@endora-commerce/mod-api-keys 0.100.0

package/dist/manifest.d.ts

@@ -0,0 +1,169 @@
+/**
+ * API Keys module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        fields: Record<string, {
+            type: "number" | "object" | "array" | "text" | "textarea" | "select" | "radio" | "external" | "uuid" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkJnB,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,155 @@
+import { defineModuleManifest } from '@endora-commerce/contracts';
+/**
+ * API Keys module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export const manifest = defineModuleManifest({
+    id: 'api_keys',
+    name: 'API Keys',
+    description: 'Programmatic API keys (Bearer tokens) used by integrations and webhooks.',
+    version: '1.0.0',
+    // `auth` owns the `requireAdmin` port the admin routes are gated by; feature
+    // 072 made it a container resolution rather than a constructor argument.
+    dependencies: ['customer_accounts', 'organizations', 'sales_channels', 'auth'],
+    settings: {
+        moduleCode: 'api_keys',
+        groups: [{ code: 'api_keys', name: 'API keys' }],
+        settings: [
+            {
+                // Feature 073 — the operator's activation control. Platform-wide.
+                code: 'api_keys.enabled',
+                name: 'API keys enabled',
+                description: 'Switches machine-to-machine API keys on or off: the admin screens that issue them and the gates that authenticate them on the external catalog namespace. Switched off, existing keys stop authenticating but are not revoked — they work again exactly as issued when you switch it back on.',
+                groupCode: 'api_keys',
+                valueType: 'boolean',
+                defaultValue: true,
+            },
+        ],
+    },
+    // Issue #213 — `integrations:manage` is a **shared** gate: it guards this
+    // module's admin surface and `webhooks`', and the core `PERMISSION_CATALOGUE`
+    // row that carries its label can name only one module. Both owners declare it,
+    // so the presence filter on `/admin-roles` keeps the code grantable while
+    // either surface is on. This half is what the core row already says; it is
+    // written out anyway, because a shared code owned by one manifest and one
+    // hard-coded core row is the arrangement that produced the asymmetry.
+    permissions: [{ code: 'integrations:manage', label: 'Manage API keys + webhooks' }],
+    /**
+     * The module's command-palette entry — feature 091, Phase 4 (the plan's
+     * batch 6), and one of the fifteen Principle XVI entries
+     * `specs/deferred-defects.md` records as owed.
+     *
+     * It arrives with the drain rather than before it, by the mechanism that
+     * register predicts: the batch owes an off-state proof over every surface the
+     * module contributes, and until this declaration existed the `AppShell.tsx`
+     * `PALETTE_ITEMS` row that advertised /api-keys was the admin's own — a
+     * hand-written copy no server-side presence check was ever asked about, so it
+     * went on offering the screen to an operator who had switched the module off.
+     * The Actions group is resolved by `AdminActionsService` against the effective
+     * enabled-set, which is what makes the withdrawal real.
+     *
+     * `requiredPermission` is the code the target route enforces, which
+     * `check:action-route-permissions` compares against the registration on
+     * `GET /api/v1/admin/api-keys` itself. It is `integrations:manage` and not a
+     * `api_keys:`-prefixed code because that is the gate the module actually
+     * has: issue #213 records why both owners declare it.
+     */
+    actions: [
+        {
+            id: 'open-api-keys',
+            labelKey: 'actions.openApiKeys.label',
+            descriptionKey: 'actions.openApiKeys.description',
+            icon: 'KeyRound',
+            targetRoute: '/api-keys',
+            requiredPermission: 'integrations:manage',
+            keywords: ['api', 'api keys', 'klucze api', 'bearer', 'token', 'integration', 'integracja'],
+            weight: 700,
+        },
+    ],
+    activation: { settingCode: 'api_keys.enabled', default: true },
+    /**
+     * This module's first i18n bundle — D-129's remaining sweep, MR 5 — and it
+     * installs **no entries**.
+     *
+     * It exists because a **declaring** module that contributes no bundle file is
+     * `check:error-translations` exit 2 for the whole tree rather than a finding
+     * (`specs/090-module-owned-error-codes/contracts/error-translation-population.md`
+     * §2.1, §2.3; `d129-sweep.md` §3.4), and all three codes below are ledgered
+     * rather than written — so `{}` is what the two files hold. That is the
+     * default §5.4 describes for this position, and it is the first time the
+     * platform has carried it. What a module in that state does at boot is not
+     * decidable from a source-tree check, so the merge request that shipped it
+     * ran `bash scripts/boot-gate.sh --with-negatives` and read the answer off a
+     * real image: **`installed`**, with two `translation_bundles` rows carrying
+     * zero entries — `[i18n] reconcile complete — installed=54 skipped=15
+     * failed=0` over the 69 modules the platform composes, none left over.
+     * `loadModuleBundles` returns a `Map` of both languages here, not an empty
+     * one; §5.4's `{"byLanguage":{}}` is what `JSON.stringify` prints for any
+     * `Map` and says nothing about its size.
+     *
+     * The bundle lives at the **package root**, not under `dist`:
+     * `manifest-locations.ts` resolves a packaged module's `manifestPath` to its
+     * `package.json`, so `dirname` is the package directory. When a sentence is
+     * written here it must be a **flat** `{"a.b.c": "text"}` map, because a nested
+     * object fails `TranslationBundleEntriesSchema` and the boot reconciler logs
+     * and skips it — silently.
+     */
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    /**
+     * The `API_KEY_*` codes — D-129's remaining sweep, Tier B
+     * (`specs/090-module-owned-error-codes/d129-sweep.md` §5.2, Appendix A;
+     * MR 5).
+     *
+     * All three were declared by `_i18n` until this merge request, not because
+     * anybody judged them the platform's but because the deleted prefix chain had
+     * no rule for them and its last line was `return 'core'`. **D-121 T1 puts
+     * them here**: the noun in each is the API key, which is this module's
+     * entity, and its scopes and its distributor binding are columns on that row.
+     * T1 does not ask who throws, which matters twice over here — `API_KEY_NOT_BOUND`
+     * is raised by three modules (this one, `catalog` and `orders`, each gating
+     * its own external namespace) and `API_KEY_CHANNEL_MISMATCH` is raised by the
+     * **platform**, in the sales-channel resolver middleware.
+     *
+     * **That last one is D-186 §3, taken deliberately and with a condition.** A
+     * platform raise site now depends on a switchable module's bundle surviving,
+     * which is a coupling Phase 3 never created. The ruling accepts it so the
+     * family lands in one bundle, and the merge request carries the assertion that
+     * makes it safe: the raise is unreachable while `api_keys` is absent, because
+     * it needs `request.actor.kind === 'api_key'` and the only thing that produces
+     * such an actor is `auth`'s request hook calling this module's gated
+     * `apiKeyResolver` — which its own presence probe answers `null` for while
+     * this module is off. `test/integration/_lifecycle/non-binding-degradation.integration.test.ts`
+     * asserts it with a bound key and a mismatching `x-sales-channel` header.
+     *
+     * **None of the three arrives with a sentence.** `API_KEY_CHANNEL_MISMATCH`
+     * and `API_KEY_NOT_BOUND` never had one and stay on
+     * `UNTRANSLATED_ERROR_CODES`, under this module instead of under `_i18n`.
+     * `API_KEY_OUT_OF_SCOPE` carried a placeholder — `"Api Key Out Of Scope."` /
+     * `"Błąd: api key out of scope."` — which D-186 §2 deletes rather than
+     * carries, and it is **not** rewritten: it is the first code in the sweep
+     * ledgered despite a live raise site. Two reasons, and the second is the one
+     * that decides it. Its reader is an integration rather than a person, so a
+     * translation is answered to a program. And the raise names the scope the key
+     * is missing — `API key lacks the required scope: <scope>.` — which a fixed
+     * sentence would replace with a vaguer one, because
+     * `localizeErrorEnvelope` substitutes the message wholesale and the raise
+     * passes no `details` for a placeholder to be filled from. Writing one here
+     * would take information away from the only audience that meets it.
+     *
+     * **`tokens` is derived from the raise sites, not from the bundle**
+     * (runbook §5), and there are none: every raise is a bare
+     * `HttpError(403, code, message)` with no `details` argument, measured by
+     * balanced-paren extraction of each call's own arguments.
+     */
+    errorCodes: [
+        { code: 'API_KEY_CHANNEL_MISMATCH' },
+        { code: 'API_KEY_NOT_BOUND' },
+        { code: 'API_KEY_OUT_OF_SCOPE' },
+    ],
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,0EAA0E;IAC5E,OAAO,EAAE,OAAO;IAChB,6EAA6E;IAC7E,yEAAyE;IACzE,YAAY,EAAE,CAAC,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,CAAC;IAC9E,QAAQ,EAAE;QACR,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAChD,QAAQ,EAAE;YACR;gBACE,kEAAkE;gBAClE,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EACT,+RAA+R;gBACjS,SAAS,EAAE,UAAU;gBACrB,SAAS,EAAE,SAAS;gBACpB,YAAY,EAAE,IAAI;aACnB;SACF;KACF;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,eAAe;YACnB,QAAQ,EAAE,2BAA2B;YACrC,cAAc,EAAE,iCAAiC;YACjD,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,WAAW;YACxB,kBAAkB,EAAE,qBAAqB;YACzC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC;YAC3F,MAAM,EAAE,GAAG;SACZ;KACF;IACD,UAAU,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE;IAC9D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,0BAA0B,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE;QAC7B,EAAE,IAAI,EAAE,sBAAsB,EAAE;KACjC;CACF,CAAC,CAAC"}

package/dist/migrations/20260724T173916_api_keys_distributor_binding.d.ts

@@ -0,0 +1,50 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 062 — Distributor API key binding (data-model.md §1), and since
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3 the **creation** of
+ * `api_keys` itself.
+ *
+ * The table was created by `webhooks`' frozen
+ * `Migration20260425T091359WebhooksUs7Init`: the two modules were one surface
+ * until the US7 split, and the creation stayed behind while the entity, the
+ * service and every other statement came here. An instance installing
+ * `api_keys` without `webhooks` therefore had no migration that builds the
+ * table, and this very migration named a table outside its own closure (D-226).
+ *
+ * **It moved from one frozen body into another, and that is the whole of
+ * FR-014.** D-226's prescribed repair — subtract the statement and re-add it
+ * above `BASELINE_THROUGH` — is right for a *reference*, which can only move
+ * strictly later in the computed order. It is wrong for a *creation*: an
+ * above-watermark migration runs after the entire frozen prefix, and two frozen
+ * migrations reference `api_keys` — this one's own `alter table` below, and
+ * `Migration20260724T193611OrdersOrderPlacementIntents`' foreign key. The
+ * creation would have landed after both and broken a fresh database. This
+ * migration's historical position precedes both, so it is where the creation
+ * goes. Both class names are unchanged and `BASELINE_MIGRATIONS` is untouched:
+ * `mikro_orm_migrations` persists the class name and no checksum, so neither
+ * edited body is re-offered to a database that has applied it.
+ *
+ * **`if not exists`, and it is load-bearing rather than defensive.** A database
+ * that applied the April migration and has not yet reached this one — anything
+ * behind by a release — already has `api_keys` while this migration is pending.
+ * A verbatim `create table` would fail there. With the guard it is a no-op on
+ * that database and the creation on a fresh one.
+ *
+ * Adds the distributor binding columns to `api_keys`:
+ *  - `organization_id` / `sales_channel_id` / `customer_account_id` — the
+ *    all-or-none binding that pins a key to one org, one channel, and one
+ *    designated service customer account. `ON DELETE RESTRICT`: revoke keys
+ *    before removing the bound rows.
+ *  - `expires_at` — optional expiry; NULL = non-expiring. `authenticate()`
+ *    refuses past instants.
+ *
+ * Existing rows keep all four columns NULL ⇒ unbound legacy keys, behavior
+ * unchanged (FR-020). The cross-row rule "service account belongs to the bound
+ * org" is enforced at creation in `ApiKeyService.create` (research §R4), not
+ * as a DB constraint.
+ */
+export declare class Migration20260724T173916ApiKeysDistributorBinding extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260724T173916_api_keys_distributor_binding.d.ts.map

package/dist/migrations/20260724T173916_api_keys_distributor_binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260724T173916_api_keys_distributor_binding.d.ts","sourceRoot":"","sources":["../../src/migrations/20260724T173916_api_keys_distributor_binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,qBAAa,iDAAkD,SAAQ,SAAS;IAC/D,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IA4DnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAqBrC"}

package/dist/migrations/20260724T173916_api_keys_distributor_binding.js

@@ -0,0 +1,117 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 062 — Distributor API key binding (data-model.md §1), and since
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3 the **creation** of
+ * `api_keys` itself.
+ *
+ * The table was created by `webhooks`' frozen
+ * `Migration20260425T091359WebhooksUs7Init`: the two modules were one surface
+ * until the US7 split, and the creation stayed behind while the entity, the
+ * service and every other statement came here. An instance installing
+ * `api_keys` without `webhooks` therefore had no migration that builds the
+ * table, and this very migration named a table outside its own closure (D-226).
+ *
+ * **It moved from one frozen body into another, and that is the whole of
+ * FR-014.** D-226's prescribed repair — subtract the statement and re-add it
+ * above `BASELINE_THROUGH` — is right for a *reference*, which can only move
+ * strictly later in the computed order. It is wrong for a *creation*: an
+ * above-watermark migration runs after the entire frozen prefix, and two frozen
+ * migrations reference `api_keys` — this one's own `alter table` below, and
+ * `Migration20260724T193611OrdersOrderPlacementIntents`' foreign key. The
+ * creation would have landed after both and broken a fresh database. This
+ * migration's historical position precedes both, so it is where the creation
+ * goes. Both class names are unchanged and `BASELINE_MIGRATIONS` is untouched:
+ * `mikro_orm_migrations` persists the class name and no checksum, so neither
+ * edited body is re-offered to a database that has applied it.
+ *
+ * **`if not exists`, and it is load-bearing rather than defensive.** A database
+ * that applied the April migration and has not yet reached this one — anything
+ * behind by a release — already has `api_keys` while this migration is pending.
+ * A verbatim `create table` would fail there. With the guard it is a no-op on
+ * that database and the creation on a fresh one.
+ *
+ * Adds the distributor binding columns to `api_keys`:
+ *  - `organization_id` / `sales_channel_id` / `customer_account_id` — the
+ *    all-or-none binding that pins a key to one org, one channel, and one
+ *    designated service customer account. `ON DELETE RESTRICT`: revoke keys
+ *    before removing the bound rows.
+ *  - `expires_at` — optional expiry; NULL = non-expiring. `authenticate()`
+ *    refuses past instants.
+ *
+ * Existing rows keep all four columns NULL ⇒ unbound legacy keys, behavior
+ * unchanged (FR-020). The cross-row rule "service account belongs to the bound
+ * org" is enforced at creation in `ApiKeyService.create` (research §R4), not
+ * as a DB constraint.
+ */
+export class Migration20260724T173916ApiKeysDistributorBinding extends Migration {
+    async up() {
+        this.addSql(`
+      create table if not exists "api_keys" (
+        "id" uuid not null,
+        "name" varchar(160) not null,
+        "key_hash" varchar(128) not null,
+        "last_four" varchar(8) not null,
+        "scopes" jsonb not null default '[]'::jsonb,
+        "status" varchar(16) not null default 'active',
+        "last_used_at" timestamptz null,
+        "revoked_at" timestamptz null,
+        "created_by_admin_user_id" uuid null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "api_keys_pkey" primary key ("id"),
+        constraint "api_keys_key_hash_unique" unique ("key_hash")
+      );
+    `);
+        this.addSql('create index if not exists "api_keys_key_hash_index" on "api_keys" ("key_hash");');
+        this.addSql(`
+      alter table "api_keys"
+        add column "organization_id" uuid null,
+        add column "sales_channel_id" uuid null,
+        add column "customer_account_id" uuid null,
+        add column "expires_at" timestamptz null;
+    `);
+        this.addSql(`
+      alter table "api_keys"
+        add constraint "api_keys_organization_id_foreign"
+          foreign key ("organization_id") references "organizations" ("id")
+          on update cascade on delete restrict;
+    `);
+        this.addSql(`
+      alter table "api_keys"
+        add constraint "api_keys_sales_channel_id_foreign"
+          foreign key ("sales_channel_id") references "sales_channels" ("id")
+          on update cascade on delete restrict;
+    `);
+        this.addSql(`
+      alter table "api_keys"
+        add constraint "api_keys_customer_account_id_foreign"
+          foreign key ("customer_account_id") references "customer_accounts" ("id")
+          on update cascade on delete restrict;
+    `);
+        this.addSql(`
+      alter table "api_keys"
+        add constraint "api_keys_binding_all_or_none" check (
+          ("organization_id" is null and "sales_channel_id" is null and "customer_account_id" is null)
+          or
+          ("organization_id" is not null and "sales_channel_id" is not null and "customer_account_id" is not null)
+        );
+    `);
+        this.addSql(`create index "api_keys_organization_id_index" on "api_keys" ("organization_id");`);
+    }
+    async down() {
+        this.addSql(`drop index if exists "api_keys_organization_id_index";`);
+        this.addSql(`alter table "api_keys" drop constraint if exists "api_keys_binding_all_or_none";`);
+        this.addSql(`alter table "api_keys" drop constraint if exists "api_keys_customer_account_id_foreign";`);
+        this.addSql(`alter table "api_keys" drop constraint if exists "api_keys_sales_channel_id_foreign";`);
+        this.addSql(`alter table "api_keys" drop constraint if exists "api_keys_organization_id_foreign";`);
+        this.addSql(`
+      alter table "api_keys"
+        drop column "organization_id",
+        drop column "sales_channel_id",
+        drop column "customer_account_id",
+        drop column "expires_at";
+    `);
+        this.addSql('drop table if exists "api_keys" cascade;');
+    }
+}
+//# sourceMappingURL=20260724T173916_api_keys_distributor_binding.js.map

package/dist/migrations/20260724T173916_api_keys_distributor_binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260724T173916_api_keys_distributor_binding.js","sourceRoot":"","sources":["../../src/migrations/20260724T173916_api_keys_distributor_binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,OAAO,iDAAkD,SAAQ,SAAS;IACrE,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;KAgBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,kFAAkF,CACnF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC;;;;;;KAMX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;;;;;KAOX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,kFAAkF,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,CACT,0FAA0F,CAC3F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uFAAuF,CACxF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;;;KAMX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260724T173916ApiKeysDistributorBinding } from './20260724T173916_api_keys_distributor_binding.js';
+export declare const migrations: (typeof Migration20260724T173916ApiKeysDistributorBinding)[];
+export { Migration20260724T173916ApiKeysDistributorBinding, };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,iDAAiD,EAAE,MAAM,mDAAmD,CAAC;AAEtH,eAAO,MAAM,UAAU,8DAEtB,CAAC;AAEF,OAAO,EACL,iDAAiD,GAClD,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,29 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260724T173916ApiKeysDistributorBinding } from './20260724T173916_api_keys_distributor_binding.js';
+export const migrations = [
+    Migration20260724T173916ApiKeysDistributorBinding,
+];
+export { Migration20260724T173916ApiKeysDistributorBinding, };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,iDAAiD,EAAE,MAAM,mDAAmD,CAAC;AAEtH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,iDAAiD;CAClD,CAAC;AAEF,OAAO,EACL,iDAAiD,GAClD,CAAC"}