@ledgerhq/revault-api 1.84.0 → 1.86.0

package/lib/{internal → entrypoints/internal-api}/app-lib.d.mts

@@ -1,6 +1,1390 @@
-import { Ar as zOidcConfig, En as UserRole, F as RateLimitMetricsMeta, I as RuntimeApiCapabilities, P as BackofficePermissionMeta, Tn as UserDeviceType, X as ExtendedPrismaClient, Y as ActivityTracer, Yi as SendOnlyTransactionData, Z as BackofficePermission, Zi as TransactionData, at as VaultRequestResponse, dn as MaintenanceMode, li as HsmCertificate, ln as GateUserType, nt as RequestReview, rn as ActivationStatus, ro as Note, wo as HsmWorkspaceComparison } from "../app-lib-Dp0IWsmF.mjs";
+import { $a as LesWalletRegistrationReport, Ao as HsmHostingMode, Co as GateAccountType, Cr as SendOnlyTransactionData, Do as GateUserType, Ei as HsmCertificate, Eo as GateReviewConfigType, F as RuntimeApiCapabilities, Go as ReviewConfigType, Ho as RequestType$1, Ia as SortOrder, J as ActivityTracer, Ja as WebhookDeliveryStats, Jo as UserRole, Ko as UserDeviceType, Lo as PsdModel, No as OnboardedUserRole, Oo as GateWhitelistType, P as TrpcMeta, Po as OnboardingStep, Qa as LesWalletRegistrableSummary, Ro as ReportStatus$1, So as EventAction$1, To as GatePolicyType, Tr as TransactionData, Wo as RevaultMode, Xo as WebhookStatus$1, Ya as RequestView, Yo as WebhookRetryStrategy$1, Zo as WhitelistType, _i as RequestListFilters, _o as AdminPermission$1, aa as HsmComparator, co as ExtendedPrismaClient, da as AccountWorkspaceScope, et as RequestReview, gi as WhitelistSortBy, go as AddressDerivationMode, hi as Note, ho as ActivationStatus$1, jo as MaintenanceMode, ko as GateWorkspaceRuleType, la as HsmWorkspaceComparison, lo as BackofficePermission, mo as AccountType$1, no as BackofficeClaims, po as AccountGovernanceType, qo as UserRegistrationState, rt as VaultRequestResponse, so as zOidcConfig, to as LesWalletRegistrationScope, ua as AccountAssetFilter, vi as startOnboarding, wo as GateGroupType, xo as ClaimedRole, yo as AuditLogType, zo as ReportType$1 } from "../../app-lib-CdmEGeOS.mjs";
 import z from "zod";
+import { Account, AllowedAction, Prisma, PrismaClient, ReviewConfig, VaultRequestReview, Workspace } from "@/generated/prisma/client";
 import "trpc-to-openapi";
+//#region src/core/rebac/relationship-tuples.d.ts
+declare const RELATIONSHIP_OBJECT_TYPES: {
+  readonly account: "account";
+  readonly entity: "entity";
+  readonly group: "group";
+  readonly policy: "policy";
+  readonly portfolio: "portfolio";
+  readonly tradelinkCustodian: "tradelink-custodian";
+  readonly tradelinkEntity: "tradelink-entity";
+  readonly tradelinkPledge: "tradelink-pledge";
+  readonly user: "user";
+  readonly whitelist: "whitelist";
+  readonly workspace: "workspace";
+  readonly workspaceRule: "workspace-rule";
+};
+type RelationshipObjectType = (typeof RELATIONSHIP_OBJECT_TYPES)[keyof typeof RELATIONSHIP_OBJECT_TYPES];
+declare const RELATIONSHIP_RELATIONS: {
+  readonly entity: "entity";
+  readonly member: "member";
+  readonly policy: "policy";
+  readonly portfolio: "portfolio";
+  readonly reader: "reader";
+  readonly tradelinkAssetManager: "tradelink:asset-manager";
+  readonly tradelinkCustodian: "tradelink:custodian";
+  readonly tradelinkExchange: "tradelink:exchange";
+  readonly tradelinkRepledgeExchange: "tradelink:repledge-exchange";
+};
+declare const DIRECT_SUBJECT_RELATION = "";
+type OperatorRelation = `operator:${AllowedAction}`;
+type RelationshipRelation = (typeof RELATIONSHIP_RELATIONS)[keyof typeof RELATIONSHIP_RELATIONS] | OperatorRelation;
+type RelationshipSubjectRelation = typeof DIRECT_SUBJECT_RELATION | typeof RELATIONSHIP_RELATIONS.member;
+/**
+ * Authorization-graph fact in Zanzibar/ReBAC vocabulary:
+ *
+ *   object#relation@subject
+ *
+ * plus Revault source attribution for deterministic source replacement:
+ *
+ *   object#relation@subject [source]
+ *
+ * This is not a TypeScript tuple (`[A, B]`). The persisted table stores each component in a
+ * dedicated string column so rows can be indexed, rebuilt, and compared deterministically.
+ */
+type RelationshipTuple = {
+  workspaceName: string;
+  objectType: RelationshipObjectType;
+  objectId: string;
+  relation: RelationshipRelation;
+  subjectType: RelationshipObjectType;
+  subjectId: string;
+  subjectRelation: RelationshipSubjectRelation;
+  sourceType: RelationshipObjectType;
+  sourceId: string;
+};
+//#endregion
+//#region src/core/relationships/inspection.d.ts
+type RelationshipShapeCount = {
+  objectType: string;
+  relation: string;
+  subjectType: string;
+  subjectRelation: string;
+  count: number;
+};
+type RelationshipSourceTypeCount = {
+  sourceType: string;
+  count: number;
+};
+type RelationshipHealth = {
+  workspaceName: string;
+  currentTupleCount: number;
+  sourceTypeCounts: RelationshipSourceTypeCount[];
+  shapeCounts: RelationshipShapeCount[];
+};
+type RelationshipDriftCheck = {
+  workspaceName: string;
+  expectedTupleCount: number;
+  actualTupleCount: number;
+  missingTupleCount: number;
+  extraTupleCount: number;
+  missingSamples: RelationshipTuple[];
+  extraSamples: RelationshipTuple[];
+  buildDurationMs: number;
+  readDurationMs: number;
+  compareDurationMs: number;
+  totalDurationMs: number;
+};
+//#endregion
+//#region src/core/runtime/internal-capabilities.d.ts
+/**
+ * Least-privilege split (ADR-0022): capabilities that must never be reachable from the *public*
+ * HTTP context live here, not in {@link createApiCoreCapabilities}. Only the internal-API transport
+ * (backoffice) mounts them, so a public procedure's `ctx.core` cannot see — or type-resolve — the
+ * administration surface. New non-public internal capabilities belong in this bucket too.
+ */
+declare const createInternalCapabilities: (prisma: ExtendedPrismaClient) => {
+  accounts: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspace: AccountWorkspaceScope;
+      status?: ActivationStatus$1;
+      id?: string;
+      name?: string;
+      governanceType?: AccountGovernanceType;
+      asset?: AccountAssetFilter;
+      support?: "standalone" | "legacy";
+      accountType?: AccountType$1;
+      index?: number;
+      policyIds?: string[];
+      entityIds?: string[];
+      userIds?: string[];
+      groupIds?: string[];
+      lesWalletRegistrable?: boolean;
+      addressBackfillable?: boolean;
+      gateSynced?: boolean;
+      sortBy: "name" | "currency" | "index" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        gateId: number;
+        name: string;
+        asset: {
+          network: string;
+          contractAddress: string | null;
+          tokenIdentifier: string | null;
+        };
+        accountTypeFields: {
+          type: "BITCOIN_LIKE";
+          xpub: string;
+          addressDerivationMode: "NEW" | "STATIC";
+        } | {
+          type: "CANTON_LIKE";
+          address: string | null;
+        } | {
+          type: "CARDANO_LIKE";
+          address: string | null;
+        } | {
+          type: "ETHEREUM_LIKE";
+          address: string | null;
+        } | {
+          type: "GENERIC_LIKE";
+        } | {
+          type: "HEDERA_LIKE";
+          address: string | null;
+          isActivated: boolean;
+        } | {
+          type: "POLKADOT_LIKE";
+          address: string | null;
+        } | {
+          type: "RIPPLE_LIKE";
+          address: string | null;
+        } | {
+          type: "SOLANA_LIKE";
+          address: string | null;
+        } | {
+          type: "STELLAR_LIKE";
+          address: string | null;
+        } | {
+          type: "SUI_LIKE";
+          address: string | null;
+        } | {
+          type: "TEZOS_LIKE";
+          address: string | null;
+        } | {
+          type: "TRON_LIKE";
+          address: string | null;
+        } | {
+          type: "RAW_SIGNING";
+        };
+        index: number;
+        derivationPath: string;
+        lesWalletId: string | null;
+        hsmId: string;
+        status: "ACTIVE" | "INACTIVE";
+        createdAt: Date;
+        updatedAt: Date;
+        governance: {
+          type: "CLASSIC";
+          policyId: string;
+        } | {
+          type: "RAW_SIGNING";
+          policyId: string;
+        } | {
+          type: "TRADELINK";
+          assetManagerId: string;
+          exchangeConfigs: {
+            exchangeId: string;
+            repledgeAuthorized: boolean;
+            needsAssetManagerApprovalForSettlements: boolean;
+          }[];
+        };
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__AccountClient<({
+      classicGovernanceMixin: {
+        id: number;
+        accountId: string;
+        policyId: string;
+      } | null;
+      tradelinkGovernanceMixin: {
+        id: number;
+        accountId: string;
+        assetManagerId: string;
+        status: ActivationStatus$1;
+        exchangeConfigs: import("@prisma/client/runtime/client").JsonValue;
+      } | null;
+    } & {
+      id: string;
+      workspaceName: string;
+      name: string;
+      status: ActivationStatus$1;
+      governanceType: AccountGovernanceType;
+      type: AccountType$1;
+      currency: string;
+      index: number;
+      contractAddress: string | null;
+      tokenIdentifier: string | null;
+      derivationPath: string;
+      bitcoinAddressDerivationMode: AddressDerivationMode | null;
+      hsmId: string;
+      hsmXpub: string;
+      hsmChainCode: string | null;
+      address: string | null;
+      xpub: string | null;
+      lesWalletId: string | null;
+      gateType: GateAccountType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+    lesWalletRegistrableSummary: (scope: LesWalletRegistrationScope) => Promise<LesWalletRegistrableSummary>;
+    registerOnLesWallet: (actor: BackofficeClaims, requiredPermission: "workspace:edit", input: {
+      scope: LesWalletRegistrationScope;
+      limit: number;
+    }) => Promise<LesWalletRegistrationReport>;
+  };
+  users: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      role?: UserRole;
+      deviceType?: UserDeviceType;
+      status?: ActivationStatus$1;
+      id?: string;
+      name?: string;
+      ids?: string[];
+      sortBy: "name" | "role" | "status" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        name: string;
+        authUserId: string | null;
+        pubKey: string;
+        deviceType: UserDeviceType;
+        deviceUserId: string | null;
+        hsmId: string | null;
+        u2fKeyHandle: string | null;
+        u2fPubKey: string | null;
+        legacyViewAll: boolean;
+        role: UserRole;
+        status: ActivationStatus$1;
+        isSuspended: boolean;
+        gateType: GateUserType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__UserClient<{
+      id: string;
+      workspaceName: string;
+      name: string;
+      authUserId: string | null;
+      pubKey: string;
+      deviceType: UserDeviceType;
+      deviceUserId: string | null;
+      hsmId: string | null;
+      u2fKeyHandle: string | null;
+      u2fPubKey: string | null;
+      legacyViewAll: boolean;
+      role: UserRole;
+      status: ActivationStatus$1;
+      isSuspended: boolean;
+      gateType: GateUserType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  userRegistrations: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      role?: "ADMIN" | "OPERATOR";
+      state?: UserRegistrationState;
+      sortBy: "name" | "role" | "state";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        name: string;
+        role: UserRole;
+        psdModel: PsdModel;
+        deviceUserId: string;
+        invitedById: string;
+        pubKey: string | null;
+        challenge: import("@prisma/client/runtime/client").JsonValue;
+        u2fKeyHandle: string | null;
+        u2fPubKey: string | null;
+        state: UserRegistrationState;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__UserRegistrationClient<{
+      id: string;
+      workspaceName: string;
+      name: string;
+      role: UserRole;
+      psdModel: PsdModel;
+      deviceUserId: string;
+      invitedById: string;
+      pubKey: string | null;
+      challenge: import("@prisma/client/runtime/client").JsonValue;
+      u2fKeyHandle: string | null;
+      u2fPubKey: string | null;
+      state: UserRegistrationState;
+      createdAt: Date;
+      updatedAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  groups: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      status?: ActivationStatus$1;
+      id?: string;
+      name?: string;
+      sortBy: "name" | "status" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        members: {
+          id: string;
+          workspaceName: string;
+          name: string;
+          authUserId: string | null;
+          pubKey: string;
+          deviceType: UserDeviceType;
+          deviceUserId: string | null;
+          hsmId: string | null;
+          u2fKeyHandle: string | null;
+          u2fPubKey: string | null;
+          legacyViewAll: boolean;
+          role: UserRole;
+          status: ActivationStatus$1;
+          isSuspended: boolean;
+          gateType: GateUserType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        }[];
+      } & {
+        id: string;
+        workspaceName: string;
+        name: string;
+        description: string | null;
+        hsmId: string;
+        status: ActivationStatus$1;
+        gateType: GateGroupType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__GroupClient<({
+      members: {
+        id: string;
+        workspaceName: string;
+        name: string;
+        authUserId: string | null;
+        pubKey: string;
+        deviceType: UserDeviceType;
+        deviceUserId: string | null;
+        hsmId: string | null;
+        u2fKeyHandle: string | null;
+        u2fPubKey: string | null;
+        legacyViewAll: boolean;
+        role: UserRole;
+        status: ActivationStatus$1;
+        isSuspended: boolean;
+        gateType: GateUserType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    } & {
+      id: string;
+      workspaceName: string;
+      name: string;
+      description: string | null;
+      hsmId: string;
+      status: ActivationStatus$1;
+      gateType: GateGroupType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  policies: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      name?: string;
+      isPrivate: boolean;
+      currency?: string;
+      currencyLess?: boolean;
+      sortBy: "name" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        reviewConfigs: ({
+          groups: ({
+            members: {
+              id: string;
+              workspaceName: string;
+              name: string;
+              authUserId: string | null;
+              pubKey: string;
+              deviceType: UserDeviceType;
+              deviceUserId: string | null;
+              hsmId: string | null;
+              u2fKeyHandle: string | null;
+              u2fPubKey: string | null;
+              legacyViewAll: boolean;
+              role: UserRole;
+              status: ActivationStatus$1;
+              isSuspended: boolean;
+              gateType: GateUserType | null;
+              gateId: number;
+              syncId: string;
+              createdAt: Date;
+              updatedAt: Date;
+            }[];
+          } & {
+            id: string;
+            workspaceName: string;
+            name: string;
+            description: string | null;
+            hsmId: string;
+            status: ActivationStatus$1;
+            gateType: GateGroupType | null;
+            gateId: number;
+            syncId: string;
+            createdAt: Date;
+            updatedAt: Date;
+          })[];
+          users: {
+            id: string;
+            workspaceName: string;
+            name: string;
+            authUserId: string | null;
+            pubKey: string;
+            deviceType: UserDeviceType;
+            deviceUserId: string | null;
+            hsmId: string | null;
+            u2fKeyHandle: string | null;
+            u2fPubKey: string | null;
+            legacyViewAll: boolean;
+            role: UserRole;
+            status: ActivationStatus$1;
+            isSuspended: boolean;
+            gateType: GateUserType | null;
+            gateId: number;
+            syncId: string;
+            createdAt: Date;
+            updatedAt: Date;
+          }[];
+        } & {
+          id: string;
+          workspaceName: string;
+          type: ReviewConfigType;
+          steps: import("@prisma/client/runtime/client").JsonValue;
+          ownerPolicyId: string | null;
+          gateType: GateReviewConfigType | null;
+          gateId: number;
+          syncId: string;
+        })[];
+        whitelists: ({
+          addresses: {
+            id: string;
+            whitelistId: string;
+            name: string;
+            currency: string;
+            address: string;
+            destinationTag: string | null;
+          }[];
+        } & {
+          id: string;
+          workspaceName: string;
+          name: string;
+          description: string | null;
+          hsmId: string;
+          type: WhitelistType;
+          status: ActivationStatus$1;
+          gateType: GateWhitelistType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        })[];
+      } & {
+        id: string;
+        workspaceName: string;
+        name: string;
+        description: string | null;
+        currency: string | null;
+        contractAddress: string | null;
+        tokenIdentifier: string | null;
+        isPrivate: boolean;
+        hsmId: string | null;
+        rulesJsonArray: import("@prisma/client/runtime/client").JsonValue;
+        status: ActivationStatus$1;
+        gateType: GatePolicyType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__PolicyClient<({
+      reviewConfigs: ({
+        groups: ({
+          members: {
+            id: string;
+            workspaceName: string;
+            name: string;
+            authUserId: string | null;
+            pubKey: string;
+            deviceType: UserDeviceType;
+            deviceUserId: string | null;
+            hsmId: string | null;
+            u2fKeyHandle: string | null;
+            u2fPubKey: string | null;
+            legacyViewAll: boolean;
+            role: UserRole;
+            status: ActivationStatus$1;
+            isSuspended: boolean;
+            gateType: GateUserType | null;
+            gateId: number;
+            syncId: string;
+            createdAt: Date;
+            updatedAt: Date;
+          }[];
+        } & {
+          id: string;
+          workspaceName: string;
+          name: string;
+          description: string | null;
+          hsmId: string;
+          status: ActivationStatus$1;
+          gateType: GateGroupType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        })[];
+        users: {
+          id: string;
+          workspaceName: string;
+          name: string;
+          authUserId: string | null;
+          pubKey: string;
+          deviceType: UserDeviceType;
+          deviceUserId: string | null;
+          hsmId: string | null;
+          u2fKeyHandle: string | null;
+          u2fPubKey: string | null;
+          legacyViewAll: boolean;
+          role: UserRole;
+          status: ActivationStatus$1;
+          isSuspended: boolean;
+          gateType: GateUserType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        }[];
+      } & {
+        id: string;
+        workspaceName: string;
+        type: ReviewConfigType;
+        steps: import("@prisma/client/runtime/client").JsonValue;
+        ownerPolicyId: string | null;
+        gateType: GateReviewConfigType | null;
+        gateId: number;
+        syncId: string;
+      })[];
+      whitelists: ({
+        addresses: {
+          id: string;
+          whitelistId: string;
+          name: string;
+          currency: string;
+          address: string;
+          destinationTag: string | null;
+        }[];
+      } & {
+        id: string;
+        workspaceName: string;
+        name: string;
+        description: string | null;
+        hsmId: string;
+        type: WhitelistType;
+        status: ActivationStatus$1;
+        gateType: GateWhitelistType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    } & {
+      id: string;
+      workspaceName: string;
+      name: string;
+      description: string | null;
+      currency: string | null;
+      contractAddress: string | null;
+      tokenIdentifier: string | null;
+      isPrivate: boolean;
+      hsmId: string | null;
+      rulesJsonArray: import("@prisma/client/runtime/client").JsonValue;
+      status: ActivationStatus$1;
+      gateType: GatePolicyType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  whitelists: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      status?: ActivationStatus$1;
+      id?: string;
+      name?: string;
+      address?: string;
+      currency?: string;
+      sortBy: WhitelistSortBy;
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        addresses: {
+          id: string;
+          whitelistId: string;
+          name: string;
+          currency: string;
+          address: string;
+          destinationTag: string | null;
+        }[];
+      } & {
+        id: string;
+        workspaceName: string;
+        name: string;
+        description: string | null;
+        hsmId: string;
+        type: WhitelistType;
+        status: ActivationStatus$1;
+        gateType: GateWhitelistType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__WhitelistClient<({
+      addresses: {
+        id: string;
+        whitelistId: string;
+        name: string;
+        currency: string;
+        address: string;
+        destinationTag: string | null;
+      }[];
+    } & {
+      id: string;
+      workspaceName: string;
+      name: string;
+      description: string | null;
+      hsmId: string;
+      type: WhitelistType;
+      status: ActivationStatus$1;
+      gateType: GateWhitelistType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  reports: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      type?: ReportType$1;
+      status?: ReportStatus$1;
+      createdBy?: string;
+      sortBy: "createdAt" | "updatedAt" | "expiresAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        type: ReportType$1;
+        params: import("@prisma/client/runtime/client").JsonValue;
+        status: ReportStatus$1;
+        s3Region: string | null;
+        s3Bucket: string | null;
+        s3Key: string | null;
+        errorMessage: string | null;
+        generationTaskId: string | null;
+        createdById: string;
+        expiresAt: Date;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__VaultReportClient<{
+      id: string;
+      workspaceName: string;
+      type: ReportType$1;
+      params: import("@prisma/client/runtime/client").JsonValue;
+      status: ReportStatus$1;
+      s3Region: string | null;
+      s3Bucket: string | null;
+      s3Key: string | null;
+      errorMessage: string | null;
+      generationTaskId: string | null;
+      createdById: string;
+      expiresAt: Date;
+      createdAt: Date;
+      updatedAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  auditLogs: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      type?: AuditLogType;
+      fromDate?: Date;
+      toDate?: Date;
+      sortBy: "createdAt" | "type";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string | null;
+        type: AuditLogType;
+        payload: import("@prisma/client/runtime/client").JsonValue;
+        createdAt: Date;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__AuditLogClient<{
+      id: string;
+      workspaceName: string | null;
+      type: AuditLogType;
+      payload: import("@prisma/client/runtime/client").JsonValue;
+      createdAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  workspaceRules: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      permission?: AdminPermission$1;
+      sortBy: "permission" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        reviewConfig: {
+          id: string;
+          workspaceName: string;
+          type: ReviewConfigType;
+          steps: import("@prisma/client/runtime/client").JsonValue;
+          ownerPolicyId: string | null;
+          gateType: GateReviewConfigType | null;
+          gateId: number;
+          syncId: string;
+        };
+      } & {
+        id: string;
+        workspaceName: string;
+        permission: AdminPermission$1;
+        reviewConfigId: string;
+        gateType: GateWorkspaceRuleType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    }>;
+  };
+  workspaces: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      name?: string | string[];
+      mode?: RevaultMode;
+      status?: ActivationStatus$1;
+      sortBy: "name" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        name: string;
+        compartmentId: number;
+        targetHsmName: string;
+        mode: RevaultMode;
+        hsmHostingMode: HsmHostingMode;
+        status: ActivationStatus$1;
+        maintenanceMode: MaintenanceMode;
+        createdAt: Date;
+        updatedAt: Date;
+        pkiRootCaFetched: boolean;
+        oidcConfig: import("@prisma/client/runtime/client").JsonValue | null;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__WorkspaceClient<{
+      id: string;
+      name: string;
+      compartmentId: number;
+      targetHsmName: string;
+      mode: RevaultMode;
+      hsmHostingMode: HsmHostingMode;
+      status: ActivationStatus$1;
+      maintenanceMode: MaintenanceMode;
+      createdAt: Date;
+      updatedAt: Date;
+      pkiRootCaFetched: boolean;
+      oidcConfig: import("@prisma/client/runtime/client").JsonValue | null;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+    edit: (actor: BackofficeClaims, requiredPermission: "workspace:edit", input: {
+      name: string;
+      mode?: RevaultMode;
+      maintenanceMode?: MaintenanceMode;
+      oidcConfig?: import("@/generated/prisma/internal/prismaNamespace").InputJsonValue | null;
+      hsmProxyName?: string;
+    }) => Promise<{
+      id: string;
+      name: string;
+      compartmentId: number;
+      targetHsmName: string;
+      mode: RevaultMode;
+      hsmHostingMode: HsmHostingMode;
+      status: ActivationStatus$1;
+      maintenanceMode: MaintenanceMode;
+      createdAt: Date;
+      updatedAt: Date;
+      pkiRootCaFetched: boolean;
+      oidcConfig: import("@prisma/client/runtime/client").JsonValue | null;
+    }>;
+    setMaintenanceMode: (actor: BackofficeClaims, requiredPermission: "workspace:edit", input: {
+      workspaceNames: string[];
+      maintenanceMode: MaintenanceMode;
+    }) => Promise<{
+      maintenanceMode: MaintenanceMode;
+      totalCount: number;
+      changedCount: number;
+    }>;
+  };
+  onboardings: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      step?: OnboardingStep | OnboardingStep[];
+      hsmHostingMode?: HsmHostingMode;
+      sortBy: "workspaceName" | "step" | "createdAt" | "completedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        claimedDevices: {
+          id: string;
+          onboardingId: string;
+          pubKey: string;
+          deviceUserId: string;
+          deviceName: string;
+          role: ClaimedRole;
+          claimedAt: Date;
+        }[];
+        users: ({
+          reviewByMasterAdmin: {
+            id: string;
+            reviewerId: string;
+            challenge: import("@prisma/client/runtime/client").JsonValue;
+            signature: string | null;
+          } | null;
+          reviewBySharedOwner: {
+            id: string;
+            reviewerId: string;
+            seedChallenge: import("@prisma/client/runtime/client").JsonValue;
+            seedFragment: import("@prisma/client/runtime/client").JsonValue;
+          } | null;
+          reviewOfExternalSigners: {
+            id: string;
+            reviewerId: string;
+            challenge: import("@prisma/client/runtime/client").JsonValue;
+            signature: string | null;
+          } | null;
+        } & {
+          id: string;
+          onboardingId: string;
+          name: string;
+          role: OnboardedUserRole;
+          psdModel: PsdModel;
+          pubKey: string;
+          deviceUserId: string;
+          u2fKeyHandle: string | null;
+          u2fPubKey: string | null;
+          registrationChallenge: import("@prisma/client/runtime/client").JsonValue;
+          registrationResponse: import("@prisma/client/runtime/client").JsonValue;
+          createdAt: Date;
+        })[];
+        wrappingKey: ({
+          fragments: {
+            id: string;
+            wrappingKeyId: string;
+            pubKey: string;
+            ephemeralPubKey: string;
+            ephemeralCertificate: import("@prisma/client/runtime/client").JsonValue;
+            blob: string;
+          }[];
+        } & {
+          id: string;
+          onboardingId: string;
+          ephemeralPubKey: string;
+          ephemeralCertificate: import("@prisma/client/runtime/client").JsonValue;
+        }) | null;
+      } & {
+        id: string;
+        workspaceName: string;
+        mode: RevaultMode;
+        compartmentId: number;
+        targetHsmName: string;
+        hsmHostingMode: HsmHostingMode;
+        step: OnboardingStep;
+        isLocked: boolean;
+        createdAt: Date;
+        completedAt: Date | null;
+      })[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__OnboardingClient<({
+      claimedDevices: {
+        id: string;
+        onboardingId: string;
+        pubKey: string;
+        deviceUserId: string;
+        deviceName: string;
+        role: ClaimedRole;
+        claimedAt: Date;
+      }[];
+      users: ({
+        reviewByMasterAdmin: {
+          id: string;
+          reviewerId: string;
+          challenge: import("@prisma/client/runtime/client").JsonValue;
+          signature: string | null;
+        } | null;
+        reviewBySharedOwner: {
+          id: string;
+          reviewerId: string;
+          seedChallenge: import("@prisma/client/runtime/client").JsonValue;
+          seedFragment: import("@prisma/client/runtime/client").JsonValue;
+        } | null;
+        reviewOfExternalSigners: {
+          id: string;
+          reviewerId: string;
+          challenge: import("@prisma/client/runtime/client").JsonValue;
+          signature: string | null;
+        } | null;
+      } & {
+        id: string;
+        onboardingId: string;
+        name: string;
+        role: OnboardedUserRole;
+        psdModel: PsdModel;
+        pubKey: string;
+        deviceUserId: string;
+        u2fKeyHandle: string | null;
+        u2fPubKey: string | null;
+        registrationChallenge: import("@prisma/client/runtime/client").JsonValue;
+        registrationResponse: import("@prisma/client/runtime/client").JsonValue;
+        createdAt: Date;
+      })[];
+      wrappingKey: ({
+        fragments: {
+          id: string;
+          wrappingKeyId: string;
+          pubKey: string;
+          ephemeralPubKey: string;
+          ephemeralCertificate: import("@prisma/client/runtime/client").JsonValue;
+          blob: string;
+        }[];
+      } & {
+        id: string;
+        onboardingId: string;
+        ephemeralPubKey: string;
+        ephemeralCertificate: import("@prisma/client/runtime/client").JsonValue;
+      }) | null;
+    } & {
+      id: string;
+      workspaceName: string;
+      mode: RevaultMode;
+      compartmentId: number;
+      targetHsmName: string;
+      hsmHostingMode: HsmHostingMode;
+      step: OnboardingStep;
+      isLocked: boolean;
+      createdAt: Date;
+      completedAt: Date | null;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+    create: (actor: BackofficeClaims, requiredPermission: "onboarding:create", input: Parameters<typeof startOnboarding>[1]) => Promise<{
+      id: string;
+      workspaceName: string;
+      hsmHostingMode: "HOSTED" | "ON_PREM";
+      step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+      claimedDevices: {
+        pubKey: string;
+        deviceUserId: string;
+        deviceName: string;
+        role: "MASTER_ADMIN" | "SHARED_OWNER" | "WRAPPING_KEY_OWNER";
+      }[];
+      wrappingKey: {
+        ephemeralPubKey: string;
+        ephemeralCertificate: HsmCertificate;
+        fragments: {
+          pubKey: string;
+          ephemeralPubKey: string;
+          ephemeralCertificate: HsmCertificate;
+          blob: string;
+        }[];
+      } | null;
+      masterAdmins: {
+        name: string;
+        psdModel: "STAX";
+        pubKey: string;
+        registrationChallenge: {
+          challenge: string;
+          ephemeralPublicKey: string;
+          ephemeralPublicKeyAttestation: HsmCertificate;
+          handshake: string;
+          handshakeAttestation: HsmCertificate;
+          u2fRegisterData: string;
+          ciphertext: string;
+          requestId: string;
+        };
+        registrationResponse: {
+          certificate: HsmCertificate;
+          u2fRegister: string;
+          u2fKeyHandle: string;
+          registerData: string;
+          validationKey: string;
+          pairingPayload: string;
+        } | null;
+        role: "MASTER_ADMIN";
+        review: {
+          challenge: {
+            challengeType: "PSD";
+            wActions: string[];
+            handshake: string;
+            handshakeAttestation: HsmCertificate;
+            partitionId: string;
+          };
+          signature: string | null;
+        } | null;
+        reviewOfExternalSigners: {
+          challenge: {
+            challengeType: "PSD";
+            wActions: string[];
+            handshake: string;
+            handshakeAttestation: HsmCertificate;
+            partitionId: string;
+          };
+          signature: string | null;
+        } | null;
+      }[];
+      sharedOwners: {
+        name: string;
+        psdModel: "STAX";
+        pubKey: string;
+        registrationChallenge: {
+          challenge: string;
+          ephemeralPublicKey: string;
+          ephemeralPublicKeyAttestation: HsmCertificate;
+          handshake: string;
+          handshakeAttestation: HsmCertificate;
+          u2fRegisterData: string;
+          ciphertext: string;
+          requestId: string;
+        };
+        registrationResponse: {
+          certificate: HsmCertificate;
+          u2fRegister: string;
+          u2fKeyHandle: string;
+          registerData: string;
+          validationKey: string;
+          pairingPayload: string;
+        } | null;
+        role: "SHARED_OWNER";
+        review: {
+          seedChallenge: {
+            challengeType: "PSD";
+            wActions: string[];
+            handshake: string;
+            handshakeAttestation: HsmCertificate;
+            partitionId: string;
+            kkHandshake: string;
+            kkHandshakeAttestation: HsmCertificate;
+            ephemeralPublicKey: string;
+            certificate: HsmCertificate;
+            blob: string;
+          };
+          seedFragment: {
+            approverBlob: string;
+            challengeResponse: string;
+            handshake: string;
+            handshakeAttestation: HsmCertificate;
+          } | null;
+        } | null;
+      }[];
+      createdAt: Date;
+      completedAt: Date | null;
+    }>;
+  };
+  requests: {
+    list: (filters: Omit<RequestListFilters, "visibility">) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: RequestView[];
+    }>;
+    find: (id: string) => Promise<RequestView | null>;
+    restart: (actor: BackofficeClaims, requiredPermission: "request:restart", id: string) => Promise<void>;
+    expire: (actor: BackofficeClaims, requiredPermission: "request:expire", id: string) => Promise<void>;
+  };
+  webhooks: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      status?: WebhookStatus$1;
+      search?: string;
+      statsWindowDays: number;
+    }) => Promise<{
+      page: {
+        page: number;
+        next: number | null;
+        prev: number | null;
+        pageSize: number;
+        total: number;
+        results: ({
+          rules: {
+            id: string;
+            webhookId: string;
+            actions: EventAction$1[];
+            requestTypes: RequestType$1[];
+            createdAt: Date;
+          }[];
+          scopeUsers: {
+            id: string;
+            workspaceName: string;
+            name: string;
+            authUserId: string | null;
+            pubKey: string;
+            deviceType: UserDeviceType;
+            deviceUserId: string | null;
+            hsmId: string | null;
+            u2fKeyHandle: string | null;
+            u2fPubKey: string | null;
+            legacyViewAll: boolean;
+            role: UserRole;
+            status: ActivationStatus$1;
+            isSuspended: boolean;
+            gateType: GateUserType | null;
+            gateId: number;
+            syncId: string;
+            createdAt: Date;
+            updatedAt: Date;
+          }[];
+        } & {
+          id: string;
+          workspaceName: string;
+          name: string;
+          description: string | null;
+          url: string;
+          status: WebhookStatus$1;
+          retryStrategy: WebhookRetryStrategy$1;
+          maxRetries: number;
+          initialIntervalMs: number;
+          consecutiveFailures: number;
+          brokenSince: Date | null;
+          createdAt: Date;
+          updatedAt: Date;
+        })[];
+      };
+      stats: Map<string, WebhookDeliveryStats>;
+    }>;
+  };
+  hsm: {
+    compareWorkspace: (input: {
+      workspaceName: string;
+      comparator: HsmComparator;
+    }) => Promise<HsmWorkspaceComparison>;
+  };
+  relationships: {
+    dryRun: (input: {
+      workspaceName: string;
+      shapeLimit: number;
+    }) => Promise<{
+      workspaceName: string;
+      dryRun: true;
+      rawTupleCount: number;
+      uniqueTupleCount: number;
+      duplicateTupleCount: number;
+      buildDurationMs: number;
+      shapeCounts: RelationshipShapeCount[];
+    }>;
+    materialize: (actor: BackofficeClaims, requiredPermission: "workspace:edit", input: {
+      workspaceName: string;
+      confirm: string;
+    }) => Promise<{
+      rawTupleCount: number;
+      uniqueTupleCount: number;
+      currentTupleCount: number;
+      buildDurationMs: number;
+      writeDurationMs: number;
+      totalDurationMs: number;
+      workspaceName: string;
+    }>;
+    health: (input: {
+      workspaceName: string;
+      shapeLimit: number;
+    }) => Promise<RelationshipHealth>;
+    driftCheck: (input: {
+      workspaceName: string;
+      sampleLimit: number;
+    }) => Promise<RelationshipDriftCheck>;
+  };
+};
+interface RuntimeInternalCapabilities extends ReturnType<typeof createInternalCapabilities> {}
+/**
+ * Request capability provider for the *internal* HTTP context: the full public provider plus the
+ * administration bucket, exposed at `ctx.core.administration`. Its {@link forReadOnlyRequest}
+ * rebinds the *entire* internal set (public + admin) onto the write-rejecting Prisma extension, so
+ * a read-only (backoffice impersonation, ADR-0012) session cannot mutate through any capability.
+ */
+interface RuntimeInternalApiCapabilityProvider extends RuntimeApiCapabilities {
+  administration: RuntimeInternalCapabilities;
+  forReadOnlyRequest: () => RuntimeInternalApiCapabilityProvider;
+}
+//#endregion
 //#region src/core/workspaces/schemas.d.ts
 declare const zWorkspaceName: z.ZodString;
 //#endregion
@@ -13,7 +1397,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
     debugAuthToken?: string;
     rootAuthToken?: string;
     backofficeRequiredPermission?: BackofficePermission;
-    prisma: ExtendedPrismaClient;
     io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
     user: {
       id: string;
@@ -28,7 +1411,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       u2fPubKey: string | null;
       legacyViewAll: boolean;
       role: UserRole;
-      status: ActivationStatus;
+      status: ActivationStatus$1;
       isSuspended: boolean;
       gateType: GateUserType | null;
       gateId: number;
@@ -39,28 +1422,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
     authorization: string | null;
     readOnly: boolean;
     activityTracer: ActivityTracer;
-    core: RuntimeApiCapabilities;
+    core: RuntimeInternalApiCapabilityProvider;
   };
-  meta: {
-    [x: string]: unknown;
-  } & {
-    openapi?: {
-      enabled?: boolean;
-      method: import("trpc-to-openapi").OpenApiMethod;
-      path: `/${string}`;
-      operationId?: string;
-      summary?: string;
-      description?: string;
-      protect?: boolean;
-      tags?: string[];
-      contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-      deprecated?: boolean;
-      requestHeaders?: import("zod").ZodObject;
-      responseHeaders?: import("zod").ZodObject;
-      successDescription?: string;
-      errorResponses?: number[] | Record<number, string>;
-    };
-  } & RateLimitMetricsMeta & BackofficePermissionMeta;
+  meta: TrpcMeta;
   errorShape: {
     message: string;
     code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -83,7 +1447,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       debugAuthToken?: string;
       rootAuthToken?: string;
       backofficeRequiredPermission?: BackofficePermission;
-      prisma: ExtendedPrismaClient;
       io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
       user: {
         id: string;
@@ -98,7 +1461,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         u2fPubKey: string | null;
         legacyViewAll: boolean;
         role: UserRole;
-        status: ActivationStatus;
+        status: ActivationStatus$1;
         isSuspended: boolean;
         gateType: GateUserType | null;
         gateId: number;
@@ -109,28 +1472,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       authorization: string | null;
       readOnly: boolean;
       activityTracer: ActivityTracer;
-      core: RuntimeApiCapabilities;
+      core: RuntimeInternalApiCapabilityProvider;
     };
-    meta: {
-      [x: string]: unknown;
-    } & {
-      openapi?: {
-        enabled?: boolean;
-        method: import("trpc-to-openapi").OpenApiMethod;
-        path: `/${string}`;
-        operationId?: string;
-        summary?: string;
-        description?: string;
-        protect?: boolean;
-        tags?: string[];
-        contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-        deprecated?: boolean;
-        requestHeaders?: import("zod").ZodObject;
-        responseHeaders?: import("zod").ZodObject;
-        successDescription?: string;
-        errorResponses?: number[] | Record<number, string>;
-      };
-    } & RateLimitMetricsMeta & BackofficePermissionMeta;
+    meta: TrpcMeta;
     errorShape: {
       message: string;
       code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -152,26 +1496,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         groups: string[];
         permissions: ("backoffice:read" | "impersonation:list" | "impersonation:request" | "impersonation:revoke" | "onboarding:create" | "request:expire" | "request:restart" | "workspace:edit")[];
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
     workspaces: import("@trpc/server").TRPCBuiltRouter<{
       ctx: {
@@ -181,7 +1506,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -196,7 +1520,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -207,28 +1531,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -269,31 +1574,12 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             createdAt: Date;
             updatedAt: Date;
           } & {
-            status: ActivationStatus;
+            status: ActivationStatus$1;
             maintenanceMode: MaintenanceMode;
             oidcConfig: import("zod").output<typeof zOidcConfig> | null;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -317,26 +1603,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             realm: string;
           } | null;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       setMaintenanceMode: import("@trpc/server").TRPCMutationProcedure<{
         input: {
@@ -349,26 +1616,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           totalCount: number;
           changedCount: number;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       edit: import("@trpc/server").TRPCMutationProcedure<{
         input: {
@@ -400,26 +1648,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             realm: string;
           } | null;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     onboardings: import("@trpc/server").TRPCBuiltRouter<{
@@ -430,7 +1659,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -445,7 +1673,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -456,28 +1684,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -513,7 +1722,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             workspaceName: string;
             hsmHostingMode: "HOSTED" | "ON_PREM";
             step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
-            skipWrappingKey: boolean;
             claimedDevices: {
               pubKey: string;
               deviceUserId: string;
@@ -626,26 +1834,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             targetHsmName: string;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -656,7 +1845,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmHostingMode: "HOSTED" | "ON_PREM";
           step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
-          skipWrappingKey: boolean;
           claimedDevices: {
             pubKey: string;
             deviceUserId: string;
@@ -768,26 +1956,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           compartmentId: number;
           targetHsmName: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       create: import("@trpc/server").TRPCMutationProcedure<{
         input: {
@@ -802,7 +1971,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmHostingMode: "HOSTED" | "ON_PREM";
           step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
-          skipWrappingKey: boolean;
           claimedDevices: {
             pubKey: string;
             deviceUserId: string;
@@ -910,26 +2078,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           createdAt: Date;
           completedAt: Date | null;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     impersonations: import("@trpc/server").TRPCBuiltRouter<{
@@ -940,7 +2089,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -955,7 +2103,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -966,28 +2114,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1011,52 +2140,14 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           code: string;
           impersonationId: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       revoke: import("@trpc/server").TRPCMutationProcedure<{
         input: {
           impersonationId: string;
         };
         output: void;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       listActive: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1072,26 +2163,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           startedAt: Date;
           expiresAt: Date;
         }[];
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     users: import("@trpc/server").TRPCBuiltRouter<{
@@ -1102,7 +2174,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -1117,7 +2188,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1128,28 +2199,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1200,26 +2252,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             updatedAt: Date;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1240,26 +2273,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           createdAt: Date;
           updatedAt: Date;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     userRegistrations: import("@trpc/server").TRPCBuiltRouter<{
@@ -1270,7 +2284,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -1285,7 +2298,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1296,28 +2309,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1358,26 +2352,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             state: "COMPLETED" | "CONSUMED" | "INITIAL" | "PENDING";
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1392,26 +2367,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           state: "COMPLETED" | "CONSUMED" | "INITIAL" | "PENDING";
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     accounts: import("@trpc/server").TRPCBuiltRouter<{
@@ -1422,7 +2378,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -1437,7 +2392,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1448,28 +2403,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1491,32 +2427,14 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           name: string;
           ticker?: string | undefined;
         }[];
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       list: import("@trpc/server").TRPCQueryProcedure<{
         input: {
           page?: number | undefined;
           pageSize?: number | undefined;
           workspaceName?: string | string[] | undefined;
+          workspaceNames?: string[] | undefined;
           status?: "ACTIVE" | "INACTIVE" | undefined;
           id?: string | undefined;
           name?: string | undefined;
@@ -1527,6 +2445,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           index?: number | undefined;
           contractAddress?: string | null | undefined;
           support?: "legacy" | "standalone" | undefined;
+          lesWalletRegistrable?: boolean | undefined;
+          addressBackfillable?: boolean | undefined;
+          gateSynced?: boolean | undefined;
           type?: "BITCOIN_LIKE" | "CANTON_LIKE" | "CARDANO_LIKE" | "ETHEREUM_LIKE" | "GENERIC_LIKE" | "HEDERA_LIKE" | "POLKADOT_LIKE" | "RAW_SIGNING" | "RIPPLE_LIKE" | "SOLANA_LIKE" | "STELLAR_LIKE" | "SUI_LIKE" | "TEZOS_LIKE" | "TRON_LIKE" | undefined;
           policyIds?: string[] | undefined;
           entityIds?: string[] | undefined;
@@ -1617,26 +2538,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             hsmId: string;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1718,26 +2620,32 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           lesWalletId: string | null;
           hsmId: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
+      }>;
+      lesWalletRegistrableSummary: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+          workspaceNames?: string[] | undefined;
+          currencies?: string[] | undefined;
+          target?: "ADDRESS" | "LES_WALLET_ID" | undefined;
+        };
+        output: {
+          total: number;
+          byCurrency: {
+            currency: string;
+            count: number;
+          }[];
+        };
+        meta: TrpcMeta;
+      }>;
+      registerOnLesWallet: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+          workspaceNames?: string[] | undefined;
+          currencies?: string[] | undefined;
+          target?: "ADDRESS" | "LES_WALLET_ID" | undefined;
+          limit: number;
+        };
+        output: LesWalletRegistrationReport;
+        meta: TrpcMeta;
       }>;
     }>>;
     groups: import("@trpc/server").TRPCBuiltRouter<{
@@ -1748,7 +2656,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -1763,7 +2670,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1774,28 +2681,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1855,26 +2743,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             hsmId: string;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1907,26 +2776,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmId: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     whitelists: import("@trpc/server").TRPCBuiltRouter<{
@@ -1937,7 +2787,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -1952,7 +2801,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1963,28 +2812,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2039,26 +2869,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             hsmId: string;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -2084,26 +2895,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmId: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     webhooks: import("@trpc/server").TRPCBuiltRouter<{
@@ -2114,7 +2906,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -2129,7 +2920,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2140,28 +2931,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2220,26 +2992,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             workspaceName: string;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     policies: import("@trpc/server").TRPCBuiltRouter<{
@@ -2250,7 +3003,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -2265,7 +3017,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2276,28 +3028,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2390,26 +3123,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmId: string | null;
         } | null;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       list: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -2529,26 +3243,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             hsmId: string | null;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -2628,26 +3323,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmId: string | null;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     workspaceRules: import("@trpc/server").TRPCBuiltRouter<{
@@ -2658,7 +3334,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -2673,7 +3348,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2684,28 +3359,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2745,26 +3401,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             workspaceName: import("zod").output<typeof zWorkspaceName>;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     reports: import("@trpc/server").TRPCBuiltRouter<{
@@ -2775,7 +3412,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -2790,7 +3426,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2801,28 +3437,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2890,26 +3507,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             workspaceName: import("zod").output<typeof zWorkspaceName>;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -2950,26 +3548,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         })) & {
           workspaceName: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     requests: import("@trpc/server").TRPCBuiltRouter<{
@@ -2980,7 +3559,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -2995,7 +3573,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -3006,28 +3584,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -3069,26 +3628,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             workspaceName: import("zod").output<typeof zWorkspaceName>;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -4679,78 +5219,21 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         }) & {
           workspaceName: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       restart: import("@trpc/server").TRPCMutationProcedure<{
         input: {
           id: string;
         };
         output: void;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       expire: import("@trpc/server").TRPCMutationProcedure<{
         input: {
           id: string;
         };
         output: void;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     relationships: import("@trpc/server").TRPCBuiltRouter<{
@@ -4761,7 +5244,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -4776,7 +5258,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -4787,28 +5269,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -4843,26 +5306,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             count: number;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       materialize: import("@trpc/server").TRPCMutationProcedure<{
         input: {
@@ -4878,26 +5322,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           writeDurationMs: number;
           totalDurationMs: number;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       health: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -4919,26 +5344,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             count: number;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       driftCheck: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -4978,26 +5384,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           compareDurationMs: number;
           totalDurationMs: number;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     auditLogs: import("@trpc/server").TRPCBuiltRouter<{
@@ -5008,7 +5395,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -5023,7 +5409,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -5034,28 +5420,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -5095,26 +5462,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             createdAt: Date;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5127,26 +5475,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           payload: unknown;
           createdAt: Date;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     auditTrail: import("@trpc/server").TRPCBuiltRouter<{
@@ -5157,7 +5486,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -5172,7 +5500,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -5183,28 +5511,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -5241,26 +5550,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           hasMore: boolean;
           capped: boolean;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       requestFailures: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5280,26 +5570,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           hasMore: boolean;
           capped: boolean;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       getEvent: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5313,26 +5584,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           contentType: string;
           decoded: boolean;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     hsmRequests: import("@trpc/server").TRPCBuiltRouter<{
@@ -5343,7 +5595,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         debugAuthToken?: string;
         rootAuthToken?: string;
         backofficeRequiredPermission?: BackofficePermission;
-        prisma: ExtendedPrismaClient;
         io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
         user: {
           id: string;
@@ -5358,7 +5609,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -5369,28 +5620,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         authorization: string | null;
         readOnly: boolean;
         activityTracer: ActivityTracer;
-        core: RuntimeApiCapabilities;
+        core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -5416,26 +5648,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           total_objects: number;
           objects_report: Record<string, number>;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       objectsInfo: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5469,26 +5682,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           }[];
           objects_missing_merkle_tree_id: string[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       objectsContent: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5505,26 +5699,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           object_contents: unknown[];
           objects_missing_merkle_tree_id: string[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       compareWithHsm: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5532,26 +5707,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           comparator: "whitelists" | "workspace-name";
         };
         output: HsmWorkspaceComparison;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
   }>>;
@@ -5563,7 +5719,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       debugAuthToken?: string;
       rootAuthToken?: string;
       backofficeRequiredPermission?: BackofficePermission;
-      prisma: ExtendedPrismaClient;
       io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
       user: {
         id: string;
@@ -5578,7 +5733,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         u2fPubKey: string | null;
         legacyViewAll: boolean;
         role: UserRole;
-        status: ActivationStatus;
+        status: ActivationStatus$1;
         isSuspended: boolean;
         gateType: GateUserType | null;
         gateId: number;
@@ -5589,28 +5744,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       authorization: string | null;
       readOnly: boolean;
       activityTracer: ActivityTracer;
-      core: RuntimeApiCapabilities;
+      core: RuntimeInternalApiCapabilityProvider;
     };
-    meta: {
-      [x: string]: unknown;
-    } & {
-      openapi?: {
-        enabled?: boolean;
-        method: import("trpc-to-openapi").OpenApiMethod;
-        path: `/${string}`;
-        operationId?: string;
-        summary?: string;
-        description?: string;
-        protect?: boolean;
-        tags?: string[];
-        contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-        deprecated?: boolean;
-        requestHeaders?: import("zod").ZodObject;
-        responseHeaders?: import("zod").ZodObject;
-        successDescription?: string;
-        errorResponses?: number[] | Record<number, string>;
-      };
-    } & RateLimitMetricsMeta & BackofficePermissionMeta;
+    meta: TrpcMeta;
     errorShape: {
       message: string;
       code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -7225,26 +7361,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           }[] | undefined;
         })[];
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
     updateReportTaskResult: import("@trpc/server").TRPCMutationProcedure<{
       input: {
@@ -7264,26 +7381,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         generationTaskId: string;
         status: "COMPLETED" | "DELETED" | "FAILED" | "INITIAL" | "PURGED" | "SCHEDULED";
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
   }>>;
   workspaces: import("@trpc/server").TRPCBuiltRouter<{
@@ -7294,7 +7392,6 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       debugAuthToken?: string;
       rootAuthToken?: string;
       backofficeRequiredPermission?: BackofficePermission;
-      prisma: ExtendedPrismaClient;
       io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
       user: {
         id: string;
@@ -7309,7 +7406,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         u2fPubKey: string | null;
         legacyViewAll: boolean;
         role: UserRole;
-        status: ActivationStatus;
+        status: ActivationStatus$1;
         isSuspended: boolean;
         gateType: GateUserType | null;
         gateId: number;
@@ -7320,28 +7417,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       authorization: string | null;
       readOnly: boolean;
       activityTracer: ActivityTracer;
-      core: RuntimeApiCapabilities;
+      core: RuntimeInternalApiCapabilityProvider;
     };
-    meta: {
-      [x: string]: unknown;
-    } & {
-      openapi?: {
-        enabled?: boolean;
-        method: import("trpc-to-openapi").OpenApiMethod;
-        path: `/${string}`;
-        operationId?: string;
-        summary?: string;
-        description?: string;
-        protect?: boolean;
-        tags?: string[];
-        contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-        deprecated?: boolean;
-        requestHeaders?: import("zod").ZodObject;
-        responseHeaders?: import("zod").ZodObject;
-        successDescription?: string;
-        errorResponses?: number[] | Record<number, string>;
-      };
-    } & RateLimitMetricsMeta & BackofficePermissionMeta;
+    meta: TrpcMeta;
     errorShape: {
       message: string;
       code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -7365,26 +7443,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         createdAt: Date;
         updatedAt: Date;
       }[];
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
     findByName: import("@trpc/server").TRPCQueryProcedure<{
       input: {
@@ -7397,26 +7456,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         createdAt: Date;
         updatedAt: Date;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
   }>>;
 }>>;