@meshmakers/octo-services 3.4.1450 → 3.4.1490

package/fesm2022/meshmakers-octo-services.mjs

@@ -1,14 +1,14 @@
 import * as i0 from '@angular/core';
 import { inject, Injector, Injectable, InjectionToken, NgModule, makeEnvironmentProviders } from '@angular/core';
 import { onError } from '@apollo/client/link/error';
-import { MessageService, DataSourceBase, PagedResultDto, provideMmSharedServices } from '@meshmakers/shared-services';
+import { MessageService, MM_CALLER_HANDLED_STATUSES, DataSourceBase, PagedResultDto, provideMmSharedServices } from '@meshmakers/shared-services';
 import { ApolloLink, InMemoryCache } from '@apollo/client/core';
 import { CombinedGraphQLErrors } from '@apollo/client';
 import * as i1 from 'apollo-angular';
 import { gql } from 'apollo-angular';
 import { map, catchError, finalize } from 'rxjs/operators';
 import { of, firstValueFrom, map as map$1, Subject, throwError, from, filter } from 'rxjs';
-import { HttpClient, HttpParams, HttpErrorResponse, HttpHeaders } from '@angular/common/http';
+import { HttpClient, HttpParams, HttpErrorResponse, HttpContext, HttpHeaders } from '@angular/common/http';
 import { Upload } from 'tus-js-client';
 import { AuthorizeService } from '@meshmakers/shared-auth';
 
@@ -21,6 +21,12 @@ class OctoServiceOptions {
     }
 }
 
+/**
+ * Operation context flag: errors of an operation with `context: { [OCTO_SILENT_ERRORS]: true }`
+ * are logged to the console only, never shown as a toast. For best-effort background reads whose
+ * caller handles the failure itself (e.g. the Settings counts, AB#5523).
+ */
+const OCTO_SILENT_ERRORS = 'octoSilentErrors';
 class OctoErrorLink extends ApolloLink {
     errorLink;
     injector = inject(Injector);
@@ -28,8 +34,12 @@ class OctoErrorLink extends ApolloLink {
         super();
         // There is currently no other way to inject a service into an Apollo Link,
         // because Apollo deprecated without replacement
-        this.errorLink = onError(({ error }) => {
+        this.errorLink = onError(({ error, operation }) => {
             if (error) {
+                if (OctoErrorLink.isSilent(operation)) {
+                    console.warn(`GraphQL error in ${operation?.operationName ?? 'operation'} (not shown)`, error);
+                    return;
+                }
                 if (error instanceof CombinedGraphQLErrors) {
                     this.showError(error);
                 }
@@ -43,6 +53,15 @@ class OctoErrorLink extends ApolloLink {
             // lets the original error propagate to the caller's own error handling.
         });
     }
+    /** True when the operation opted out of error toasts ({@link OCTO_SILENT_ERRORS}). */
+    static isSilent(operation) {
+        try {
+            return operation?.getContext?.()?.[OCTO_SILENT_ERRORS] === true;
+        }
+        catch {
+            return false;
+        }
+    }
     showErrorLike(error) {
         // Network connectivity errors (HTTP status 0) are already handled by MmHttpErrorInterceptor
         // which either shows the connection error overlay (via ON_CONNECTION_LOST) or a toast.
@@ -200,6 +219,258 @@ class LevelMetaData {
     }
 }
 
+/**
+ * SECRET value type (AB#5528) — frontend contract types and helpers (AB#5542).
+ *
+ * Contract: `octo-construction-kit-engine/docs/secret-frontend-handover.md` §2 (asset repository
+ * GraphQL) and §4/§8 (identity providers REST). Field names are binding.
+ *
+ * The generated `globalTypes.ts` carries the SECRET round-2 schema (`OctoSecretStateDto { isSet
+ * keyMissing setAt }`, `secretIsSet` / `secretKeyMissing` / `secretSetAt`, `clearSecretAttributes`,
+ * `Query.secrets`). The shapes below accept the generated DTOs structurally; `keyMissing` / `setAt`
+ * stay optional so documents (or older backends) without them still map, and `setAt` accepts the
+ * ISO string Apollo actually delivers as well as a `Date`.
+ *
+ * Rules (decisions 2026-10-06):
+ * - A secret is never read. Typed fields select `{ isSet keyMissing setAt }`, generic attribute
+ *   lists select `secretIsSet secretKeyMissing secretSetAt` (`value` is always null for secrets).
+ * - Input: a non-empty string sets / rotates; omitted, `null` or `""` keeps the stored value.
+ *   Clearing is explicit: the camelCase name goes into `clearSecretAttributes` (only optional
+ *   secrets; a new value and a clear for the same field in one request are rejected).
+ * - Placeholders (`<…>`, `TODO_SET_*`) have no meaning — they are ordinary values.
+ * - `keyMissing` (value stored, key id unknown in this environment) reads as `isSet: false` for
+ *   consumers; the UI shows "Key missing — re-enter".
+ */
+/** The CK value type name of a secret attribute as reported by the CK model API (`AttributeValueTypesDto.Secret = 17`). */
+const SECRET_VALUE_TYPE = 'SECRET';
+/** Whether a CK value type is the SECRET value type (case-insensitive). */
+function isSecretValueType(valueType) {
+    return !!valueType && valueType.toUpperCase() === SECRET_VALUE_TYPE;
+}
+function toDate(value) {
+    if (!value)
+        return null;
+    const d = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(d.getTime()) ? null : d;
+}
+/** Normalises a typed `OctoSecretState` (null/undefined = not set). */
+function toSecretState(state) {
+    return {
+        isSet: state?.isSet === true,
+        keyMissing: state?.keyMissing === true,
+        setAt: toDate(state?.setAt),
+    };
+}
+/**
+ * The secret state of a generic attribute, or `null` when the attribute is not a secret
+ * (`secretIsSet` is null for every non-secret attribute).
+ */
+function secretStateFromAttribute(attribute) {
+    if (!attribute || (attribute.secretIsSet !== true && attribute.secretIsSet !== false))
+        return null;
+    return {
+        isSet: attribute.secretIsSet,
+        keyMissing: attribute.secretKeyMissing === true,
+        setAt: toDate(attribute.secretSetAt),
+    };
+}
+/**
+ * Whether a value is a secret state object (`{ isSet }` marker or a {@link SecretState}) rather than
+ * a plain value — e.g. a SECRET record member read through the generic API. Only objects whose keys
+ * are a subset of `isSet` / `keyMissing` / `setAt` with a boolean `isSet` qualify.
+ */
+function isSecretStateObject(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || value instanceof Date)
+        return false;
+    const record = value;
+    return typeof record['isSet'] === 'boolean'
+        && Object.keys(record).every((k) => k === 'isSet' || k === 'keyMissing' || k === 'setAt' || k === '__typename');
+}
+/** Display status: key missing wins (it implies `isSet: false`), then set / not set. */
+function secretStatusOf(state) {
+    if (state?.keyMissing)
+        return 'keyMissing';
+    return state?.isSet ? 'set' : 'notSet';
+}
+/**
+ * Whether a secret counts as present for "required" checks: set, or stored but unreadable (the
+ * server treats a key-missing secret as present, handover §2).
+ */
+function isSecretPresent(state) {
+    return state?.isSet === true || state?.keyMissing === true;
+}
+/**
+ * The wire value of a typed secret input: the string when the user typed one, else `undefined`
+ * (= omit = keep). Never trims — whitespace can be part of a secret.
+ */
+function secretInputValue(typed) {
+    return typeof typed === 'string' && typed.length > 0 ? typed : undefined;
+}
+const DEFAULT_SECRET_STATUS_LABELS = {
+    set: 'Set',
+    setAt: 'Set · set at {setAt}',
+    notSet: 'Not set',
+    keyMissing: 'Key missing — re-enter',
+};
+/**
+ * Human-readable status: "Set · set at …" / "Set" (legacy, no timestamp) / "Not set" /
+ * "Key missing — re-enter".
+ */
+function formatSecretStatus(state, formatDate = (d) => d.toLocaleString(), labels = DEFAULT_SECRET_STATUS_LABELS) {
+    switch (secretStatusOf(state)) {
+        case 'keyMissing':
+            return labels.keyMissing;
+        case 'set':
+            return state?.setAt ? labels.setAt.replace('{setAt}', formatDate(state.setAt)) : labels.set;
+        default:
+            return labels.notSet;
+    }
+}
+
+/**
+ * Secret-safe attribute selection for generic runtime GraphQL documents (AB#5542).
+ *
+ * The generic `attributes` field of `RtEntity` / `RtAssociation` returns EVERY attribute of the
+ * entity — passwords, client secrets, API keys included — when its `attributeNames` argument is
+ * omitted (or bound to a variable the caller leaves `undefined`). Until the SECRET value type
+ * (AB#5528) lets the server mask those values, every generic document must pass an explicit,
+ * non-nullable list, and callers that derive the list from CK metadata must leave out
+ * credential-like attributes. These helpers are that rule in one place:
+ *
+ * - {@link isCredentialLikeAttributeName}: the name heuristic (suffix based, camelCase or PascalCase).
+ * - {@link isSecretAttributeCandidate}: THE rule — explicit decision, `secret` CK metadata, else the
+ *   name heuristic for textual value types only.
+ * - {@link toAttributeNameFilter}: name-only list for read-only callers without type information.
+ * - {@link toUniqueCamelCaseNames}: camelCase + de-duplication for type-aware callers.
+ * The server compares camelCase names only, and one list also filters the sub-attributes of records.
+ *
+ * SECRET value type (AB#5528): an attribute whose value type is `SECRET` is ALWAYS a secret — no
+ * explicit decision or metadata can opt it out. The server never projects its value (`value` is
+ * null, `secretIsSet` / `{ isSet }` report the state, see `secret-state.ts`). The metadata marker
+ * and the name heuristic remain only as the FALLBACK for non-SECRET attributes (models that have
+ * not switched their credentials to SECRET yet, handover note §1 phase 2 before phase 3).
+ */
+/**
+ * Credential-like name suffixes (lower case). Matched against the END of the attribute name so
+ * that `password`, `adminPassword`, `privateKeyPassphrase`, `clientSecret`, `botToken`,
+ * `refreshToken`, `apiKey`, `secretKey`, `connectionString` match, while `maxTokens`,
+ * `tokensPerDay`, `tokenEndpoint` or `receivesClusterSecrets` do not.
+ */
+const CREDENTIAL_ATTRIBUTE_NAME_SUFFIXES = [
+    'password',
+    'passphrase',
+    'secret',
+    'secretkey',
+    'token',
+    'apikey',
+    'privatekey',
+    'connectionstring',
+    'credential',
+    'credentials',
+    'encryptedvalue',
+];
+/** CK value types that can carry a credential (anything textual). */
+const TEXTUAL_VALUE_TYPES = new Set(['STRING', 'STRING_ARRAY']);
+/** Lower-cases the first character, like the server's `ToCamelCase` used by the `attributeNames` filter. */
+function toCamelCaseAttributeName(name) {
+    return name.length === 0 ? name : name.charAt(0).toLowerCase() + name.slice(1);
+}
+/** Whether an attribute name looks like a credential (password, secret, token, API key, …). */
+function isCredentialLikeAttributeName(name) {
+    if (!name)
+        return false;
+    const normalised = name.replace(/[^a-zA-Z0-9]/g, '').toLowerCase();
+    return CREDENTIAL_ATTRIBUTE_NAME_SUFFIXES.some((suffix) => normalised.endsWith(suffix));
+}
+/** Whether a CK value type can hold a credential (textual). `undefined` (unknown) counts as textual. */
+function isTextualValueType(valueType) {
+    return !valueType || TEXTUAL_VALUE_TYPES.has(valueType.toUpperCase());
+}
+/**
+ * THE credential rule of the frontend (AB#5542; entity forms, runtime browser, meshboard, Data
+ * Explorer all use it). An attribute is a secret candidate when
+ * 0. its value type is `SECRET` (always; cannot be opted out), else
+ * 1. the caller decided explicitly (`secret: true|false`, e.g. form `Secret: false` opts out), else
+ * 2. its CK metadata says `secret: true|false`, else
+ * 3. it is TEXTUAL (`STRING`, `STRING_ARRAY`, unknown) and its name is credential-like
+ *    ({@link isCredentialLikeAttributeName}). Non-textual attributes (`isSecret: BOOLEAN`,
+ *    `maxTokens: INT`, a `credentials` RECORD) are never secrets by name.
+ */
+function isSecretAttributeCandidate(attribute) {
+    if (isSecretValueType(attribute.attributeValueType))
+        return true;
+    if (attribute.secret === true || attribute.secret === false)
+        return attribute.secret;
+    const marker = (attribute.metaData ?? []).find((m) => !!m && m.key?.toLowerCase() === 'secret');
+    if (marker) {
+        const value = (marker.value ?? '').trim().toLowerCase();
+        if (value === 'true')
+            return true;
+        if (value === 'false')
+            return false;
+    }
+    if (!isTextualValueType(attribute.attributeValueType))
+        return false;
+    return isCredentialLikeAttributeName(attribute.attributeName);
+}
+/** camelCase, de-duplicated, without empty entries — no secret filtering (callers decided already). */
+function toUniqueCamelCaseNames(names) {
+    const result = [];
+    const seen = new Set();
+    for (const name of names) {
+        if (!name)
+            continue;
+        const camel = toCamelCaseAttributeName(name);
+        if (seen.has(camel))
+            continue;
+        seen.add(camel);
+        result.push(camel);
+    }
+    return result;
+}
+/**
+ * Builds the value of an `attributeNames` argument from names WITHOUT type information (widget
+ * configuration, user-picked fields): camelCase, de-duplicated, without empty and credential-like
+ * names. Because the type is unknown, the name rule is applied conservatively — use it only for
+ * READ-ONLY displays. Anything that is written back must derive its list type-aware
+ * ({@link isSecretAttributeCandidate}, octo-ui `SecretSafeAttributeNamesService`), otherwise a
+ * dropped non-secret attribute (`isSecret: BOOLEAN`) would be saved back empty.
+ * Always returns an array, so a `[String!]!` variable can never fall back to "all attributes".
+ */
+function toAttributeNameFilter(names) {
+    return toUniqueCamelCaseNames([...names].filter((name) => !isCredentialLikeAttributeName(name)));
+}
+/**
+ * Whether a query column (`attributePath` such as `password`, `endpoint.apiKey`,
+ * `parent->clientSecret`) is a secret candidate: its last path segment by the shared rule.
+ * Column pickers hide these so users cannot add credential columns to runtime queries
+ * (AB#5542 — query rows would project the value).
+ */
+function isSecretQueryColumn(attributePath, attributeValueType) {
+    if (!attributePath)
+        return false;
+    const lastSegment = attributePath.split(/->|\.|\//).pop() ?? attributePath;
+    return isSecretAttributeCandidate({ attributeName: lastSegment, attributeValueType });
+}
+
+/**
+ * Bot services REST DTOs of the SECRET value type administration (AB#5528 / AB#5544, frontend
+ * handover §9). Mirror `Meshmakers.Octo.Communication.Contracts.DataTransferObjects`
+ * (`SecretEnvironmentStatusDto`, `SecretSweepRunDto`, `SecretSweepDumpDto`,
+ * `SecretFormCountsReportDto`); enums travel as names, JSON is camelCase, timestamps are ISO-8601
+ * strings. No DTO ever carries a secret value.
+ */
+/** `SecretEnvironmentStatusDto.warnings` codes (handover §9/§14). */
+const SECRET_STATUS_WARNING_NO_KEY_RING = 'NoKeyRing';
+const SECRET_STATUS_WARNING_NO_LEGACY_V1_KEY = 'NoLegacyV1Key';
+/** An existing encrypted dump's key id is not in the key ring: that dump cannot be restored (handover §14). */
+const SECRET_STATUS_WARNING_DUMP_KEY_MISSING = 'DumpKeyMissing';
+/** The pseudo key id of a legacy enc:v1 value (handover §10); shown as "legacy key (enc:v1)". */
+const SECRET_LEGACY_V1_KEY_ID = 'enc:v1';
+/** Error codes of the dump restore (`statusDescription` of the 409 body, handover §14). */
+const SECRET_DUMP_RESTORE_ERROR_DUMP_DELETED = 'DumpDeleted';
+const SECRET_DUMP_RESTORE_ERROR_DUMP_KEY_MISSING = 'DumpKeyMissing';
+
 var HealthStatus;
 (function (HealthStatus) {
     /*
@@ -358,6 +629,14 @@ var AssociationModOptionsDto;
     AssociationModOptionsDto["CreateDto"] = "CREATE";
     AssociationModOptionsDto["DeleteDto"] = "DELETE";
 })(AssociationModOptionsDto || (AssociationModOptionsDto = {}));
+/** Who owns an attribute value, and therefore what installing the blueprint again does to it (AB#5187). SEED_OWNED: the blueprint owns the value - re-applying the blueprint OVERWRITES whatever the tenant has, and the value is carried in an exported runtime model. TENANT_OWNED: the tenant owns the value - re-applying the blueprint KEEPS the tenant's value and only seeds it on a fresh tenant, and the value IS still carried in an exported runtime model. RUNTIME_STATE: a service, operator, pipeline or job writes the value - re-applying the blueprint KEEPS it, and it is NOT carried in an exported runtime model. SECRET: a credential such as an API key, client secret, token or password - re-applying the blueprint KEEPS it, and it is NOT carried in an exported runtime model. */
+var AttributeOwnershipDto;
+(function (AttributeOwnershipDto) {
+    AttributeOwnershipDto["RuntimeStateDto"] = "RUNTIME_STATE";
+    AttributeOwnershipDto["SecretDto"] = "SECRET";
+    AttributeOwnershipDto["SeedOwnedDto"] = "SEED_OWNED";
+    AttributeOwnershipDto["TenantOwnedDto"] = "TENANT_OWNED";
+})(AttributeOwnershipDto || (AttributeOwnershipDto = {}));
 /** Enum of valid attribute types */
 var AttributeValueTypeDto;
 (function (AttributeValueTypeDto) {
@@ -377,6 +656,7 @@ var AttributeValueTypeDto;
     AttributeValueTypeDto["IntArrayDto"] = "INT_ARRAY";
     AttributeValueTypeDto["RecordDto"] = "RECORD";
     AttributeValueTypeDto["RecordArrayDto"] = "RECORD_ARRAY";
+    AttributeValueTypeDto["SecretDto"] = "SECRET";
     AttributeValueTypeDto["StringDto"] = "STRING";
     AttributeValueTypeDto["StringArrayDto"] = "STRING_ARRAY";
     AttributeValueTypeDto["TimeSpanDto"] = "TIME_SPAN";
@@ -982,6 +1262,30 @@ var SearchFilterTypesDto;
     SearchFilterTypesDto["AttributeFilterDto"] = "ATTRIBUTE_FILTER";
     SearchFilterTypesDto["TextSearchDto"] = "TEXT_SEARCH";
 })(SearchFilterTypesDto || (SearchFilterTypesDto = {}));
+/** Storage form of a secret value. Never the value. */
+var SecretStorageFormDto;
+(function (SecretStorageFormDto) {
+    /** Stored value cannot be parsed (reads as not set, warning logged). */
+    SecretStorageFormDto["CorruptDto"] = "CORRUPT";
+    /** Legacy enc:v1 (instance key). */
+    SecretStorageFormDto["EncV1Dto"] = "ENC_V1";
+    /** Protected, key id known. */
+    SecretStorageFormDto["EncV2Dto"] = "ENC_V2";
+    /** Protected, key id not in this environment's key ring. */
+    SecretStorageFormDto["KeyMissingDto"] = "KEY_MISSING";
+    /** Null or missing. */
+    SecretStorageFormDto["NotSetDto"] = "NOT_SET";
+    /** Legacy clear text still stored (before the Encrypt sweep). */
+    SecretStorageFormDto["PlaintextDto"] = "PLAINTEXT";
+})(SecretStorageFormDto || (SecretStorageFormDto = {}));
+/** How a RevealSecret@1 node refers to a secret. */
+var SecretUsageMatchDto;
+(function (SecretUsageMatchDto) {
+    /** The node resolves the entity at run time (rtIdPath) on the same CK type and attribute. */
+    SecretUsageMatchDto["ByTypeDto"] = "BY_TYPE";
+    /** The node names the CK type, rtId and attribute of the secret. */
+    SecretUsageMatchDto["ExactDto"] = "EXACT";
+})(SecretUsageMatchDto || (SecretUsageMatchDto = {}));
 /** Civil-boundary policy for a series query that spans multiple reference time zones (AB#4190). */
 var SeriesComparisonPolicyDto;
 (function (SeriesComparisonPolicyDto) {
@@ -1490,6 +1794,14 @@ var SystemStreamDataCkComputedColumnStateDto;
     /** A backfill has been scheduled for this computed column but has not started yet. Consumers still see the previous archive state. */
     SystemStreamDataCkComputedColumnStateDto["PendingDto"] = "PENDING";
 })(SystemStreamDataCkComputedColumnStateDto || (SystemStreamDataCkComputedColumnStateDto = {}));
+/** Runtime entities of construction kit enum 'System.StreamData/CkConflictKeyOrder' */
+var SystemStreamDataCkConflictKeyOrderDto;
+(function (SystemStreamDataCkConflictKeyOrderDto) {
+    /** The greater value is the better one. Use for timestamps, sequence numbers and versions, where later or higher supersedes earlier. */
+    SystemStreamDataCkConflictKeyOrderDto["HigherWinsDto"] = "HIGHER_WINS";
+    /** The smaller value is the better one. Use for rank-like codes numbered best-first, where a lower code must never be displaced by a higher one. */
+    SystemStreamDataCkConflictKeyOrderDto["LowerWinsDto"] = "LOWER_WINS";
+})(SystemStreamDataCkConflictKeyOrderDto || (SystemStreamDataCkConflictKeyOrderDto = {}));
 /** Runtime entities of construction kit enum 'System.StreamData/CkRecomputeChangeKind' */
 var SystemStreamDataCkRecomputeChangeKindDto;
 (function (SystemStreamDataCkRecomputeChangeKindDto) {
@@ -1752,6 +2064,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -2116,6 +2429,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -2585,6 +2899,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -2758,6 +3073,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -2930,6 +3246,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -3102,6 +3419,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -3274,6 +3592,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -3446,6 +3765,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -3618,6 +3938,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -3739,6 +4060,7 @@ const result = {
             "SystemUIBranding",
             "SystemUIDashboard",
             "SystemUIDashboardWidget",
+            "SystemUIEntityForm",
             "SystemUIMappingCoverageConfiguration",
             "SystemUIProcessDiagram",
             "SystemUISymbolDefinition",
@@ -4039,8 +4361,12 @@ class AttributeSelectorService {
             if (!type) {
                 return { items: [], totalCount: 0 };
             }
-            const items = (type.availableQueryColumns?.items || [])
-                .filter((item) => item !== null)
+            const all = (type.availableQueryColumns?.items || [])
+                .filter((item) => item !== null);
+            // Credential columns are never offered (SECRET-safe, AB#5542): a runtime query row would
+            // project their value in clear text.
+            const items = all
+                .filter(item => !isSecretQueryColumn(item.attributePath, item.attributeValueType))
                 .map(item => ({
                 attributePath: item.attributePath,
                 attributeValueType: item.attributeValueType,
@@ -4048,7 +4374,7 @@ class AttributeSelectorService {
             }));
             return {
                 items,
-                totalCount: type.availableQueryColumns?.totalCount || 0
+                totalCount: Math.max(0, (type.availableQueryColumns?.totalCount || 0) - (all.length - items.length))
             };
         }));
     }
@@ -5009,6 +5335,169 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.5", ngImpor
                 }]
         }] });
 
+/**
+ * Bot services REST client of the SECRET value type administration (AB#5528 / AB#5544, frontend
+ * handover §9): environment encryption status, tenant secret sweeps and their pre-sweep dumps.
+ * Like {@link BotService}, every call takes the tenant explicitly and addresses
+ * `{botServices}{tenantId}/v1/...`. Methods return `null` when the bot service URL is not
+ * configured; HTTP errors (403 missing role, 400 `ConfirmationRequired`) are rethrown as
+ * `HttpErrorResponse` for the caller.
+ *
+ * Roles (handover §6, §14): status — any user with tenant access; sweep runs — `AdminPanelManagement`;
+ * starting a sweep, deleting a dump and restoring a dump — `SecretManagement`.
+ *
+ * Tenant (handover §13, §14): the `{tenantId}/v1/secrets/...` routes (status, sweep runs, dump
+ * delete, dump restore) accept only the token's OWN tenant — always pass the current tenant, never a child tenant
+ * (child-tenant links only navigate into that tenant). A restore appears as a run with
+ * `trigger: Restore`, mode `Encrypt` and `dump: null`.
+ */
+class BotSecretsService {
+    httpClient = inject(HttpClient);
+    configurationService = inject(CONFIGURATION_SERVICE);
+    baseUrl(tenantId) {
+        const botServicesUrl = this.configurationService.config?.botServices;
+        return botServicesUrl ? `${botServicesUrl}${tenantId}/v1/` : null;
+    }
+    /** `GET {tenantId}/v1/secrets/status` — environment-level, identical in every tenant. */
+    async getSecretEnvironmentStatus(tenantId) {
+        const baseUrl = this.baseUrl(tenantId);
+        if (!baseUrl)
+            return null;
+        return firstValueFrom(this.httpClient.get(`${baseUrl}secrets/status`));
+    }
+    /**
+     * `POST {tenantId}/v1/jobs/secret-sweep?mode=&confirm=` — Encrypt and CleanupUnreadable need
+     * `confirm = true` (the server answers `400 ConfirmationRequired` otherwise and takes a
+     * pre-sweep dump first). Role `SecretManagement`.
+     */
+    async startSecretSweep(tenantId, mode, confirm = false) {
+        const baseUrl = this.baseUrl(tenantId);
+        if (!baseUrl)
+            return null;
+        let params = new HttpParams().set('mode', mode);
+        if (confirm) {
+            params = params.set('confirm', true);
+        }
+        return firstValueFrom(this.httpClient.post(`${baseUrl}jobs/secret-sweep`, null, { params }));
+    }
+    /**
+     * `GET {tenantId}/v1/jobs/secret-sweep/report` — the last sweep report of the tenant (counts,
+     * unreadable / cleared references, never values); `null` when there is none (`404`) or the bot
+     * service URL is not configured. Role `AdminPanelManagement`.
+     */
+    async getSecretSweepReport(tenantId) {
+        const baseUrl = this.baseUrl(tenantId);
+        if (!baseUrl)
+            return null;
+        try {
+            return await firstValueFrom(this.httpClient.get(`${baseUrl}jobs/secret-sweep/report`));
+        }
+        catch (error) {
+            if (error instanceof HttpErrorResponse && error.status === 404)
+                return null;
+            throw error;
+        }
+    }
+    /**
+     * `GET {tenantId}/v1/secrets/sweep-runs?limit=` — newest first. Role `AdminPanelManagement`.
+     * A `403` is rethrown WITHOUT the global "Access denied" toast (`MM_CALLER_HANDLED_STATUSES`): the
+     * caller explains it in place.
+     */
+    async getSecretSweepRuns(tenantId, limit = 20) {
+        const baseUrl = this.baseUrl(tenantId);
+        if (!baseUrl)
+            return null;
+        const params = new HttpParams().set('limit', limit);
+        const context = new HttpContext().set(MM_CALLER_HANDLED_STATUSES, [403]);
+        return (await firstValueFrom(this.httpClient.get(`${baseUrl}secrets/sweep-runs`, { params, context }))) ?? [];
+    }
+    /**
+     * `DELETE {tenantId}/v1/secrets/sweep-runs/{runId}/dump` — deletes a pre-sweep dump before it
+     * expires. `404` (unknown run / no dump) and `409` (already deleted) map to a result instead of an
+     * error; other errors (e.g. `403` without `SecretManagement`) are rethrown.
+     */
+    async deleteSecretSweepDump(tenantId, runId) {
+        const baseUrl = this.baseUrl(tenantId);
+        if (!baseUrl)
+            return null;
+        try {
+            await firstValueFrom(this.httpClient.delete(`${baseUrl}secrets/sweep-runs/${encodeURIComponent(runId)}/dump`));
+            return 'Deleted';
+        }
+        catch (error) {
+            if (error instanceof HttpErrorResponse && error.status === 404)
+                return 'NotFound';
+            if (error instanceof HttpErrorResponse && error.status === 409)
+                return 'AlreadyDeleted';
+            throw error;
+        }
+    }
+    /**
+     * `POST {tenantId}/v1/secrets/sweep-runs/{runId}/restore-dump?confirm=` (handover §14, AB#5559) —
+     * restores the run's pre-sweep dump into the tenant (replaces the tenant database, then a Verify
+     * runs). Role `SecretManagement`, own tenant only; `confirm = true` only after the user confirmed.
+     * 🔴 A dump taken before the first Encrypt holds plaintext secrets: restoring it brings them back.
+     *
+     * Every documented answer (200 / 400 / 403 / 404 / 409) is mapped to a
+     * {@link SecretSweepDumpRestoreResult} and kept away from the global error toast
+     * (`MM_CALLER_HANDLED_STATUSES`); other errors (network, 5xx) are rethrown.
+     */
+    async restoreSecretSweepDump(tenantId, runId, confirm = false) {
+        const baseUrl = this.baseUrl(tenantId);
+        if (!baseUrl)
+            return null;
+        let params = new HttpParams();
+        if (confirm) {
+            params = params.set('confirm', true);
+        }
+        const context = new HttpContext().set(MM_CALLER_HANDLED_STATUSES, [400, 403, 404, 409]);
+        try {
+            const response = await firstValueFrom(this.httpClient.post(`${baseUrl}secrets/sweep-runs/${encodeURIComponent(runId)}/restore-dump`, null, { params, context }));
+            return { status: 'Started', jobId: response?.jobId ?? '' };
+        }
+        catch (error) {
+            if (!(error instanceof HttpErrorResponse))
+                throw error;
+            const message = errorMessageOf(error);
+            switch (error.status) {
+                case 400:
+                    return { status: 'ConfirmationRequired', message };
+                case 403:
+                    return { status: 'Forbidden', message };
+                case 404:
+                    return { status: 'NotFound', message };
+                case 409:
+                    return { status: errorCodeOf(error) === SECRET_DUMP_RESTORE_ERROR_DUMP_KEY_MISSING ? 'DumpKeyMissing' : 'DumpDeleted', message };
+                default:
+                    throw error;
+            }
+        }
+    }
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.1.5", ngImport: i0, type: BotSecretsService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.1.5", ngImport: i0, type: BotSecretsService, providedIn: 'root' });
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.5", ngImport: i0, type: BotSecretsService, decorators: [{
+            type: Injectable,
+            args: [{ providedIn: 'root' }]
+        }] });
+/** The code of a bot error body (`statusDescription`, handover §12; `code` / `errorCode` tolerated). */
+function errorCodeOf(error) {
+    const body = error.error;
+    const code = body && typeof body === 'object' ? (body.code ?? body.errorCode ?? body.statusDescription) : null;
+    if (typeof code === 'string')
+        return code;
+    // A body that arrives as text (no JSON content type) still names the code.
+    if (typeof error.error === 'string' && error.error.includes(SECRET_DUMP_RESTORE_ERROR_DUMP_KEY_MISSING)) {
+        return SECRET_DUMP_RESTORE_ERROR_DUMP_KEY_MISSING;
+    }
+    return null;
+}
+/** The value-free message of a bot error body, if any. */
+function errorMessageOf(error) {
+    const body = error.error;
+    return body && typeof body === 'object' && typeof body.message === 'string' && body.message ? body.message : null;
+}
+
 class HealthService {
     httpClient = inject(HttpClient);
     configurationService = inject(CONFIGURATION_SERVICE);
@@ -5098,6 +5587,105 @@ class IdentityService {
         }
         return null;
     }
+    /**
+     * Reads one page of the slim user directory of the current tenant
+     * (`GET {tenant}/v1/users/directory?skip=&take=&search=`, AB#5859): id and display name only.
+     *
+     * Unlike {@link getUsers} (`users/getPaged`, which requires the `UserManagement` role once the
+     * identity service enforces tenant roles), the directory is available to any signed-in user of
+     * the own tenant — the token's tenant must equal the route tenant. It is meant for pickers
+     * (group members, assignees, ...) that need nothing but a user id and a name.
+     *
+     * Availability: introduced on the identity branch `feat/gerald/identity-rest-role-authz`, not yet
+     * released. Identity versions without the endpoint answer **404**; the error is propagated as
+     * `HttpErrorResponse`. Use {@link getUserDirectoryWithFallback} to transparently fall back to
+     * `users/getPaged` on such versions.
+     *
+     * @param skip Number of entries to skip (negative values are treated as 0).
+     * @param take Page size; clamped to 1..500 (the server limit). Non-finite values use 100.
+     * @param search Optional case-insensitive substring of the display name; omitted when empty.
+     *   The server never matches user names or e-mail addresses.
+     * @returns The page (sorted by display name, then id), or `null` when no identity URL is configured.
+     */
+    async getUserDirectory(skip, take, search) {
+        const baseUrl = await this.getApiBaseUrl();
+        if (!baseUrl) {
+            return null;
+        }
+        return this.fetchUserDirectory(baseUrl, skip, take, search);
+    }
+    /**
+     * Like {@link getUserDirectory}, but falls back to `users/getPaged` when the identity service does
+     * not know the directory endpoint yet (404). The missing capability is remembered per tenant for
+     * the lifetime of this (root) service, so the 404 is hit at most once per tenant and session.
+     *
+     * The fallback maps {@link UserDto} to {@link UserDirectoryEntryDto} with the server's display
+     * name rule ("First Last", else the user name) and applies `search` to the returned page only —
+     * it is a best-effort bridge for old identity versions, and it still needs `UserManagement`
+     * wherever `getPaged` requires it. Errors other than the 404 (401, 403, 5xx, ...) are propagated.
+     */
+    async getUserDirectoryWithFallback(skip, take, search) {
+        const baseUrl = await this.getApiBaseUrl();
+        if (!baseUrl) {
+            return null;
+        }
+        if (!this.tenantsWithoutUserDirectory.has(baseUrl)) {
+            try {
+                return await this.fetchUserDirectory(baseUrl, skip, take, search);
+            }
+            catch (error) {
+                if (!(error instanceof HttpErrorResponse) || error.status !== 404) {
+                    throw error;
+                }
+                this.tenantsWithoutUserDirectory.add(baseUrl);
+            }
+        }
+        const page = await this.getUsers(Math.max(0, Math.trunc(skip) || 0), IdentityService.clampDirectoryTake(take));
+        if (!page) {
+            return null;
+        }
+        const term = search?.trim().toLowerCase() ?? '';
+        const list = (page.list ?? [])
+            .map(user => IdentityService.toUserDirectoryEntry(user))
+            .filter(entry => !term || entry.displayName.toLowerCase().includes(term));
+        return {
+            skip: page.skip,
+            take: page.take,
+            totalCount: term ? list.length : page.totalCount,
+            list
+        };
+    }
+    /** Base URLs (= tenants) whose identity service answered 404 for `users/directory`. */
+    tenantsWithoutUserDirectory = new Set();
+    static maxUserDirectoryPageSize = 500;
+    static clampDirectoryTake(take) {
+        if (!Number.isFinite(take)) {
+            return 100;
+        }
+        return Math.min(IdentityService.maxUserDirectoryPageSize, Math.max(1, Math.trunc(take)));
+    }
+    static toUserDirectoryEntry(user) {
+        const fullName = [user.firstName, user.lastName]
+            .filter(n => !!n && n.trim().length > 0)
+            .map(n => n.trim())
+            .join(' ');
+        return { userId: user.userId, displayName: fullName.length > 0 ? fullName : (user.name ?? '') };
+    }
+    async fetchUserDirectory(baseUrl, skip, take, search) {
+        let params = new HttpParams()
+            .set('skip', Math.max(0, Math.trunc(skip) || 0).toString())
+            .set('take', IdentityService.clampDirectoryTake(take).toString());
+        const term = search?.trim();
+        if (term) {
+            // HttpParams URL-encodes the value.
+            params = params.set('search', term);
+        }
+        const response = await firstValueFrom(this.httpClient.get(baseUrl + 'users/directory', {
+            params,
+            observe: 'response'
+        }));
+        return response.body;
+    }
     async getUserDetails(userName) {
         const baseUrl = await this.getApiBaseUrl();
         if (baseUrl) {
@@ -5890,7 +6478,12 @@ class JobManagementService {
             link.click();
         }
     }
-    async waitForJob(jobId, title, operation) {
+    /**
+     * Polls a job until it ends and shows its error on failure.
+     * @param formatErrorDetails optional formatter for the failure text, e.g. to append an explanation
+     *   of known message codes (the Studio explains the SECRET compiler messages of a CK import, AB#5544).
+     */
+    async waitForJob(jobId, title, operation, formatErrorDetails) {
         let cancelled = false;
         const progressSubject = new Subject();
         const progressDialog = this.progressWindowService.showIndeterminateProgress(title, progressSubject.asObservable(), {
@@ -5916,7 +6509,7 @@ class JobManagementService {
                 }
                 else {
                     const errorDetails = jobDto.errorMessage || jobDto.reason || 'Unknown error';
-                    this.messageService.showErrorWithDetails(errorDetails, operation);
+                    this.messageService.showErrorWithDetails(formatErrorDetails ? formatErrorDetails(errorDetails) : errorDetails, operation);
                 }
                 break;
             }
@@ -6024,8 +6617,16 @@ class CommunicationService {
      * supplied UTC timestamp are returned, keeping subsequent refreshes light.
      */
     async getAdapterMetrics(tenantId, adapterRtId, adapterCkTypeId, since) {
+        return (await this.getAdapterMetricsResult(tenantId, adapterRtId, adapterCkTypeId, since)).samples;
+    }
+    /**
+     * Like {@link getAdapterMetrics}, but reports a 404 (adapter not connected / unknown to the
+     * controller) as `notFound: true` instead of hiding it, so pollers can back off (AB#5546).
+     * Other errors are rethrown.
+     */
+    async getAdapterMetricsResult(tenantId, adapterRtId, adapterCkTypeId, since) {
         if (!this.communicationServicesUrl) {
-            return [];
+            return { samples: [], notFound: false };
         }
         const rtEntityId = encodeURIComponent(`${adapterCkTypeId}@${adapterRtId}`);
         const uri = `${this.communicationServicesUrl}${tenantId}/v1/adapter/${rtEntityId}/metrics`;
@@ -6035,12 +6636,12 @@ class CommunicationService {
         }
         return firstValueFrom(this.httpClient
             .get(uri, { params, headers: this.noCacheHeaders })
-            .pipe(catchError((err) => {
+            .pipe(map((samples) => ({ samples: samples ?? [], notFound: false })), catchError((err) => {
             // 404 = adapter not connected yet / unknown to the controller;
             // surface as "no samples" so the UI can render an empty state
             // instead of a toast.
             if (err.status === 404) {
-                return of([]);
+                return of({ samples: [], notFound: true });
             }
             return throwError(() => err);
         })));
@@ -6256,6 +6857,26 @@ class CommunicationService {
         const uri = `${this.communicationServicesUrl}${tenantId}/v1/adapter/${adapterRtId}/serviceAccount/rotateSecret`;
         return await firstValueFrom(this.httpClient.post(uri, null));
     }
+    /**
+     * Rotates the client secret of a `ServiceAccountConfiguration` (`POST
+     * /serviceAccount/{configurationRtId}/rotateSecret`, OctoMesh AB#5111) — the
+     * configuration-bound variant of {@link rotateAdapterServiceAccountSecret} with the same core
+     * logic and result: an adapter-owned configuration is rotated through its adapter server-side,
+     * a standalone (declared) one directly. Roles are never touched.
+     *
+     * Same contract as the adapter-bound call: the result carries **no secret**, the old secret is
+     * invalid once this resolves, and the pipelines / data flows using the account keep presenting
+     * it until they are redeployed (`requiresPipelineRedeploy`, `message`). Throws when the
+     * communication services URL is missing or the controller refuses (the error text says that
+     * the previous secret remains in effect).
+     */
+    async rotateServiceAccountConfigurationSecret(tenantId, configurationRtId) {
+        if (!this.communicationServicesUrl) {
+            throw new Error('Communication services URL is not configured');
+        }
+        const uri = `${this.communicationServicesUrl}${tenantId}/v1/serviceAccount/${configurationRtId}/rotateSecret`;
+        return await firstValueFrom(this.httpClient.post(uri, null));
+    }
     /**
      * Enables or disables debug capture for a pipeline via the dedicated debug
      * endpoint (`PATCH /pipeline/{id}/debug`). This is the ONLY way debug capture
@@ -6690,7 +7311,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.1.5", ngImpor
         }] });
 
 const GetEntitiesByCkTypeDocumentDto = gql `
-    query getEntitiesByCkType($ckTypeId: String!, $rtId: OctoObjectId, $after: String, $first: Int, $searchFilter: SearchFilter, $fieldFilters: [FieldFilter], $sort: [Sort]) {
+    query getEntitiesByCkType($ckTypeId: String!, $attributeNames: [String!]!, $rtId: OctoObjectId, $after: String, $first: Int, $searchFilter: SearchFilter, $fieldFilters: [FieldFilter], $sort: [Sort]) {
   runtime {
     runtimeEntities(
       ckId: $ckTypeId
@@ -6710,7 +7331,7 @@ const GetEntitiesByCkTypeDocumentDto = gql `
         rtDisplayDescription
         rtCreationDateTime
         rtChangedDateTime
-        attributes(resolveEnumValuesToNames: true) {
+        attributes(attributeNames: $attributeNames, resolveEnumValuesToNames: true) {
           items {
             attributeName
             value
@@ -6750,6 +7371,8 @@ class RuntimeEntitySelectDataSource {
         const result = await firstValueFrom(this.getEntitiesByCkTypeGQL.fetch({
             variables: {
                 ckTypeId: this.ckTypeId,
+                // Only rt* fields are displayed — no attributes (SECRET-safe, AB#5542).
+                attributeNames: [],
                 first: take ?? 10,
                 fieldFilters: [
                     // Search by the engine-computed display name (AB#4813); rtId matching required exact
@@ -6811,6 +7434,7 @@ class RuntimeEntityDialogDataSource {
         return from(this.getEntitiesByCkTypeGQL.fetch({
             variables: {
                 ckTypeId: this.ckTypeId,
+                attributeNames: [],
                 first: options.take,
                 after: options.skip > 0 ? btoa(`arrayconnection:${options.skip - 1}`) : undefined,
                 fieldFilters: fieldFilters.length > 0 ? fieldFilters : undefined
@@ -7147,5 +7771,5 @@ function provideOctoServices(octoServiceOptions) {
  * Generated bundle index. Do not edit.
  */
 
-export { AggregationInputTypesDto, AggregationTypeDto, AggregationTypesDto, AiService, ArchiveStorageHealthDto, AssetRepoGraphQlDataSource, AssetRepoService, AssociationModOptionsDto, AttributeSelectorService, AttributeValueTypeDto, BasicEnergyCarrierTypeDto, BasicEnergyDataQualityDto, BasicEnergyFacilityTypeDto, BasicEnergyProductionTypeDto, BasicEnergyStateDto, BasicLegalEntityTypeDto, BasicSalutationDto, BasicTypeOfTelephoneBasicDto, BasicTypeOfTelephoneEnhancedDto, BasicUnitOfMeasureDto, BlueprintConflictResolutionDto, BlueprintUpdateModeDto, BotService, BucketAlignmentDto, BucketAlignmentInputDto, CONFIGURATION_SERVICE, CkExtensionUpdateOperationsDto, CkModelCatalogService, CkModelService, CkRollupFunctionDto, CkTypeAttributeService, CkTypeMetaData, CkTypeSelectorService, CommunicationService, DeepGraphDirectionDto, DeleteStrategiesDto, DeploymentState, EnergyCommunityBillingCycleDto, EnergyCommunityBillingDocumentStateDto, EnergyCommunityBillingTypeDto, EnergyCommunityTaxProcedureCreditNoteDto, EnvironmentCarbonScopeDto, EnvironmentComplianceCategoryDto, EnvironmentComplianceStatusDto, EnvironmentEnergySourceDto, EnvironmentGoalStateDto, FieldFilterOperatorsDto, FormulaResultTypeDto, GetCkModelByIdDocumentDto, GetCkModelByIdDtoGQL, GetCkRecordAttributesDocumentDto, GetCkRecordAttributesDtoGQL, GetCkTypeAttributesDocumentDto, GetCkTypeAttributesDtoGQL, GetCkTypeAvailableQueryColumnsDocumentDto, GetCkTypeAvailableQueryColumnsDtoGQL, GetCkTypesDocumentDto, GetCkTypesDtoGQL, GetDerivedCkTypesDocumentDto, GetDerivedCkTypesDtoGQL, GetEntitiesByCkTypeDocumentDto, GetEntitiesByCkTypeDtoGQL, GraphDirectionDto, GraphQL, GraphQLCloneIgnoredProperties, GraphQLCommonIgnoredProperties, GraphQlDataSource, HealthService, HealthStatus, IDENTITY_PROVIDER_TYPE_LABELS, IdentityProviderType, IdentityService, ImportStrategyDto, IndustryBasicAlarmPriorityDto, IndustryBasicAlarmSourceTypeDto, IndustryBasicAlarmStateDto, IndustryBasicAlarmTypeDto, IndustryBasicIecDataTypeDto, IndustryBasicMachineCapabilitiesDto, IndustryBasicMachineStateDto, IndustryEnergyDemandResponseMarketDto, IndustryEnergyDemandResponseStatusDto, IndustryEnergyTariffTypeDto, IndustryMaintenanceAggregationTypeDto, IndustryMaintenanceCostCategoryDto, IndustryMaintenanceEnergyBalanceGroupDto, IndustryMaintenanceEnergyBalanceProductDto, IndustryMaintenanceEnergyBalanceUnitDto, IndustryMaintenanceOrderPriorityDto, IndustryMaintenanceOrderStateDto, IndustryMaintenanceOrderTypeDto, IndustryMaintenanceServiceTypeDto, IndustryManufacturingFeedbackSyncStateDto, IndustryManufacturingProductionOrderItemStateDto, IndustryManufacturingProductionOrderStateDto, JobManagementService, LevelMetaData, LoggerSeverity, ModelStateDto, MultiplicitiesDto, NavigationFilterModeDto, OctoErrorLink, OctoGraphQLServiceBase, OctoSdkDemoCustomerStatusDto, OctoSdkDemoNetworkOperatorDto, OctoSdkDemoOperatingStatusDto, OctoServiceOptions, OctoServicesModule, PagedGraphResultDto, ProgressValue, ProgressWindowService, QueryModeDto, ReportingService, RtAssociationMetaData, RuntimeEntityDialogDataSource, RuntimeEntitySelectDataSource, SearchFilterTypesDto, SeriesComparisonPolicyDto, SeriesResolutionSignalDto, SortOrdersDto, SystemAggregationTypesDto, SystemAiApprovalModeDto, SystemAiApprovalReasonDto, SystemAiApprovalStatusDto, SystemAiAuthModeDto, SystemAiConflictModeDto, SystemAiCredentialKindDto, SystemAiJobKindDto, SystemAiJobStatusDto, SystemAiKnowledgeKindDto, SystemAiLeaseStatusDto, SystemAiModelTierDto, SystemAiRiskLevelDto, SystemAiSessionEventKindDto, SystemAiSessionStatusDto, SystemAiSubscriptionScopeDto, SystemAiTicketScopeDto, SystemAiTicketStatusDto, SystemAiWorkspaceModeDto, SystemCommunicationCommunicationStateDto, SystemCommunicationConfigurationStateDto, SystemCommunicationDeploymentStateDto, SystemCommunicationEnvironmentDto, SystemCommunicationHelmChannelDto, SystemCommunicationLifecycleModeDto, SystemCommunicationLifecycleStateDto, SystemCommunicationPipelineExecutionStatusDto, SystemCommunicationPipelineTriggerTypeDto, SystemCommunicationSignalRegistrationActionDto, SystemCommunicationSignalRegistrationStateDto, SystemEnvironmentModesDto, SystemFieldFilterOperatorDto, SystemIdentityDataPolicyEnforcementModeDto, SystemIdentityDataPolicyScopeDto, SystemIdentityIdentifierKindDto, SystemIdentityIdentifierSourceDto, SystemIdentityTokenExpirationDto, SystemIdentityTokenTypeDto, SystemIdentityTokenUsageDto, SystemIdentityTrustLevelDto, SystemMaintenanceLevelsDto, SystemNavigationFilterModesDto, SystemNotificationEventLevelsDto, SystemNotificationEventSourcesDto, SystemNotificationEventStatesDto, SystemNotificationNotificationTypesDto, SystemNotificationRenderingTypesDto, SystemQueryTypesDto, SystemSortOrdersDto, SystemStreamDataBucketAlignmentDto, SystemStreamDataCkArchiveStatusDto, SystemStreamDataCkComputedColumnResultTypeDto, SystemStreamDataCkComputedColumnStateDto, SystemStreamDataCkRecomputeChangeKindDto, SystemStreamDataCkRecomputeChangeSourceDto, SystemStreamDataCkRecomputeJobStateDto, SystemStreamDataCkRecomputeTriggerDto, SystemStreamDataCkRollupFunctionDto, TENANT_ID_PROVIDER, TusUploadService, UpdateTypeDto, buildTusEndpoint, octoDataIdFromObject, result as possibleTypes, provideOctoServices };
+export { AggregationInputTypesDto, AggregationTypeDto, AggregationTypesDto, AiService, ArchiveStorageHealthDto, AssetRepoGraphQlDataSource, AssetRepoService, AssociationModOptionsDto, AttributeOwnershipDto, AttributeSelectorService, AttributeValueTypeDto, BasicEnergyCarrierTypeDto, BasicEnergyDataQualityDto, BasicEnergyFacilityTypeDto, BasicEnergyProductionTypeDto, BasicEnergyStateDto, BasicLegalEntityTypeDto, BasicSalutationDto, BasicTypeOfTelephoneBasicDto, BasicTypeOfTelephoneEnhancedDto, BasicUnitOfMeasureDto, BlueprintConflictResolutionDto, BlueprintUpdateModeDto, BotSecretsService, BotService, BucketAlignmentDto, BucketAlignmentInputDto, CONFIGURATION_SERVICE, CREDENTIAL_ATTRIBUTE_NAME_SUFFIXES, CkExtensionUpdateOperationsDto, CkModelCatalogService, CkModelService, CkRollupFunctionDto, CkTypeAttributeService, CkTypeMetaData, CkTypeSelectorService, CommunicationService, DEFAULT_SECRET_STATUS_LABELS, DeepGraphDirectionDto, DeleteStrategiesDto, DeploymentState, EnergyCommunityBillingCycleDto, EnergyCommunityBillingDocumentStateDto, EnergyCommunityBillingTypeDto, EnergyCommunityTaxProcedureCreditNoteDto, EnvironmentCarbonScopeDto, EnvironmentComplianceCategoryDto, EnvironmentComplianceStatusDto, EnvironmentEnergySourceDto, EnvironmentGoalStateDto, FieldFilterOperatorsDto, FormulaResultTypeDto, GetCkModelByIdDocumentDto, GetCkModelByIdDtoGQL, GetCkRecordAttributesDocumentDto, GetCkRecordAttributesDtoGQL, GetCkTypeAttributesDocumentDto, GetCkTypeAttributesDtoGQL, GetCkTypeAvailableQueryColumnsDocumentDto, GetCkTypeAvailableQueryColumnsDtoGQL, GetCkTypesDocumentDto, GetCkTypesDtoGQL, GetDerivedCkTypesDocumentDto, GetDerivedCkTypesDtoGQL, GetEntitiesByCkTypeDocumentDto, GetEntitiesByCkTypeDtoGQL, GraphDirectionDto, GraphQL, GraphQLCloneIgnoredProperties, GraphQLCommonIgnoredProperties, GraphQlDataSource, HealthService, HealthStatus, IDENTITY_PROVIDER_TYPE_LABELS, IdentityProviderType, IdentityService, ImportStrategyDto, IndustryBasicAlarmPriorityDto, IndustryBasicAlarmSourceTypeDto, IndustryBasicAlarmStateDto, IndustryBasicAlarmTypeDto, IndustryBasicIecDataTypeDto, IndustryBasicMachineCapabilitiesDto, IndustryBasicMachineStateDto, IndustryEnergyDemandResponseMarketDto, IndustryEnergyDemandResponseStatusDto, IndustryEnergyTariffTypeDto, IndustryMaintenanceAggregationTypeDto, IndustryMaintenanceCostCategoryDto, IndustryMaintenanceEnergyBalanceGroupDto, IndustryMaintenanceEnergyBalanceProductDto, IndustryMaintenanceEnergyBalanceUnitDto, IndustryMaintenanceOrderPriorityDto, IndustryMaintenanceOrderStateDto, IndustryMaintenanceOrderTypeDto, IndustryMaintenanceServiceTypeDto, IndustryManufacturingFeedbackSyncStateDto, IndustryManufacturingProductionOrderItemStateDto, IndustryManufacturingProductionOrderStateDto, JobManagementService, LevelMetaData, LoggerSeverity, ModelStateDto, MultiplicitiesDto, NavigationFilterModeDto, OCTO_SILENT_ERRORS, OctoErrorLink, OctoGraphQLServiceBase, OctoSdkDemoCustomerStatusDto, OctoSdkDemoNetworkOperatorDto, OctoSdkDemoOperatingStatusDto, OctoServiceOptions, OctoServicesModule, PagedGraphResultDto, ProgressValue, ProgressWindowService, QueryModeDto, ReportingService, RtAssociationMetaData, RuntimeEntityDialogDataSource, RuntimeEntitySelectDataSource, SECRET_DUMP_RESTORE_ERROR_DUMP_DELETED, SECRET_DUMP_RESTORE_ERROR_DUMP_KEY_MISSING, SECRET_LEGACY_V1_KEY_ID, SECRET_STATUS_WARNING_DUMP_KEY_MISSING, SECRET_STATUS_WARNING_NO_KEY_RING, SECRET_STATUS_WARNING_NO_LEGACY_V1_KEY, SECRET_VALUE_TYPE, SearchFilterTypesDto, SecretStorageFormDto, SecretUsageMatchDto, SeriesComparisonPolicyDto, SeriesResolutionSignalDto, SortOrdersDto, SystemAggregationTypesDto, SystemAiApprovalModeDto, SystemAiApprovalReasonDto, SystemAiApprovalStatusDto, SystemAiAuthModeDto, SystemAiConflictModeDto, SystemAiCredentialKindDto, SystemAiJobKindDto, SystemAiJobStatusDto, SystemAiKnowledgeKindDto, SystemAiLeaseStatusDto, SystemAiModelTierDto, SystemAiRiskLevelDto, SystemAiSessionEventKindDto, SystemAiSessionStatusDto, SystemAiSubscriptionScopeDto, SystemAiTicketScopeDto, SystemAiTicketStatusDto, SystemAiWorkspaceModeDto, SystemCommunicationCommunicationStateDto, SystemCommunicationConfigurationStateDto, SystemCommunicationDeploymentStateDto, SystemCommunicationEnvironmentDto, SystemCommunicationHelmChannelDto, SystemCommunicationLifecycleModeDto, SystemCommunicationLifecycleStateDto, SystemCommunicationPipelineExecutionStatusDto, SystemCommunicationPipelineTriggerTypeDto, SystemCommunicationSignalRegistrationActionDto, SystemCommunicationSignalRegistrationStateDto, SystemEnvironmentModesDto, SystemFieldFilterOperatorDto, SystemIdentityDataPolicyEnforcementModeDto, SystemIdentityDataPolicyScopeDto, SystemIdentityIdentifierKindDto, SystemIdentityIdentifierSourceDto, SystemIdentityTokenExpirationDto, SystemIdentityTokenTypeDto, SystemIdentityTokenUsageDto, SystemIdentityTrustLevelDto, SystemMaintenanceLevelsDto, SystemNavigationFilterModesDto, SystemNotificationEventLevelsDto, SystemNotificationEventSourcesDto, SystemNotificationEventStatesDto, SystemNotificationNotificationTypesDto, SystemNotificationRenderingTypesDto, SystemQueryTypesDto, SystemSortOrdersDto, SystemStreamDataBucketAlignmentDto, SystemStreamDataCkArchiveStatusDto, SystemStreamDataCkComputedColumnResultTypeDto, SystemStreamDataCkComputedColumnStateDto, SystemStreamDataCkConflictKeyOrderDto, SystemStreamDataCkRecomputeChangeKindDto, SystemStreamDataCkRecomputeChangeSourceDto, SystemStreamDataCkRecomputeJobStateDto, SystemStreamDataCkRecomputeTriggerDto, SystemStreamDataCkRollupFunctionDto, TENANT_ID_PROVIDER, TusUploadService, UpdateTypeDto, buildTusEndpoint, formatSecretStatus, isCredentialLikeAttributeName, isSecretAttributeCandidate, isSecretPresent, isSecretQueryColumn, isSecretStateObject, isSecretValueType, isTextualValueType, octoDataIdFromObject, result as possibleTypes, provideOctoServices, secretInputValue, secretStateFromAttribute, secretStatusOf, toAttributeNameFilter, toCamelCaseAttributeName, toSecretState, toUniqueCamelCaseNames };
 //# sourceMappingURL=meshmakers-octo-services.mjs.map