
}

PermissionSchema = z.enum(PERMISSION_VALUES)

GenerateTokenRequest = z.object({
  name: z.string().max(100).optional(),
  expires_in: z.number().int().min(60).max(3600).optional(), // 1 min to 1 hour
  permissions: z.array(PermissionSchema).optional(),
})

export type GenerateTokenRequest = z.infer<typeof GenerateTokenRequest>

GenerateTokenResponse = z.object({
  token: z.string(), // JWT
  expires_at: z.string().datetime(),
  permissions: z.array(PermissionSchema),
})

export type GenerateTokenResponse = z.infer<typeof GenerateTokenResponse>

WebhookEventType = z.enum([
  'instance.created',
  'instance.ready',
  'instance.scaling',
  'instance.suspended',
  'instance.deleted',
  'backup.started',
  'backup.completed',
  'backup.failed',
  'usage.threshold_exceeded',
  'billing.invoice_created',
  'billing.payment_failed',
])

export type WebhookEventType = z.infer<typeof WebhookEventType>

Webhook = z.object({
  id: z.string(),
  tenant_id: z.string(),
  url: z.string().url(),
  events: z.array(WebhookEventType),
  secret: z.string(),
  enabled: z.boolean(),
  created_at: z.string().datetime(),
})

export type Webhook = z.infer<typeof Webhook>

CreateWebhookRequest = z.object({
  url: z.string().url(),
  events: z.array(WebhookEventType).min(1),
  secret: z.string().optional(), // Auto-generated if not provided
})

export type CreateWebhookRequest = z.infer<typeof CreateWebhookRequest>

ListWebhooksResponse = z.object({
  webhooks: z.array(Webhook),
})

export type ListWebhooksResponse = z.infer<typeof ListWebhooksResponse>

export type PermissionKey = keyof typeof PERMISSIONS

export type PermissionValue = (typeof PERMISSIONS)[PermissionKey]

export interface ApiKey {
  id: string;
  tenantId: string;
  name: string;
  keyPrefix: string;
  description?: string;
  permissions: Permission[];
  role?: TenantRole;
  enabled: boolean;
  lastUsedAt?: Date;
  usageCount: number;
  rateLimitPerMinute?: number;
  rateLimitBurst?: number;
  createdAt: Date;
  expiresAt?: Date;
  metadata?: Record<string, any>;
}

BackupStatus = z.enum(['creating', 'completed', 'failed', 'deleting'])

export type BackupStatus = z.infer<typeof BackupStatus>

CreateBackupRequest = z.object({
  name: z.string().max(100).optional(),
  description: z.string().max(500).optional(),
})

export type CreateBackupRequest = z.infer<typeof CreateBackupRequest>

CreateBackupResponse = z.object({
  backup_id: z.string(),
  tenant_id: z.string(),
  status: z.literal('creating'),
  created_at: z.string().datetime(),
  estimated_duration: z.number().int(), // seconds
})

export type CreateBackupResponse = z.infer<typeof CreateBackupResponse>