@ledgerhq/revault-api 1.85.0 → 1.87.0

package/lib/{internal → entrypoints/internal-api}/app-lib.d.mts

@@ -1,6 +1,1563 @@
-import { Er as zOidcConfig, F as RuntimeInternalApiCapabilityProvider, I as RateLimitMetricsMeta, P as BackofficePermissionMeta, Sa as SendOnlyTransactionData, Tn as UserRole, X as BackofficePermission, Y as ActivityTracer, ai as HsmCertificate, bo as HsmWorkspaceComparison, cn as GateUserType, it as VaultRequestResponse, nn as ActivationStatus, po as Note, tt as RequestReview, un as MaintenanceMode, wa as TransactionData, wn as UserDeviceType } from "../app-lib-D-2gZGYR.mjs";
+import { $a as AccountGovernanceType, Ao as RevaultMode, Ci as startOnboarding, Co as PsdModel, Dr as SendOnlyTransactionData, Fa as RequestView, Fo as WebhookRetryStrategy$1, Ha as BackofficeClaims, Io as WebhookStatus$1, Ja as ExtendedPrismaClient, Lo as WhitelistType, Mo as UserDeviceType, No as UserRegistrationState, Oo as RequestType$1, Pa as WebhookDeliveryStats, Po as UserRole, Q as ActivityTracer, R as TrpcMeta, Ra as LesWalletRegistrableSummary, Sa as SortOrder, Si as RequestListFilters, To as ReportType$1, Va as LesWalletRegistrationScope, Ya as BackofficePermission, _o as MaintenanceMode, ao as AuditLogType$1, bi as BackofficeAuditLogInput, bo as OnboardingStep, co as EventAction$1, do as GatePolicyType, eo as AccountType$1, fo as GateReviewConfigType, ga as AccountWorkspaceScope, go as HsmHostingMode, ha as AccountAssetFilter, ho as GateWorkspaceRuleType, it as RequestReview, ji as HsmCertificate, jo as ReviewConfigType, kr as TransactionData, lo as GateAccountType, ma as HsmWorkspaceComparison, mo as GateWhitelistType, no as AddressDerivationMode, po as GateUserType, qa as zOidcConfig, ro as AdminPermission$1, so as ClaimedRole, st as VaultRequestResponse, to as ActivationStatus$1, ua as HsmComparator, uo as GateGroupType, wo as ReportStatus$1, xi as WhitelistSortBy, xo as OutgoingTransactionStatus, yi as Note, yo as OnboardedUserRole, z as RuntimeApiCapabilities, za as LesWalletRegistrationReport } from "../../app-lib-3Twpit5H.mjs";
 import z from "zod";
+import { Account, AllowedAction, Prisma, PrismaClient, ReviewConfig, VaultRequestReview, Workspace } from "@/generated/prisma/client";
 import "trpc-to-openapi";
+//#region src/core/rebac/relationship-tuples.d.ts
+declare const RELATIONSHIP_OBJECT_TYPES: {
+  readonly account: "account";
+  readonly entity: "entity";
+  readonly group: "group";
+  readonly policy: "policy";
+  readonly portfolio: "portfolio";
+  readonly tradelinkCustodian: "tradelink-custodian";
+  readonly tradelinkEntity: "tradelink-entity";
+  readonly tradelinkPledge: "tradelink-pledge";
+  readonly user: "user";
+  readonly whitelist: "whitelist";
+  readonly workspace: "workspace";
+  readonly workspaceRule: "workspace-rule";
+};
+type RelationshipObjectType = (typeof RELATIONSHIP_OBJECT_TYPES)[keyof typeof RELATIONSHIP_OBJECT_TYPES];
+declare const RELATIONSHIP_RELATIONS: {
+  readonly entity: "entity";
+  readonly member: "member";
+  readonly policy: "policy";
+  readonly portfolio: "portfolio";
+  readonly reader: "reader";
+  readonly tradelinkAssetManager: "tradelink:asset-manager";
+  readonly tradelinkCustodian: "tradelink:custodian";
+  readonly tradelinkExchange: "tradelink:exchange";
+  readonly tradelinkRepledgeExchange: "tradelink:repledge-exchange";
+};
+declare const DIRECT_SUBJECT_RELATION = "";
+type OperatorRelation = `operator:${AllowedAction}`;
+type RelationshipRelation = (typeof RELATIONSHIP_RELATIONS)[keyof typeof RELATIONSHIP_RELATIONS] | OperatorRelation;
+type RelationshipSubjectRelation = typeof DIRECT_SUBJECT_RELATION | typeof RELATIONSHIP_RELATIONS.member;
+/**
+ * Authorization-graph fact in Zanzibar/ReBAC vocabulary:
+ *
+ *   object#relation@subject
+ *
+ * plus Revault source attribution for deterministic source replacement:
+ *
+ *   object#relation@subject [source]
+ *
+ * This is not a TypeScript tuple (`[A, B]`). The persisted table stores each component in a
+ * dedicated string column so rows can be indexed, rebuilt, and compared deterministically.
+ */
+type RelationshipTuple = {
+  workspaceName: string;
+  objectType: RelationshipObjectType;
+  objectId: string;
+  relation: RelationshipRelation;
+  subjectType: RelationshipObjectType;
+  subjectId: string;
+  subjectRelation: RelationshipSubjectRelation;
+  sourceType: RelationshipObjectType;
+  sourceId: string;
+};
+//#endregion
+//#region src/core/relationships/inspection.d.ts
+type RelationshipShapeCount = {
+  objectType: string;
+  relation: string;
+  subjectType: string;
+  subjectRelation: string;
+  count: number;
+};
+type RelationshipSourceTypeCount = {
+  sourceType: string;
+  count: number;
+};
+type RelationshipHealth = {
+  workspaceName: string;
+  currentTupleCount: number;
+  sourceTypeCounts: RelationshipSourceTypeCount[];
+  shapeCounts: RelationshipShapeCount[];
+};
+type RelationshipDriftCheck = {
+  workspaceName: string;
+  expectedTupleCount: number;
+  actualTupleCount: number;
+  missingTupleCount: number;
+  extraTupleCount: number;
+  missingSamples: RelationshipTuple[];
+  extraSamples: RelationshipTuple[];
+  buildDurationMs: number;
+  readDurationMs: number;
+  compareDurationMs: number;
+  totalDurationMs: number;
+};
+//#endregion
+//#region src/services/configcat-management/types.d.ts
+type ConfigCatManagementLocation = {
+  productId: string;
+  configId: string;
+};
+type ConfigCatSettingType = "boolean" | "string" | "int" | "double";
+type PromotionValueType = "boolean" | "string" | "number" | "json";
+type ConfigCatScalarValue = boolean | string | number;
+type ConfigCatFlag = {
+  settingId: number;
+  key: string;
+  name: string;
+  settingType: ConfigCatSettingType;
+  valueType: PromotionValueType;
+  isJson: boolean;
+  hint?: string | null;
+  order?: number | null;
+  hasTags: boolean;
+  hasPredefinedVariations: boolean;
+};
+type ConfigCatManagement = {
+  listFlags: (location: ConfigCatManagementLocation) => Promise<ConfigCatFlag[]>;
+  listEnvironmentIds: (location: ConfigCatManagementLocation) => Promise<string[]>;
+  readSimpleValues: (location: ConfigCatManagementLocation, flags: ConfigCatFlag[]) => Promise<Map<number, ConfigCatScalarValue | null>>;
+  createFlag: (opts: {
+    target: ConfigCatManagementLocation;
+    targetEnvironmentIds: string[];
+    sourceFlag: ConfigCatFlag;
+    value: ConfigCatScalarValue;
+  }) => Promise<void>;
+};
+//#endregion
+//#region src/core/administration/feature-flag-promotions/types.d.ts
+type ConfigCatPromotionEnvironmentConfig = {
+  slug: string;
+  displayName: string;
+  productId: string;
+  configId: string;
+};
+type FlagEnvironment = {
+  slug: string;
+  displayName: string;
+  order: number;
+};
+type PromotionTargetSelection = {
+  flagKey: string;
+  targetEnv: string;
+};
+type PromotionBlockerCode = "ENVIRONMENT_NOT_CONFIGURED" | "TARGET_NOT_AFTER_SOURCE" | "SELECTED_FLAG_ALREADY_EXISTS" | "SOURCE_FLAG_NOT_FOUND" | "UNSUPPORTED_FLAG" | "CONFIGCAT_UNAVAILABLE" | "EXTERNAL_WRITE_FAILED" | "EXTERNAL_WRITE_OUTCOME_UNKNOWN";
+type PromotionBlocker = {
+  code: PromotionBlockerCode;
+  severity: "blocking";
+  sourceEnv: string;
+  targetEnv?: string;
+  flagKey?: string;
+  message: string;
+};
+type PromotionCreate = {
+  sourceEnv: string;
+  targetEnv: string;
+  flagKey: string;
+  flagName: string;
+  valueType: PromotionValueType;
+};
+type MatrixOutput = {
+  environments: FlagEnvironment[];
+  sourceEnv: string;
+  rows: Array<{
+    flagKey: string;
+    flagName: string;
+    valueType: PromotionValueType;
+    cells: Record<string, {
+      state: "source" | "present" | "missing" | "blocked" | "notAllowed";
+      summary: string;
+      blockers: PromotionBlocker[];
+    }>;
+  }>;
+  summary: {
+    promotableCells: number;
+    blockedCells: number;
+    alignedFlags: number;
+  };
+  fetchedAt: string;
+};
+type ApplyOutput = {
+  attemptId: string;
+  status: "applied" | "blocked" | "failed" | "partiallyApplied";
+  created: PromotionCreate[];
+  notAttempted: PromotionCreate[];
+  blockers: PromotionBlocker[];
+};
+//#endregion
+//#region src/core/administration/feature-flag-promotions/capability.d.ts
+type PromoteInput = {
+  sourceEnv: string;
+  selections: PromotionTargetSelection[];
+  operatorReason?: string;
+  actor: BackofficeClaims;
+};
+type FeatureFlagPromotions = {
+  matrix: (input: {
+    sourceEnv?: string;
+  }) => Promise<MatrixOutput>;
+  promote: (input: PromoteInput) => Promise<ApplyOutput>;
+};
+//#endregion
+//#region src/core/runtime/internal-capabilities.d.ts
+/**
+ * Least-privilege split (ADR-0022): capabilities that must never be reachable from the *public*
+ * HTTP context live here, not in {@link createApiCoreCapabilities}. Only the internal-API transport
+ * (backoffice) mounts them, so a public procedure's `ctx.core` cannot see — or type-resolve — the
+ * administration surface. New non-public internal capabilities belong in this bucket too.
+ */
+type InternalCapabilityDependencies = {
+  configCatManagement?: ConfigCatManagement;
+  configCatPromotionEnvironments?: ConfigCatPromotionEnvironmentConfig[];
+};
+declare const createInternalCapabilities: (prisma: ExtendedPrismaClient, dependencies?: InternalCapabilityDependencies) => {
+  accounts: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspace: AccountWorkspaceScope;
+      status?: ActivationStatus$1;
+      id?: string;
+      name?: string;
+      governanceType?: AccountGovernanceType;
+      asset?: AccountAssetFilter;
+      support?: "standalone" | "legacy";
+      accountType?: AccountType$1;
+      index?: number;
+      policyIds?: string[];
+      entityIds?: string[];
+      userIds?: string[];
+      groupIds?: string[];
+      lesWalletRegistrable?: boolean;
+      addressBackfillable?: boolean;
+      gateSynced?: boolean;
+      sortBy: "name" | "currency" | "index" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        gateId: number;
+        name: string;
+        asset: {
+          network: string;
+          contractAddress: string | null;
+          tokenIdentifier: string | null;
+        };
+        accountTypeFields: {
+          type: "BITCOIN_LIKE";
+          xpub: string;
+          addressDerivationMode: "NEW" | "STATIC";
+        } | {
+          type: "CANTON_LIKE";
+          address: string | null;
+        } | {
+          type: "CARDANO_LIKE";
+          address: string | null;
+        } | {
+          type: "ETHEREUM_LIKE";
+          address: string | null;
+        } | {
+          type: "GENERIC_LIKE";
+        } | {
+          type: "HEDERA_LIKE";
+          address: string | null;
+          isActivated: boolean;
+        } | {
+          type: "POLKADOT_LIKE";
+          address: string | null;
+        } | {
+          type: "RIPPLE_LIKE";
+          address: string | null;
+        } | {
+          type: "SOLANA_LIKE";
+          address: string | null;
+        } | {
+          type: "STELLAR_LIKE";
+          address: string | null;
+        } | {
+          type: "SUI_LIKE";
+          address: string | null;
+        } | {
+          type: "TEZOS_LIKE";
+          address: string | null;
+        } | {
+          type: "TRON_LIKE";
+          address: string | null;
+        } | {
+          type: "RAW_SIGNING";
+        };
+        index: number;
+        derivationPath: string;
+        lesWalletId: string | null;
+        hsmId: string;
+        status: "ACTIVE" | "INACTIVE";
+        createdAt: Date;
+        updatedAt: Date;
+        governance: {
+          type: "CLASSIC";
+          policyId: string;
+        } | {
+          type: "RAW_SIGNING";
+          policyId: string;
+        } | {
+          type: "TRADELINK";
+          assetManagerId: string;
+          exchangeConfigs: {
+            exchangeId: string;
+            repledgeAuthorized: boolean;
+            needsAssetManagerApprovalForSettlements: boolean;
+          }[];
+        };
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__AccountClient<({
+      classicGovernanceMixin: {
+        id: number;
+        accountId: string;
+        policyId: string;
+      } | null;
+      tradelinkGovernanceMixin: {
+        id: number;
+        accountId: string;
+        assetManagerId: string;
+        status: ActivationStatus$1;
+        exchangeConfigs: import("@prisma/client/runtime/client").JsonValue;
+      } | null;
+    } & {
+      id: string;
+      workspaceName: string;
+      name: string;
+      status: ActivationStatus$1;
+      governanceType: AccountGovernanceType;
+      type: AccountType$1;
+      currency: string;
+      index: number;
+      contractAddress: string | null;
+      tokenIdentifier: string | null;
+      derivationPath: string;
+      bitcoinAddressDerivationMode: AddressDerivationMode | null;
+      hsmId: string;
+      hsmXpub: string;
+      hsmChainCode: string | null;
+      address: string | null;
+      xpub: string | null;
+      lesWalletId: string | null;
+      gateType: GateAccountType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+    lesWalletRegistrableSummary: (scope: LesWalletRegistrationScope) => Promise<LesWalletRegistrableSummary>;
+    registerOnLesWallet: (actor: BackofficeClaims, requiredPermission: "workspace:edit", input: {
+      scope: LesWalletRegistrationScope;
+      limit: number;
+    }) => Promise<LesWalletRegistrationReport>;
+  };
+  users: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      role?: UserRole;
+      deviceType?: UserDeviceType;
+      status?: ActivationStatus$1;
+      id?: string;
+      name?: string;
+      ids?: string[];
+      sortBy: "name" | "role" | "status" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        name: string;
+        authUserId: string | null;
+        pubKey: string;
+        deviceType: UserDeviceType;
+        deviceUserId: string | null;
+        hsmId: string | null;
+        u2fKeyHandle: string | null;
+        u2fPubKey: string | null;
+        legacyViewAll: boolean;
+        role: UserRole;
+        status: ActivationStatus$1;
+        isSuspended: boolean;
+        gateType: GateUserType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__UserClient<{
+      id: string;
+      workspaceName: string;
+      name: string;
+      authUserId: string | null;
+      pubKey: string;
+      deviceType: UserDeviceType;
+      deviceUserId: string | null;
+      hsmId: string | null;
+      u2fKeyHandle: string | null;
+      u2fPubKey: string | null;
+      legacyViewAll: boolean;
+      role: UserRole;
+      status: ActivationStatus$1;
+      isSuspended: boolean;
+      gateType: GateUserType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  userRegistrations: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      role?: "ADMIN" | "OPERATOR";
+      state?: UserRegistrationState;
+      sortBy: "name" | "role" | "state";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        name: string;
+        role: UserRole;
+        psdModel: PsdModel;
+        deviceUserId: string;
+        invitedById: string;
+        pubKey: string | null;
+        challenge: import("@prisma/client/runtime/client").JsonValue;
+        u2fKeyHandle: string | null;
+        u2fPubKey: string | null;
+        state: UserRegistrationState;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__UserRegistrationClient<{
+      id: string;
+      workspaceName: string;
+      name: string;
+      role: UserRole;
+      psdModel: PsdModel;
+      deviceUserId: string;
+      invitedById: string;
+      pubKey: string | null;
+      challenge: import("@prisma/client/runtime/client").JsonValue;
+      u2fKeyHandle: string | null;
+      u2fPubKey: string | null;
+      state: UserRegistrationState;
+      createdAt: Date;
+      updatedAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  groups: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      status?: ActivationStatus$1;
+      id?: string;
+      name?: string;
+      sortBy: "name" | "status" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        members: {
+          id: string;
+          workspaceName: string;
+          name: string;
+          authUserId: string | null;
+          pubKey: string;
+          deviceType: UserDeviceType;
+          deviceUserId: string | null;
+          hsmId: string | null;
+          u2fKeyHandle: string | null;
+          u2fPubKey: string | null;
+          legacyViewAll: boolean;
+          role: UserRole;
+          status: ActivationStatus$1;
+          isSuspended: boolean;
+          gateType: GateUserType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        }[];
+      } & {
+        id: string;
+        workspaceName: string;
+        name: string;
+        description: string | null;
+        hsmId: string;
+        status: ActivationStatus$1;
+        gateType: GateGroupType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__GroupClient<({
+      members: {
+        id: string;
+        workspaceName: string;
+        name: string;
+        authUserId: string | null;
+        pubKey: string;
+        deviceType: UserDeviceType;
+        deviceUserId: string | null;
+        hsmId: string | null;
+        u2fKeyHandle: string | null;
+        u2fPubKey: string | null;
+        legacyViewAll: boolean;
+        role: UserRole;
+        status: ActivationStatus$1;
+        isSuspended: boolean;
+        gateType: GateUserType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    } & {
+      id: string;
+      workspaceName: string;
+      name: string;
+      description: string | null;
+      hsmId: string;
+      status: ActivationStatus$1;
+      gateType: GateGroupType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  policies: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      name?: string;
+      isPrivate: boolean;
+      currency?: string;
+      currencyLess?: boolean;
+      sortBy: "name" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        reviewConfigs: ({
+          groups: ({
+            members: {
+              id: string;
+              workspaceName: string;
+              name: string;
+              authUserId: string | null;
+              pubKey: string;
+              deviceType: UserDeviceType;
+              deviceUserId: string | null;
+              hsmId: string | null;
+              u2fKeyHandle: string | null;
+              u2fPubKey: string | null;
+              legacyViewAll: boolean;
+              role: UserRole;
+              status: ActivationStatus$1;
+              isSuspended: boolean;
+              gateType: GateUserType | null;
+              gateId: number;
+              syncId: string;
+              createdAt: Date;
+              updatedAt: Date;
+            }[];
+          } & {
+            id: string;
+            workspaceName: string;
+            name: string;
+            description: string | null;
+            hsmId: string;
+            status: ActivationStatus$1;
+            gateType: GateGroupType | null;
+            gateId: number;
+            syncId: string;
+            createdAt: Date;
+            updatedAt: Date;
+          })[];
+          users: {
+            id: string;
+            workspaceName: string;
+            name: string;
+            authUserId: string | null;
+            pubKey: string;
+            deviceType: UserDeviceType;
+            deviceUserId: string | null;
+            hsmId: string | null;
+            u2fKeyHandle: string | null;
+            u2fPubKey: string | null;
+            legacyViewAll: boolean;
+            role: UserRole;
+            status: ActivationStatus$1;
+            isSuspended: boolean;
+            gateType: GateUserType | null;
+            gateId: number;
+            syncId: string;
+            createdAt: Date;
+            updatedAt: Date;
+          }[];
+        } & {
+          id: string;
+          workspaceName: string;
+          type: ReviewConfigType;
+          steps: import("@prisma/client/runtime/client").JsonValue;
+          ownerPolicyId: string | null;
+          gateType: GateReviewConfigType | null;
+          gateId: number;
+          syncId: string;
+        })[];
+        whitelists: ({
+          addresses: {
+            id: string;
+            whitelistId: string;
+            name: string;
+            currency: string;
+            address: string;
+            destinationTag: string | null;
+          }[];
+        } & {
+          id: string;
+          workspaceName: string;
+          name: string;
+          description: string | null;
+          hsmId: string;
+          type: WhitelistType;
+          status: ActivationStatus$1;
+          gateType: GateWhitelistType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        })[];
+      } & {
+        id: string;
+        workspaceName: string;
+        name: string;
+        description: string | null;
+        currency: string | null;
+        contractAddress: string | null;
+        tokenIdentifier: string | null;
+        isPrivate: boolean;
+        hsmId: string | null;
+        rulesJsonArray: import("@prisma/client/runtime/client").JsonValue;
+        status: ActivationStatus$1;
+        gateType: GatePolicyType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__PolicyClient<({
+      reviewConfigs: ({
+        groups: ({
+          members: {
+            id: string;
+            workspaceName: string;
+            name: string;
+            authUserId: string | null;
+            pubKey: string;
+            deviceType: UserDeviceType;
+            deviceUserId: string | null;
+            hsmId: string | null;
+            u2fKeyHandle: string | null;
+            u2fPubKey: string | null;
+            legacyViewAll: boolean;
+            role: UserRole;
+            status: ActivationStatus$1;
+            isSuspended: boolean;
+            gateType: GateUserType | null;
+            gateId: number;
+            syncId: string;
+            createdAt: Date;
+            updatedAt: Date;
+          }[];
+        } & {
+          id: string;
+          workspaceName: string;
+          name: string;
+          description: string | null;
+          hsmId: string;
+          status: ActivationStatus$1;
+          gateType: GateGroupType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        })[];
+        users: {
+          id: string;
+          workspaceName: string;
+          name: string;
+          authUserId: string | null;
+          pubKey: string;
+          deviceType: UserDeviceType;
+          deviceUserId: string | null;
+          hsmId: string | null;
+          u2fKeyHandle: string | null;
+          u2fPubKey: string | null;
+          legacyViewAll: boolean;
+          role: UserRole;
+          status: ActivationStatus$1;
+          isSuspended: boolean;
+          gateType: GateUserType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        }[];
+      } & {
+        id: string;
+        workspaceName: string;
+        type: ReviewConfigType;
+        steps: import("@prisma/client/runtime/client").JsonValue;
+        ownerPolicyId: string | null;
+        gateType: GateReviewConfigType | null;
+        gateId: number;
+        syncId: string;
+      })[];
+      whitelists: ({
+        addresses: {
+          id: string;
+          whitelistId: string;
+          name: string;
+          currency: string;
+          address: string;
+          destinationTag: string | null;
+        }[];
+      } & {
+        id: string;
+        workspaceName: string;
+        name: string;
+        description: string | null;
+        hsmId: string;
+        type: WhitelistType;
+        status: ActivationStatus$1;
+        gateType: GateWhitelistType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    } & {
+      id: string;
+      workspaceName: string;
+      name: string;
+      description: string | null;
+      currency: string | null;
+      contractAddress: string | null;
+      tokenIdentifier: string | null;
+      isPrivate: boolean;
+      hsmId: string | null;
+      rulesJsonArray: import("@prisma/client/runtime/client").JsonValue;
+      status: ActivationStatus$1;
+      gateType: GatePolicyType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  whitelists: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      status?: ActivationStatus$1;
+      id?: string;
+      name?: string;
+      address?: string;
+      currency?: string;
+      sortBy: WhitelistSortBy;
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        addresses: {
+          id: string;
+          whitelistId: string;
+          name: string;
+          currency: string;
+          address: string;
+          destinationTag: string | null;
+        }[];
+      } & {
+        id: string;
+        workspaceName: string;
+        name: string;
+        description: string | null;
+        hsmId: string;
+        type: WhitelistType;
+        status: ActivationStatus$1;
+        gateType: GateWhitelistType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__WhitelistClient<({
+      addresses: {
+        id: string;
+        whitelistId: string;
+        name: string;
+        currency: string;
+        address: string;
+        destinationTag: string | null;
+      }[];
+    } & {
+      id: string;
+      workspaceName: string;
+      name: string;
+      description: string | null;
+      hsmId: string;
+      type: WhitelistType;
+      status: ActivationStatus$1;
+      gateType: GateWhitelistType | null;
+      gateId: number;
+      syncId: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  reports: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      type?: ReportType$1;
+      status?: ReportStatus$1;
+      createdBy?: string;
+      sortBy: "createdAt" | "updatedAt" | "expiresAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        type: ReportType$1;
+        params: import("@prisma/client/runtime/client").JsonValue;
+        status: ReportStatus$1;
+        s3Region: string | null;
+        s3Bucket: string | null;
+        s3Key: string | null;
+        errorMessage: string | null;
+        generationTaskId: string | null;
+        createdById: string;
+        expiresAt: Date;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__VaultReportClient<{
+      id: string;
+      workspaceName: string;
+      type: ReportType$1;
+      params: import("@prisma/client/runtime/client").JsonValue;
+      status: ReportStatus$1;
+      s3Region: string | null;
+      s3Bucket: string | null;
+      s3Key: string | null;
+      errorMessage: string | null;
+      generationTaskId: string | null;
+      createdById: string;
+      expiresAt: Date;
+      createdAt: Date;
+      updatedAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  auditLogs: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      type?: AuditLogType$1;
+      fromDate?: Date;
+      toDate?: Date;
+      sortBy: "createdAt" | "type";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string | null;
+        type: AuditLogType$1;
+        payload: import("@prisma/client/runtime/client").JsonValue;
+        createdAt: Date;
+      }[];
+    }>;
+    insert: (input: BackofficeAuditLogInput) => Promise<void>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__AuditLogClient<{
+      id: string;
+      workspaceName: string | null;
+      type: AuditLogType$1;
+      payload: import("@prisma/client/runtime/client").JsonValue;
+      createdAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  workspaceRules: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      permission?: AdminPermission$1;
+      sortBy: "permission" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        reviewConfig: {
+          id: string;
+          workspaceName: string;
+          type: ReviewConfigType;
+          steps: import("@prisma/client/runtime/client").JsonValue;
+          ownerPolicyId: string | null;
+          gateType: GateReviewConfigType | null;
+          gateId: number;
+          syncId: string;
+        };
+      } & {
+        id: string;
+        workspaceName: string;
+        permission: AdminPermission$1;
+        reviewConfigId: string;
+        gateType: GateWorkspaceRuleType | null;
+        gateId: number;
+        syncId: string;
+        createdAt: Date;
+        updatedAt: Date;
+      })[];
+    }>;
+  };
+  workspaces: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      name?: string | string[];
+      mode?: RevaultMode;
+      status?: ActivationStatus$1;
+      sortBy: "name" | "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        name: string;
+        compartmentId: number;
+        targetHsmName: string;
+        mode: RevaultMode;
+        hsmHostingMode: HsmHostingMode;
+        status: ActivationStatus$1;
+        maintenanceMode: MaintenanceMode;
+        createdAt: Date;
+        updatedAt: Date;
+        pkiRootCaFetched: boolean;
+        oidcConfig: import("@prisma/client/runtime/client").JsonValue | null;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__WorkspaceClient<{
+      id: string;
+      name: string;
+      compartmentId: number;
+      targetHsmName: string;
+      mode: RevaultMode;
+      hsmHostingMode: HsmHostingMode;
+      status: ActivationStatus$1;
+      maintenanceMode: MaintenanceMode;
+      createdAt: Date;
+      updatedAt: Date;
+      pkiRootCaFetched: boolean;
+      oidcConfig: import("@prisma/client/runtime/client").JsonValue | null;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+    edit: (actor: BackofficeClaims, requiredPermission: "workspace:edit", input: {
+      name: string;
+      mode?: RevaultMode;
+      maintenanceMode?: MaintenanceMode;
+      oidcConfig?: import("@/generated/prisma/internal/prismaNamespace").InputJsonValue | null;
+      hsmProxyName?: string;
+    }) => Promise<{
+      id: string;
+      name: string;
+      compartmentId: number;
+      targetHsmName: string;
+      mode: RevaultMode;
+      hsmHostingMode: HsmHostingMode;
+      status: ActivationStatus$1;
+      maintenanceMode: MaintenanceMode;
+      createdAt: Date;
+      updatedAt: Date;
+      pkiRootCaFetched: boolean;
+      oidcConfig: import("@prisma/client/runtime/client").JsonValue | null;
+    }>;
+    setMaintenanceMode: (actor: BackofficeClaims, requiredPermission: "workspace:edit", input: {
+      workspaceNames: string[];
+      maintenanceMode: MaintenanceMode;
+    }) => Promise<{
+      maintenanceMode: MaintenanceMode;
+      totalCount: number;
+      changedCount: number;
+    }>;
+  };
+  onboardings: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      step?: OnboardingStep | OnboardingStep[];
+      hsmHostingMode?: HsmHostingMode;
+      sortBy: "workspaceName" | "step" | "createdAt" | "completedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: ({
+        claimedDevices: {
+          id: string;
+          onboardingId: string;
+          pubKey: string;
+          deviceUserId: string;
+          deviceName: string;
+          role: ClaimedRole;
+          claimedAt: Date;
+        }[];
+        users: ({
+          reviewByMasterAdmin: {
+            id: string;
+            reviewerId: string;
+            challenge: import("@prisma/client/runtime/client").JsonValue;
+            signature: string | null;
+          } | null;
+          reviewBySharedOwner: {
+            id: string;
+            reviewerId: string;
+            seedChallenge: import("@prisma/client/runtime/client").JsonValue;
+            seedFragment: import("@prisma/client/runtime/client").JsonValue;
+          } | null;
+          reviewOfExternalSigners: {
+            id: string;
+            reviewerId: string;
+            challenge: import("@prisma/client/runtime/client").JsonValue;
+            signature: string | null;
+          } | null;
+        } & {
+          id: string;
+          onboardingId: string;
+          name: string;
+          role: OnboardedUserRole;
+          psdModel: PsdModel;
+          pubKey: string;
+          deviceUserId: string;
+          u2fKeyHandle: string | null;
+          u2fPubKey: string | null;
+          registrationChallenge: import("@prisma/client/runtime/client").JsonValue;
+          registrationResponse: import("@prisma/client/runtime/client").JsonValue;
+          createdAt: Date;
+        })[];
+        wrappingKey: ({
+          fragments: {
+            id: string;
+            wrappingKeyId: string;
+            pubKey: string;
+            ephemeralPubKey: string;
+            ephemeralCertificate: import("@prisma/client/runtime/client").JsonValue;
+            blob: string;
+          }[];
+        } & {
+          id: string;
+          onboardingId: string;
+          ephemeralPubKey: string;
+          ephemeralCertificate: import("@prisma/client/runtime/client").JsonValue;
+        }) | null;
+      } & {
+        id: string;
+        workspaceName: string;
+        mode: RevaultMode;
+        compartmentId: number;
+        targetHsmName: string;
+        hsmHostingMode: HsmHostingMode;
+        step: OnboardingStep;
+        isLocked: boolean;
+        createdAt: Date;
+        completedAt: Date | null;
+      })[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__OnboardingClient<({
+      claimedDevices: {
+        id: string;
+        onboardingId: string;
+        pubKey: string;
+        deviceUserId: string;
+        deviceName: string;
+        role: ClaimedRole;
+        claimedAt: Date;
+      }[];
+      users: ({
+        reviewByMasterAdmin: {
+          id: string;
+          reviewerId: string;
+          challenge: import("@prisma/client/runtime/client").JsonValue;
+          signature: string | null;
+        } | null;
+        reviewBySharedOwner: {
+          id: string;
+          reviewerId: string;
+          seedChallenge: import("@prisma/client/runtime/client").JsonValue;
+          seedFragment: import("@prisma/client/runtime/client").JsonValue;
+        } | null;
+        reviewOfExternalSigners: {
+          id: string;
+          reviewerId: string;
+          challenge: import("@prisma/client/runtime/client").JsonValue;
+          signature: string | null;
+        } | null;
+      } & {
+        id: string;
+        onboardingId: string;
+        name: string;
+        role: OnboardedUserRole;
+        psdModel: PsdModel;
+        pubKey: string;
+        deviceUserId: string;
+        u2fKeyHandle: string | null;
+        u2fPubKey: string | null;
+        registrationChallenge: import("@prisma/client/runtime/client").JsonValue;
+        registrationResponse: import("@prisma/client/runtime/client").JsonValue;
+        createdAt: Date;
+      })[];
+      wrappingKey: ({
+        fragments: {
+          id: string;
+          wrappingKeyId: string;
+          pubKey: string;
+          ephemeralPubKey: string;
+          ephemeralCertificate: import("@prisma/client/runtime/client").JsonValue;
+          blob: string;
+        }[];
+      } & {
+        id: string;
+        onboardingId: string;
+        ephemeralPubKey: string;
+        ephemeralCertificate: import("@prisma/client/runtime/client").JsonValue;
+      }) | null;
+    } & {
+      id: string;
+      workspaceName: string;
+      mode: RevaultMode;
+      compartmentId: number;
+      targetHsmName: string;
+      hsmHostingMode: HsmHostingMode;
+      step: OnboardingStep;
+      isLocked: boolean;
+      createdAt: Date;
+      completedAt: Date | null;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+    create: (actor: BackofficeClaims, requiredPermission: "onboarding:create", input: Parameters<typeof startOnboarding>[1]) => Promise<{
+      id: string;
+      workspaceName: string;
+      hsmHostingMode: "HOSTED" | "ON_PREM";
+      step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
+      claimedDevices: {
+        pubKey: string;
+        deviceUserId: string;
+        deviceName: string;
+        role: "MASTER_ADMIN" | "SHARED_OWNER" | "WRAPPING_KEY_OWNER";
+      }[];
+      wrappingKey: {
+        ephemeralPubKey: string;
+        ephemeralCertificate: HsmCertificate;
+        fragments: {
+          pubKey: string;
+          ephemeralPubKey: string;
+          ephemeralCertificate: HsmCertificate;
+          blob: string;
+        }[];
+      } | null;
+      masterAdmins: {
+        name: string;
+        psdModel: "STAX";
+        pubKey: string;
+        registrationChallenge: {
+          challenge: string;
+          ephemeralPublicKey: string;
+          ephemeralPublicKeyAttestation: HsmCertificate;
+          handshake: string;
+          handshakeAttestation: HsmCertificate;
+          u2fRegisterData: string;
+          ciphertext: string;
+          requestId: string;
+        };
+        registrationResponse: {
+          certificate: HsmCertificate;
+          u2fRegister: string;
+          u2fKeyHandle: string;
+          registerData: string;
+          validationKey: string;
+          pairingPayload: string;
+        } | null;
+        role: "MASTER_ADMIN";
+        review: {
+          challenge: {
+            challengeType: "PSD";
+            wActions: string[];
+            handshake: string;
+            handshakeAttestation: HsmCertificate;
+            partitionId: string;
+          };
+          signature: string | null;
+        } | null;
+        reviewOfExternalSigners: {
+          challenge: {
+            challengeType: "PSD";
+            wActions: string[];
+            handshake: string;
+            handshakeAttestation: HsmCertificate;
+            partitionId: string;
+          };
+          signature: string | null;
+        } | null;
+      }[];
+      sharedOwners: {
+        name: string;
+        psdModel: "STAX";
+        pubKey: string;
+        registrationChallenge: {
+          challenge: string;
+          ephemeralPublicKey: string;
+          ephemeralPublicKeyAttestation: HsmCertificate;
+          handshake: string;
+          handshakeAttestation: HsmCertificate;
+          u2fRegisterData: string;
+          ciphertext: string;
+          requestId: string;
+        };
+        registrationResponse: {
+          certificate: HsmCertificate;
+          u2fRegister: string;
+          u2fKeyHandle: string;
+          registerData: string;
+          validationKey: string;
+          pairingPayload: string;
+        } | null;
+        role: "SHARED_OWNER";
+        review: {
+          seedChallenge: {
+            challengeType: "PSD";
+            wActions: string[];
+            handshake: string;
+            handshakeAttestation: HsmCertificate;
+            partitionId: string;
+            kkHandshake: string;
+            kkHandshakeAttestation: HsmCertificate;
+            ephemeralPublicKey: string;
+            certificate: HsmCertificate;
+            blob: string;
+          };
+          seedFragment: {
+            approverBlob: string;
+            challengeResponse: string;
+            handshake: string;
+            handshakeAttestation: HsmCertificate;
+          } | null;
+        } | null;
+      }[];
+      createdAt: Date;
+      completedAt: Date | null;
+    }>;
+  };
+  requests: {
+    list: (filters: Omit<RequestListFilters, "visibility">) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: RequestView[];
+    }>;
+    find: (id: string) => Promise<RequestView | null>;
+    restart: (actor: BackofficeClaims, requiredPermission: "request:restart", id: string) => Promise<void>;
+    expire: (actor: BackofficeClaims, requiredPermission: "request:expire", id: string) => Promise<void>;
+  };
+  outgoingTransactions: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      accountId?: string;
+      hash?: string;
+      id?: string;
+      currency?: string;
+      sortBy: "createdAt" | "updatedAt";
+    }) => Promise<{
+      page: number;
+      next: number | null;
+      prev: number | null;
+      pageSize: number;
+      total: number;
+      results: {
+        id: string;
+        workspaceName: string;
+        accountId: string;
+        intent: import("@prisma/client/runtime/client").JsonValue;
+        note: import("@prisma/client/runtime/client").JsonValue;
+        hash: string | null;
+        replacementHash: string | null;
+        status: OutgoingTransactionStatus;
+        lesWalletTaskId: string;
+        createdById: string;
+        createdAt: Date;
+        updatedAt: Date;
+      }[];
+    }>;
+    find: (id: string) => import("@/generated/prisma/models").Prisma__OutgoingTransactionClient<({
+      statusTransitions: {
+        id: string;
+        sequence: number;
+        outgoingTransactionId: string;
+        status: OutgoingTransactionStatus;
+        recordedAt: Date;
+        failureReasonCode: string | null;
+        failureReason: string | null;
+      }[];
+    } & {
+      id: string;
+      workspaceName: string;
+      accountId: string;
+      intent: import("@prisma/client/runtime/client").JsonValue;
+      note: import("@prisma/client/runtime/client").JsonValue;
+      hash: string | null;
+      replacementHash: string | null;
+      status: OutgoingTransactionStatus;
+      lesWalletTaskId: string;
+      createdById: string;
+      createdAt: Date;
+      updatedAt: Date;
+    }) | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+      omit: import("@/generated/prisma/internal/prismaNamespace").GlobalOmitConfig | undefined;
+    }>;
+  };
+  webhooks: {
+    list: (input: ({
+      page: number;
+      pageSize: number;
+    } & {
+      sortOrder: SortOrder;
+    }) & {
+      workspaceName?: string | string[];
+      status?: WebhookStatus$1;
+      search?: string;
+      statsWindowDays: number;
+    }) => Promise<{
+      page: {
+        page: number;
+        next: number | null;
+        prev: number | null;
+        pageSize: number;
+        total: number;
+        results: ({
+          rules: {
+            id: string;
+            webhookId: string;
+            actions: EventAction$1[];
+            requestTypes: RequestType$1[];
+            createdAt: Date;
+          }[];
+          scopeUsers: {
+            id: string;
+            workspaceName: string;
+            name: string;
+            authUserId: string | null;
+            pubKey: string;
+            deviceType: UserDeviceType;
+            deviceUserId: string | null;
+            hsmId: string | null;
+            u2fKeyHandle: string | null;
+            u2fPubKey: string | null;
+            legacyViewAll: boolean;
+            role: UserRole;
+            status: ActivationStatus$1;
+            isSuspended: boolean;
+            gateType: GateUserType | null;
+            gateId: number;
+            syncId: string;
+            createdAt: Date;
+            updatedAt: Date;
+          }[];
+        } & {
+          id: string;
+          workspaceName: string;
+          name: string;
+          description: string | null;
+          url: string;
+          status: WebhookStatus$1;
+          retryStrategy: WebhookRetryStrategy$1;
+          maxRetries: number;
+          initialIntervalMs: number;
+          consecutiveFailures: number;
+          brokenSince: Date | null;
+          createdAt: Date;
+          updatedAt: Date;
+        })[];
+      };
+      stats: Map<string, WebhookDeliveryStats>;
+    }>;
+  };
+  hsm: {
+    compareWorkspace: (input: {
+      workspaceName: string;
+      comparator: HsmComparator;
+    }) => Promise<HsmWorkspaceComparison>;
+  };
+  relationships: {
+    dryRun: (input: {
+      workspaceName: string;
+      shapeLimit: number;
+    }) => Promise<{
+      workspaceName: string;
+      dryRun: true;
+      rawTupleCount: number;
+      uniqueTupleCount: number;
+      duplicateTupleCount: number;
+      buildDurationMs: number;
+      shapeCounts: RelationshipShapeCount[];
+    }>;
+    materialize: (actor: BackofficeClaims, requiredPermission: "workspace:edit", input: {
+      workspaceName: string;
+      confirm: string;
+    }) => Promise<{
+      rawTupleCount: number;
+      uniqueTupleCount: number;
+      currentTupleCount: number;
+      buildDurationMs: number;
+      writeDurationMs: number;
+      totalDurationMs: number;
+      workspaceName: string;
+    }>;
+    health: (input: {
+      workspaceName: string;
+      shapeLimit: number;
+    }) => Promise<RelationshipHealth>;
+    driftCheck: (input: {
+      workspaceName: string;
+      sampleLimit: number;
+    }) => Promise<RelationshipDriftCheck>;
+  };
+  featureFlagPromotions: FeatureFlagPromotions;
+};
+interface RuntimeInternalCapabilities extends ReturnType<typeof createInternalCapabilities> {}
+/**
+ * Request capability provider for the *internal* HTTP context: the full public provider plus the
+ * administration bucket, exposed at `ctx.core.administration`. Its {@link forReadOnlyRequest}
+ * rebinds the *entire* internal set (public + admin) onto the write-rejecting Prisma extension, so
+ * a read-only (backoffice impersonation, ADR-0012) session cannot mutate through any capability.
+ */
+interface RuntimeInternalApiCapabilityProvider extends RuntimeApiCapabilities {
+  administration: RuntimeInternalCapabilities;
+  forReadOnlyRequest: () => RuntimeInternalApiCapabilityProvider;
+}
+//#endregion
 //#region src/core/workspaces/schemas.d.ts
 declare const zWorkspaceName: z.ZodString;
 //#endregion
@@ -27,7 +1584,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       u2fPubKey: string | null;
       legacyViewAll: boolean;
       role: UserRole;
-      status: ActivationStatus;
+      status: ActivationStatus$1;
       isSuspended: boolean;
       gateType: GateUserType | null;
       gateId: number;
@@ -40,26 +1597,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
     activityTracer: ActivityTracer;
     core: RuntimeInternalApiCapabilityProvider;
   };
-  meta: {
-    [x: string]: unknown;
-  } & {
-    openapi?: {
-      enabled?: boolean;
-      method: import("trpc-to-openapi").OpenApiMethod;
-      path: `/${string}`;
-      operationId?: string;
-      summary?: string;
-      description?: string;
-      protect?: boolean;
-      tags?: string[];
-      contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-      deprecated?: boolean;
-      requestHeaders?: import("zod").ZodObject;
-      responseHeaders?: import("zod").ZodObject;
-      successDescription?: string;
-      errorResponses?: number[] | Record<number, string>;
-    };
-  } & RateLimitMetricsMeta & BackofficePermissionMeta;
+  meta: TrpcMeta;
   errorShape: {
     message: string;
     code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -96,7 +1634,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         u2fPubKey: string | null;
         legacyViewAll: boolean;
         role: UserRole;
-        status: ActivationStatus;
+        status: ActivationStatus$1;
         isSuspended: boolean;
         gateType: GateUserType | null;
         gateId: number;
@@ -109,26 +1647,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       activityTracer: ActivityTracer;
       core: RuntimeInternalApiCapabilityProvider;
     };
-    meta: {
-      [x: string]: unknown;
-    } & {
-      openapi?: {
-        enabled?: boolean;
-        method: import("trpc-to-openapi").OpenApiMethod;
-        path: `/${string}`;
-        operationId?: string;
-        summary?: string;
-        description?: string;
-        protect?: boolean;
-        tags?: string[];
-        contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-        deprecated?: boolean;
-        requestHeaders?: import("zod").ZodObject;
-        responseHeaders?: import("zod").ZodObject;
-        successDescription?: string;
-        errorResponses?: number[] | Record<number, string>;
-      };
-    } & RateLimitMetricsMeta & BackofficePermissionMeta;
+    meta: TrpcMeta;
     errorShape: {
       message: string;
       code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -148,28 +1667,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       output: {
         sub: string;
         groups: string[];
-        permissions: ("backoffice:read" | "impersonation:list" | "impersonation:request" | "impersonation:revoke" | "onboarding:create" | "request:expire" | "request:restart" | "workspace:edit")[];
+        permissions: ("backoffice:read" | "feature-flag:promote" | "impersonation:list" | "impersonation:request" | "impersonation:revoke" | "onboarding:create" | "request:expire" | "request:restart" | "workspace:edit")[];
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
     workspaces: import("@trpc/server").TRPCBuiltRouter<{
       ctx: {
@@ -193,7 +1693,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -206,26 +1706,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -266,31 +1747,12 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             createdAt: Date;
             updatedAt: Date;
           } & {
-            status: ActivationStatus;
+            status: ActivationStatus$1;
             maintenanceMode: MaintenanceMode;
-            oidcConfig: import("zod").output<typeof zOidcConfig> | null;
+            oidcConfig: import("zod").infer<typeof zOidcConfig> | null;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -314,26 +1776,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             realm: string;
           } | null;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       setMaintenanceMode: import("@trpc/server").TRPCMutationProcedure<{
         input: {
@@ -346,26 +1789,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           totalCount: number;
           changedCount: number;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       edit: import("@trpc/server").TRPCMutationProcedure<{
         input: {
@@ -397,26 +1821,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             realm: string;
           } | null;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     onboardings: import("@trpc/server").TRPCBuiltRouter<{
@@ -441,7 +1846,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -454,26 +1859,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -621,26 +2007,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             targetHsmName: string;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -762,26 +2129,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           compartmentId: number;
           targetHsmName: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       create: import("@trpc/server").TRPCMutationProcedure<{
         input: {
@@ -903,26 +2251,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           createdAt: Date;
           completedAt: Date | null;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     impersonations: import("@trpc/server").TRPCBuiltRouter<{
@@ -947,7 +2276,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -960,26 +2289,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1003,52 +2313,14 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           code: string;
           impersonationId: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       revoke: import("@trpc/server").TRPCMutationProcedure<{
         input: {
           impersonationId: string;
         };
         output: void;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       listActive: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1064,26 +2336,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           startedAt: Date;
           expiresAt: Date;
         }[];
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     users: import("@trpc/server").TRPCBuiltRouter<{
@@ -1108,7 +2361,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1121,26 +2374,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1191,26 +2425,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             updatedAt: Date;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1231,26 +2446,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           createdAt: Date;
           updatedAt: Date;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     userRegistrations: import("@trpc/server").TRPCBuiltRouter<{
@@ -1275,7 +2471,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1288,26 +2484,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1348,26 +2525,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             state: "COMPLETED" | "CONSUMED" | "INITIAL" | "PENDING";
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1382,26 +2540,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           state: "COMPLETED" | "CONSUMED" | "INITIAL" | "PENDING";
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     accounts: import("@trpc/server").TRPCBuiltRouter<{
@@ -1426,7 +2565,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1439,26 +2578,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1480,32 +2600,14 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           name: string;
           ticker?: string | undefined;
         }[];
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       list: import("@trpc/server").TRPCQueryProcedure<{
         input: {
           page?: number | undefined;
           pageSize?: number | undefined;
           workspaceName?: string | string[] | undefined;
+          workspaceNames?: string[] | undefined;
           status?: "ACTIVE" | "INACTIVE" | undefined;
           id?: string | undefined;
           name?: string | undefined;
@@ -1516,6 +2618,9 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           index?: number | undefined;
           contractAddress?: string | null | undefined;
           support?: "legacy" | "standalone" | undefined;
+          lesWalletRegistrable?: boolean | undefined;
+          addressBackfillable?: boolean | undefined;
+          gateSynced?: boolean | undefined;
           type?: "BITCOIN_LIKE" | "CANTON_LIKE" | "CARDANO_LIKE" | "ETHEREUM_LIKE" | "GENERIC_LIKE" | "HEDERA_LIKE" | "POLKADOT_LIKE" | "RAW_SIGNING" | "RIPPLE_LIKE" | "SOLANA_LIKE" | "STELLAR_LIKE" | "SUI_LIKE" | "TEZOS_LIKE" | "TRON_LIKE" | undefined;
           policyIds?: string[] | undefined;
           entityIds?: string[] | undefined;
@@ -1601,31 +2706,12 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
               }[];
             };
           } & {
-            workspaceName: import("zod").output<typeof zWorkspaceName>;
+            workspaceName: import("zod").infer<typeof zWorkspaceName>;
             lesWalletId: string | null;
             hsmId: string;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1707,26 +2793,32 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           lesWalletId: string | null;
           hsmId: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
+      }>;
+      lesWalletRegistrableSummary: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+          workspaceNames?: string[] | undefined;
+          currencies?: string[] | undefined;
+          target?: "ADDRESS" | "LES_WALLET_ID" | undefined;
+        };
+        output: {
+          total: number;
+          byCurrency: {
+            currency: string;
+            count: number;
+          }[];
+        };
+        meta: TrpcMeta;
+      }>;
+      registerOnLesWallet: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+          workspaceNames?: string[] | undefined;
+          currencies?: string[] | undefined;
+          target?: "ADDRESS" | "LES_WALLET_ID" | undefined;
+          limit: number;
+        };
+        output: LesWalletRegistrationReport;
+        meta: TrpcMeta;
       }>;
     }>>;
     groups: import("@trpc/server").TRPCBuiltRouter<{
@@ -1751,7 +2843,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1764,26 +2856,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -1839,30 +2912,11 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             createdAt: Date;
             updatedAt: Date;
           } & {
-            workspaceName: import("zod").output<typeof zWorkspaceName>;
+            workspaceName: import("zod").infer<typeof zWorkspaceName>;
             hsmId: string;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -1895,26 +2949,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmId: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     whitelists: import("@trpc/server").TRPCBuiltRouter<{
@@ -1939,7 +2974,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -1952,26 +2987,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2022,30 +3038,11 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             updatedAt: Date;
             description: string | null;
           } & {
-            workspaceName: import("zod").output<typeof zWorkspaceName>;
+            workspaceName: import("zod").infer<typeof zWorkspaceName>;
             hsmId: string;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -2071,26 +3068,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmId: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     webhooks: import("@trpc/server").TRPCBuiltRouter<{
@@ -2115,7 +3093,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2128,26 +3106,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2206,26 +3165,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             workspaceName: string;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     policies: import("@trpc/server").TRPCBuiltRouter<{
@@ -2250,7 +3190,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2263,26 +3203,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2375,26 +3296,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmId: string | null;
         } | null;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       list: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -2485,8 +3387,8 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             createdAt: Date;
             updatedAt: Date;
           }, "rules"> & {
-            workspaceName: import("zod").output<typeof zWorkspaceName>;
-            rules: Array<import("zod").output<import("zod").ZodObject<{
+            workspaceName: import("zod").infer<typeof zWorkspaceName>;
+            rules: Array<import("zod").infer<import("zod").ZodObject<{
               reviewSteps: import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
                 quorum: import("zod").ZodNumber;
                 userIds: import("zod").ZodArray<import("zod").ZodString>;
@@ -2514,26 +3416,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             hsmId: string | null;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -2613,26 +3496,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           workspaceName: string;
           hsmId: string | null;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     workspaceRules: import("@trpc/server").TRPCBuiltRouter<{
@@ -2657,7 +3521,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2670,26 +3534,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2726,29 +3571,10 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
               userIds: string[];
             }[];
           } & {
-            workspaceName: import("zod").output<typeof zWorkspaceName>;
+            workspaceName: import("zod").infer<typeof zWorkspaceName>;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     reports: import("@trpc/server").TRPCBuiltRouter<{
@@ -2773,7 +3599,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2786,26 +3612,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -2870,29 +3677,10 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
               transactionStatuses?: ("FAILED" | "PENDING" | "SUCCESSFUL" | "UNKNOWN")[] | undefined;
             };
           })) & {
-            workspaceName: import("zod").output<typeof zWorkspaceName>;
+            workspaceName: import("zod").infer<typeof zWorkspaceName>;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -2933,26 +3721,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         })) & {
           workspaceName: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     requests: import("@trpc/server").TRPCBuiltRouter<{
@@ -2977,7 +3746,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -2990,26 +3759,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -3048,29 +3798,10 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           pageSize: number;
           total: number;
           results: (VaultRequestResponse & {
-            workspaceName: import("zod").output<typeof zWorkspaceName>;
+            workspaceName: import("zod").infer<typeof zWorkspaceName>;
           })[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -4661,81 +5392,24 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         }) & {
           workspaceName: string;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       restart: import("@trpc/server").TRPCMutationProcedure<{
         input: {
           id: string;
         };
         output: void;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       expire: import("@trpc/server").TRPCMutationProcedure<{
         input: {
           id: string;
         };
         output: void;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
-    relationships: import("@trpc/server").TRPCBuiltRouter<{
+    outgoingTransactions: import("@trpc/server").TRPCBuiltRouter<{
       ctx: {
         req?: import("fastify").FastifyRequest<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("node:http").IncomingMessage, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown, import("fastify").FastifyBaseLogger, import("fastify/types/type-provider").ResolveFastifyRequestType<import("fastify").FastifyTypeProviderDefault, import("fastify").FastifySchema, import("fastify").RouteGenericInterface>> | undefined;
         res?: import("fastify").FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("node:http").IncomingMessage, import("node:http").ServerResponse<import("node:http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown> | undefined;
@@ -4757,7 +5431,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -4770,26 +5444,120 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
+      meta: TrpcMeta;
+      errorShape: {
+        message: string;
+        code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
+        data: {
+          code: import("@trpc/server").TRPC_ERROR_CODE_KEY;
+          httpStatus: number;
+          path?: string;
+          stack?: string;
+          maintenanceMode?: "FULL" | "READ_ONLY" | undefined;
+          maintenance?: boolean | undefined;
+        };
+      };
+      transformer: true;
+    }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+      list: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+          page?: number | undefined;
+          pageSize?: number | undefined;
+          workspaceName?: string | string[] | undefined;
+          accountId?: string | undefined;
+          hash?: string | undefined;
+          id?: string | undefined;
+          currency?: string | undefined;
+          sortBy?: "createdAt" | "updatedAt" | undefined;
+          sortOrder?: "asc" | "desc" | undefined;
+        };
+        output: {
+          page: number;
+          next: number | null;
+          prev: number | null;
+          pageSize: number;
+          total: number;
+          results: {
+            id: string;
+            workspaceName: string;
+            accountId: string;
+            status: "CONFIRMED" | "DROPPED" | "FAILED" | "ON_CHAIN" | "SCHEDULED" | "SUBMITTED";
+            hash: string | null;
+            replacementHash: string | null;
+            intent: unknown;
+            note: unknown;
+            lesWalletTaskId: string;
+            createdById: string;
+            createdAt: Date;
+            updatedAt: Date;
+          }[];
+        };
+        meta: TrpcMeta;
+      }>;
+      findById: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+          id: string;
+        };
+        output: {
+          id: string;
+          workspaceName: string;
+          accountId: string;
+          status: "CONFIRMED" | "DROPPED" | "FAILED" | "ON_CHAIN" | "SCHEDULED" | "SUBMITTED";
+          hash: string | null;
+          replacementHash: string | null;
+          intent: unknown;
+          note: unknown;
+          lesWalletTaskId: string;
+          createdById: string;
+          createdAt: Date;
+          updatedAt: Date;
+          statusTransitions: {
+            sequence: number;
+            status: "CONFIRMED" | "DROPPED" | "FAILED" | "ON_CHAIN" | "SCHEDULED" | "SUBMITTED";
+            recordedAt: Date;
+            failureReasonCode: string | null;
+            failureReason: string | null;
+          }[];
         };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
+      }>;
+    }>>;
+    relationships: import("@trpc/server").TRPCBuiltRouter<{
+      ctx: {
+        req?: import("fastify").FastifyRequest<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("node:http").IncomingMessage, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown, import("fastify").FastifyBaseLogger, import("fastify/types/type-provider").ResolveFastifyRequestType<import("fastify").FastifyTypeProviderDefault, import("fastify").FastifySchema, import("fastify").RouteGenericInterface>> | undefined;
+        res?: import("fastify").FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("node:http").IncomingMessage, import("node:http").ServerResponse<import("node:http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown> | undefined;
+        info?: import("@trpc/server/unstable-core-do-not-import").TRPCRequestInfo | undefined;
+        debugAuthToken?: string;
+        rootAuthToken?: string;
+        backofficeRequiredPermission?: BackofficePermission;
+        io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
+        user: {
+          id: string;
+          workspaceName: string;
+          name: string;
+          authUserId: string | null;
+          pubKey: string;
+          deviceType: UserDeviceType;
+          deviceUserId: string | null;
+          hsmId: string | null;
+          u2fKeyHandle: string | null;
+          u2fPubKey: string | null;
+          legacyViewAll: boolean;
+          role: UserRole;
+          status: ActivationStatus$1;
+          isSuspended: boolean;
+          gateType: GateUserType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        } | null;
+        authorization: string | null;
+        readOnly: boolean;
+        activityTracer: ActivityTracer;
+        core: RuntimeInternalApiCapabilityProvider;
+      };
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -4824,26 +5592,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             count: number;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       materialize: import("@trpc/server").TRPCMutationProcedure<{
         input: {
@@ -4859,26 +5608,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           writeDurationMs: number;
           totalDurationMs: number;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       health: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -4900,26 +5630,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             count: number;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       driftCheck: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -4959,26 +5670,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           compareDurationMs: number;
           totalDurationMs: number;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     auditLogs: import("@trpc/server").TRPCBuiltRouter<{
@@ -5003,7 +5695,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -5016,26 +5708,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -5075,26 +5748,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
             createdAt: Date;
           }[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       findById: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5107,26 +5761,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           payload: unknown;
           createdAt: Date;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     auditTrail: import("@trpc/server").TRPCBuiltRouter<{
@@ -5151,7 +5786,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -5164,26 +5799,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -5220,26 +5836,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           hasMore: boolean;
           capped: boolean;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       requestFailures: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5259,26 +5856,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           hasMore: boolean;
           capped: boolean;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       getEvent: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5292,26 +5870,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           contentType: string;
           decoded: boolean;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
     }>>;
     hsmRequests: import("@trpc/server").TRPCBuiltRouter<{
@@ -5336,7 +5895,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           u2fPubKey: string | null;
           legacyViewAll: boolean;
           role: UserRole;
-          status: ActivationStatus;
+          status: ActivationStatus$1;
           isSuspended: boolean;
           gateType: GateUserType | null;
           gateId: number;
@@ -5349,26 +5908,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         activityTracer: ActivityTracer;
         core: RuntimeInternalApiCapabilityProvider;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
       errorShape: {
         message: string;
         code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -5394,26 +5934,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           total_objects: number;
           objects_report: Record<string, number>;
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       objectsInfo: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5447,26 +5968,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           }[];
           objects_missing_merkle_tree_id: string[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       objectsContent: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5483,26 +5985,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           object_contents: unknown[];
           objects_missing_merkle_tree_id: string[];
         };
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
-          };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+        meta: TrpcMeta;
       }>;
       compareWithHsm: import("@trpc/server").TRPCQueryProcedure<{
         input: {
@@ -5510,26 +5993,132 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           comparator: "whitelists" | "workspace-name";
         };
         output: HsmWorkspaceComparison;
-        meta: {
-          [x: string]: unknown;
-        } & {
-          openapi?: {
-            enabled?: boolean;
-            method: import("trpc-to-openapi").OpenApiMethod;
-            path: `/${string}`;
-            operationId?: string;
-            summary?: string;
-            description?: string;
-            protect?: boolean;
-            tags?: string[];
-            contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-            deprecated?: boolean;
-            requestHeaders?: import("zod").ZodObject;
-            responseHeaders?: import("zod").ZodObject;
-            successDescription?: string;
-            errorResponses?: number[] | Record<number, string>;
+        meta: TrpcMeta;
+      }>;
+    }>>;
+    configCatPromotions: import("@trpc/server").TRPCBuiltRouter<{
+      ctx: {
+        req?: import("fastify").FastifyRequest<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("node:http").IncomingMessage, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown, import("fastify").FastifyBaseLogger, import("fastify/types/type-provider").ResolveFastifyRequestType<import("fastify").FastifyTypeProviderDefault, import("fastify").FastifySchema, import("fastify").RouteGenericInterface>> | undefined;
+        res?: import("fastify").FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("node:http").IncomingMessage, import("node:http").ServerResponse<import("node:http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown> | undefined;
+        info?: import("@trpc/server/unstable-core-do-not-import").TRPCRequestInfo | undefined;
+        debugAuthToken?: string;
+        rootAuthToken?: string;
+        backofficeRequiredPermission?: BackofficePermission;
+        io: import("socket.io").Server<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any> | null;
+        user: {
+          id: string;
+          workspaceName: string;
+          name: string;
+          authUserId: string | null;
+          pubKey: string;
+          deviceType: UserDeviceType;
+          deviceUserId: string | null;
+          hsmId: string | null;
+          u2fKeyHandle: string | null;
+          u2fPubKey: string | null;
+          legacyViewAll: boolean;
+          role: UserRole;
+          status: ActivationStatus$1;
+          isSuspended: boolean;
+          gateType: GateUserType | null;
+          gateId: number;
+          syncId: string;
+          createdAt: Date;
+          updatedAt: Date;
+        } | null;
+        authorization: string | null;
+        readOnly: boolean;
+        activityTracer: ActivityTracer;
+        core: RuntimeInternalApiCapabilityProvider;
+      };
+      meta: TrpcMeta;
+      errorShape: {
+        message: string;
+        code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
+        data: {
+          code: import("@trpc/server").TRPC_ERROR_CODE_KEY;
+          httpStatus: number;
+          path?: string;
+          stack?: string;
+          maintenanceMode?: "FULL" | "READ_ONLY" | undefined;
+          maintenance?: boolean | undefined;
+        };
+      };
+      transformer: true;
+    }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+      matrix: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+          sourceEnv?: string | undefined;
+        };
+        output: {
+          environments: {
+            slug: string;
+            displayName: string;
+            order: number;
+          }[];
+          sourceEnv: string;
+          rows: {
+            flagKey: string;
+            flagName: string;
+            valueType: "boolean" | "json" | "number" | "string";
+            cells: Record<string, {
+              state: "blocked" | "missing" | "notAllowed" | "present" | "source";
+              summary: string;
+              blockers: {
+                code: "CONFIGCAT_UNAVAILABLE" | "ENVIRONMENT_NOT_CONFIGURED" | "EXTERNAL_WRITE_FAILED" | "EXTERNAL_WRITE_OUTCOME_UNKNOWN" | "SELECTED_FLAG_ALREADY_EXISTS" | "SOURCE_FLAG_NOT_FOUND" | "TARGET_NOT_AFTER_SOURCE" | "UNSUPPORTED_FLAG";
+                severity: "blocking";
+                sourceEnv: string;
+                targetEnv?: string | undefined;
+                flagKey?: string | undefined;
+                message: string;
+              }[];
+            }>;
+          }[];
+          summary: {
+            promotableCells: number;
+            blockedCells: number;
+            alignedFlags: number;
           };
-        } & RateLimitMetricsMeta & BackofficePermissionMeta;
+          fetchedAt: string;
+        };
+        meta: TrpcMeta;
+      }>;
+      promote: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+          sourceEnv: string;
+          selections: {
+            flagKey: string;
+            targetEnv: string;
+          }[];
+          operatorReason?: string | undefined;
+        };
+        output: {
+          attemptId: string;
+          status: "applied" | "blocked" | "failed" | "partiallyApplied";
+          created: {
+            sourceEnv: string;
+            targetEnv: string;
+            flagKey: string;
+            flagName: string;
+            valueType: "boolean" | "json" | "number" | "string";
+          }[];
+          notAttempted: {
+            sourceEnv: string;
+            targetEnv: string;
+            flagKey: string;
+            flagName: string;
+            valueType: "boolean" | "json" | "number" | "string";
+          }[];
+          blockers: {
+            code: "CONFIGCAT_UNAVAILABLE" | "ENVIRONMENT_NOT_CONFIGURED" | "EXTERNAL_WRITE_FAILED" | "EXTERNAL_WRITE_OUTCOME_UNKNOWN" | "SELECTED_FLAG_ALREADY_EXISTS" | "SOURCE_FLAG_NOT_FOUND" | "TARGET_NOT_AFTER_SOURCE" | "UNSUPPORTED_FLAG";
+            severity: "blocking";
+            sourceEnv: string;
+            targetEnv?: string | undefined;
+            flagKey?: string | undefined;
+            message: string;
+          }[];
+        };
+        meta: TrpcMeta;
       }>;
     }>>;
   }>>;
@@ -5555,7 +6144,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         u2fPubKey: string | null;
         legacyViewAll: boolean;
         role: UserRole;
-        status: ActivationStatus;
+        status: ActivationStatus$1;
         isSuspended: boolean;
         gateType: GateUserType | null;
         gateId: number;
@@ -5568,26 +6157,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       activityTracer: ActivityTracer;
       core: RuntimeInternalApiCapabilityProvider;
     };
-    meta: {
-      [x: string]: unknown;
-    } & {
-      openapi?: {
-        enabled?: boolean;
-        method: import("trpc-to-openapi").OpenApiMethod;
-        path: `/${string}`;
-        operationId?: string;
-        summary?: string;
-        description?: string;
-        protect?: boolean;
-        tags?: string[];
-        contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-        deprecated?: boolean;
-        requestHeaders?: import("zod").ZodObject;
-        responseHeaders?: import("zod").ZodObject;
-        successDescription?: string;
-        errorResponses?: number[] | Record<number, string>;
-      };
-    } & RateLimitMetricsMeta & BackofficePermissionMeta;
+    meta: TrpcMeta;
     errorShape: {
       message: string;
       code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -7202,26 +7772,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
           }[] | undefined;
         })[];
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
     updateReportTaskResult: import("@trpc/server").TRPCMutationProcedure<{
       input: {
@@ -7241,26 +7792,26 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         generationTaskId: string;
         status: "COMPLETED" | "DELETED" | "FAILED" | "INITIAL" | "PURGED" | "SCHEDULED";
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
+    }>;
+    resolveAccounts: import("@trpc/server").TRPCMutationProcedure<{
+      input: {
+        workspaceName: string;
+        accounts: {
+          network: string;
+          index: number;
+          contractAddress?: string | null | undefined;
+        }[];
+      };
+      output: {
+        network: string;
+        index: number;
+        contractAddress: string | null;
+        name: string;
+        revaultId: string;
+        address: string | null;
+      }[];
+      meta: TrpcMeta;
     }>;
   }>>;
   workspaces: import("@trpc/server").TRPCBuiltRouter<{
@@ -7285,7 +7836,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         u2fPubKey: string | null;
         legacyViewAll: boolean;
         role: UserRole;
-        status: ActivationStatus;
+        status: ActivationStatus$1;
         isSuspended: boolean;
         gateType: GateUserType | null;
         gateId: number;
@@ -7298,26 +7849,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
       activityTracer: ActivityTracer;
       core: RuntimeInternalApiCapabilityProvider;
     };
-    meta: {
-      [x: string]: unknown;
-    } & {
-      openapi?: {
-        enabled?: boolean;
-        method: import("trpc-to-openapi").OpenApiMethod;
-        path: `/${string}`;
-        operationId?: string;
-        summary?: string;
-        description?: string;
-        protect?: boolean;
-        tags?: string[];
-        contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-        deprecated?: boolean;
-        requestHeaders?: import("zod").ZodObject;
-        responseHeaders?: import("zod").ZodObject;
-        successDescription?: string;
-        errorResponses?: number[] | Record<number, string>;
-      };
-    } & RateLimitMetricsMeta & BackofficePermissionMeta;
+    meta: TrpcMeta;
     errorShape: {
       message: string;
       code: import("@trpc/server").TRPC_ERROR_CODE_NUMBER;
@@ -7341,26 +7873,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         createdAt: Date;
         updatedAt: Date;
       }[];
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
     findByName: import("@trpc/server").TRPCQueryProcedure<{
       input: {
@@ -7373,26 +7886,7 @@ declare const internalAppRouter: import("@trpc/server").TRPCBuiltRouter<{
         createdAt: Date;
         updatedAt: Date;
       };
-      meta: {
-        [x: string]: unknown;
-      } & {
-        openapi?: {
-          enabled?: boolean;
-          method: import("trpc-to-openapi").OpenApiMethod;
-          path: `/${string}`;
-          operationId?: string;
-          summary?: string;
-          description?: string;
-          protect?: boolean;
-          tags?: string[];
-          contentTypes?: import("trpc-to-openapi").OpenApiContentType[];
-          deprecated?: boolean;
-          requestHeaders?: import("zod").ZodObject;
-          responseHeaders?: import("zod").ZodObject;
-          successDescription?: string;
-          errorResponses?: number[] | Record<number, string>;
-        };
-      } & RateLimitMetricsMeta & BackofficePermissionMeta;
+      meta: TrpcMeta;
     }>;
   }>>;
 }>>;