@opengeni/contracts 3.1.0-canary.2 → 3.1.2

package/src/organization-model-usage.ts

@@ -0,0 +1,81 @@
+import { defineSchema } from "./define-schema";
+// Server-parsed only; kept off the root contracts index so browser bundles that
+// import the root never carry these schemas.
+import { z } from "zod";
+
+import { OrganizationUsagePeriod, OrganizationUsageQuery } from "./organization-usage";
+
+const BigIntString = /* @__PURE__ */ defineSchema(() => z.string().regex(/^\d+$/));
+const OrganizationModelUsageBillingPath = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["opengeni_credits", "external"]),
+);
+
+/** Exact per-billing-path sums from per-call model facts; bigint sums stay strings. */
+export const OrganizationModelUsageTotals = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    billingPath: OrganizationModelUsageBillingPath,
+    calls: BigIntString,
+    inputTokens: BigIntString,
+    outputTokens: BigIntString,
+    cachedTokens: BigIntString,
+    cacheInputTokens: BigIntString,
+    cacheWriteTokens: BigIntString,
+    totalTokens: BigIntString,
+    tokenKnownCalls: BigIntString,
+    cacheKnownCalls: BigIntString,
+    creditMicros: BigIntString,
+    estimatedProviderMicros: BigIntString,
+    estimatedProviderKnownCalls: BigIntString,
+  }),
+);
+export type OrganizationModelUsageTotals = z.infer<typeof OrganizationModelUsageTotals>;
+
+export const OrganizationModelUsageQuery = /* @__PURE__ */ defineSchema(() =>
+  OrganizationUsageQuery.extend({
+    afterWorkspaceId: z.string().uuid().optional(),
+  }),
+);
+
+export const OrganizationModelUsage = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    accountId: z.string().uuid(),
+    period: OrganizationUsagePeriod,
+    since: z.string().datetime(),
+    until: z.string().datetime(),
+    billing: z.array(OrganizationModelUsageTotals).max(2),
+    /** Exact uncapped per-fact payer split; independent of the top-model list. */
+    payers: z
+      .array(
+        OrganizationModelUsageTotals.omit({ billingPath: true }).extend({
+          payer: z.enum(["opengeni_credits", "subscription", "own_key"]),
+        }),
+      )
+      .default([]),
+    models: z
+      .array(
+        z.object({
+          provider: z.string(),
+          model: z.string(),
+          totals: OrganizationModelUsageTotals,
+        }),
+      )
+      .max(50),
+    modelsTruncated: z.boolean(),
+    workspaces: z
+      .array(
+        z.object({
+          workspaceId: z.string().uuid(),
+          name: z.string().nullable(),
+          billing: z.array(OrganizationModelUsageTotals).max(2),
+        }),
+      )
+      .max(50),
+    /** Every Personal workspace, aggregated; individual Personal workspaces are never named. */
+    personal: z.object({
+      workspacesWithUsage: BigIntString,
+      billing: z.array(OrganizationModelUsageTotals).max(2),
+    }),
+    nextWorkspaceCursor: z.string().uuid().nullable(),
+  }),
+);
+export type OrganizationModelUsage = z.infer<typeof OrganizationModelUsage>;

package/src/organization-recovery.ts

@@ -1,150 +1,156 @@
+import { defineSchema } from "./define-schema";
 import { z } from "zod";
 
-const Uuid = z.string().uuid();
-const Timestamp = z.string().datetime({ offset: true });
+const Uuid = /* @__PURE__ */ defineSchema(() => z.string().uuid());
+const Timestamp = /* @__PURE__ */ defineSchema(() => z.string().datetime({ offset: true }));
 
-export const OrganizationRecoveryPolicyState = z.enum([
-  "pending_acceptance",
-  "active",
-  "degraded",
-  "superseded",
-  "disabled",
-]);
+export const OrganizationRecoveryPolicyState = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["pending_acceptance", "active", "degraded", "superseded", "disabled"]),
+);
 export type OrganizationRecoveryPolicyState = z.infer<typeof OrganizationRecoveryPolicyState>;
 
-export const OrganizationRecoveryOperationState = z.enum([
-  "collecting",
-  "cooling",
-  "executed",
-  "cancelled",
-  "expired",
-  "superseded",
-]);
+export const OrganizationRecoveryOperationState = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["collecting", "cooling", "executed", "cancelled", "expired", "superseded"]),
+);
 export type OrganizationRecoveryOperationState = z.infer<typeof OrganizationRecoveryOperationState>;
 
-export const OrganizationRecoveryUnavailableReason = z.enum([
-  "no_policy",
-  "pending_acceptance",
-  "degraded",
-  "disabled",
-  "identity_unavailable",
-]);
+export const OrganizationRecoveryUnavailableReason = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["no_policy", "pending_acceptance", "degraded", "disabled", "identity_unavailable"]),
+);
 export type OrganizationRecoveryUnavailableReason = z.infer<
   typeof OrganizationRecoveryUnavailableReason
 >;
 
-export const OrganizationRecoveryMemberSummary = z
-  .object({
-    membershipId: Uuid,
-    name: z.string().trim().min(1).max(1024).nullable(),
-    email: z.string().email().max(320).nullable(),
-  })
-  .strict();
+export const OrganizationRecoveryMemberSummary = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      membershipId: Uuid,
+      name: z.string().trim().min(1).max(1024).nullable(),
+      email: z.string().email().max(320).nullable(),
+    })
+    .strict(),
+);
 export type OrganizationRecoveryMemberSummary = z.infer<typeof OrganizationRecoveryMemberSummary>;
 
-export const OrganizationRecoveryCustodian = OrganizationRecoveryMemberSummary.extend({
-  ordinal: z.number().int().min(1).max(3),
-  enrollmentState: z.enum(["pending_acceptance", "accepted", "ineligible"]),
-  acceptedAt: Timestamp.nullable(),
-}).strict();
+export const OrganizationRecoveryCustodian = /* @__PURE__ */ defineSchema(() =>
+  OrganizationRecoveryMemberSummary.extend({
+    ordinal: z.number().int().min(1).max(3),
+    enrollmentState: z.enum(["pending_acceptance", "accepted", "ineligible"]),
+    acceptedAt: Timestamp.nullable(),
+  }).strict(),
+);
 export type OrganizationRecoveryCustodian = z.infer<typeof OrganizationRecoveryCustodian>;
 
-export const OrganizationRecoveryPolicy = z
-  .object({
-    id: Uuid,
-    organizationId: Uuid,
-    revision: z.number().int().positive(),
-    state: OrganizationRecoveryPolicyState,
-    custodians: z.array(OrganizationRecoveryCustodian).length(3),
-    createdAt: Timestamp,
-    updatedAt: Timestamp,
-  })
-  .strict();
+export const OrganizationRecoveryPolicy = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      id: Uuid,
+      organizationId: Uuid,
+      revision: z.number().int().positive(),
+      state: OrganizationRecoveryPolicyState,
+      custodians: z.array(OrganizationRecoveryCustodian).length(3),
+      createdAt: Timestamp,
+      updatedAt: Timestamp,
+    })
+    .strict(),
+);
 export type OrganizationRecoveryPolicy = z.infer<typeof OrganizationRecoveryPolicy>;
 
-export const OrganizationRecoveryApproval = OrganizationRecoveryMemberSummary.extend({
-  approvedAt: Timestamp,
-}).strict();
+export const OrganizationRecoveryApproval = /* @__PURE__ */ defineSchema(() =>
+  OrganizationRecoveryMemberSummary.extend({
+    approvedAt: Timestamp,
+  }).strict(),
+);
 export type OrganizationRecoveryApproval = z.infer<typeof OrganizationRecoveryApproval>;
 
-export const OrganizationRecoveryOperation = z
-  .object({
-    id: Uuid,
-    organizationId: Uuid,
-    policyId: Uuid,
-    policyRevision: z.number().int().positive(),
-    revision: z.number().int().positive(),
-    state: OrganizationRecoveryOperationState,
-    target: OrganizationRecoveryMemberSummary,
-    approvals: z.array(OrganizationRecoveryApproval).max(3),
-    approvalCount: z.number().int().min(0).max(3),
-    quorumAt: Timestamp.nullable(),
-    executableAt: Timestamp.nullable(),
-    expiresAt: Timestamp,
-    executedAt: Timestamp.nullable(),
-    cancelledAt: Timestamp.nullable(),
-    notificationJournaled: z.boolean(),
-    createdAt: Timestamp,
-    updatedAt: Timestamp,
-  })
-  .strict();
+export const OrganizationRecoveryOperation = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      id: Uuid,
+      organizationId: Uuid,
+      policyId: Uuid,
+      policyRevision: z.number().int().positive(),
+      revision: z.number().int().positive(),
+      state: OrganizationRecoveryOperationState,
+      target: OrganizationRecoveryMemberSummary,
+      approvals: z.array(OrganizationRecoveryApproval).max(3),
+      approvalCount: z.number().int().min(0).max(3),
+      quorumAt: Timestamp.nullable(),
+      executableAt: Timestamp.nullable(),
+      expiresAt: Timestamp,
+      executedAt: Timestamp.nullable(),
+      cancelledAt: Timestamp.nullable(),
+      notificationJournaled: z.boolean(),
+      createdAt: Timestamp,
+      updatedAt: Timestamp,
+    })
+    .strict(),
+);
 export type OrganizationRecoveryOperation = z.infer<typeof OrganizationRecoveryOperation>;
 
-export const OrganizationRecoveryCapabilities = z
-  .object({
-    configure: z.boolean(),
-    accept: z.boolean(),
-    disable: z.boolean(),
-    start: z.boolean(),
-    approve: z.boolean(),
-    cancel: z.boolean(),
-    execute: z.boolean(),
-  })
-  .strict();
+export const OrganizationRecoveryCapabilities = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      configure: z.boolean(),
+      accept: z.boolean(),
+      disable: z.boolean(),
+      start: z.boolean(),
+      approve: z.boolean(),
+      cancel: z.boolean(),
+      execute: z.boolean(),
+    })
+    .strict(),
+);
 export type OrganizationRecoveryCapabilities = z.infer<typeof OrganizationRecoveryCapabilities>;
 
-export const OrganizationRecoveryOverview = z
-  .object({
-    organizationId: Uuid,
-    availability: z.enum(["available", "recovery_unavailable"]),
-    unavailableReason: OrganizationRecoveryUnavailableReason.nullable(),
-    recentReauthenticationAt: Timestamp.nullable(),
-    eligibleMembers: z.array(OrganizationRecoveryMemberSummary).max(1000),
-    policy: OrganizationRecoveryPolicy.nullable(),
-    operation: OrganizationRecoveryOperation.nullable(),
-    capabilities: OrganizationRecoveryCapabilities,
-  })
-  .strict();
+export const OrganizationRecoveryOverview = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      organizationId: Uuid,
+      availability: z.enum(["available", "recovery_unavailable"]),
+      unavailableReason: OrganizationRecoveryUnavailableReason.nullable(),
+      recentReauthenticationAt: Timestamp.nullable(),
+      eligibleMembers: z.array(OrganizationRecoveryMemberSummary).max(1000),
+      policy: OrganizationRecoveryPolicy.nullable(),
+      operation: OrganizationRecoveryOperation.nullable(),
+      capabilities: OrganizationRecoveryCapabilities,
+    })
+    .strict(),
+);
 export type OrganizationRecoveryOverview = z.infer<typeof OrganizationRecoveryOverview>;
 
-const ExpectedPolicyRevision = z.number().int().nonnegative();
-const ExpectedOperationRevision = z.number().int().positive();
+const ExpectedPolicyRevision = /* @__PURE__ */ defineSchema(() => z.number().int().nonnegative());
+const ExpectedOperationRevision = /* @__PURE__ */ defineSchema(() => z.number().int().positive());
 const CommandOperationId = Uuid;
 
-export const ConfigureOrganizationRecoveryPolicyRequest = z
-  .object({
-    custodianMembershipIds: z.tuple([Uuid, Uuid, Uuid]).superRefine((ids, context) => {
-      if (new Set(ids).size !== 3) {
-        context.addIssue({
-          code: "custom",
-          message: "recovery custodians must be three distinct memberships",
-        });
-      }
-    }),
-    expectedPolicyRevision: ExpectedPolicyRevision,
-    operationId: CommandOperationId,
-  })
-  .strict();
+export const ConfigureOrganizationRecoveryPolicyRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      custodianMembershipIds: z.tuple([Uuid, Uuid, Uuid]).superRefine((ids, context) => {
+        if (new Set(ids).size !== 3) {
+          context.addIssue({
+            code: "custom",
+            message: "recovery custodians must be three distinct memberships",
+          });
+        }
+      }),
+      expectedPolicyRevision: ExpectedPolicyRevision,
+      operationId: CommandOperationId,
+    })
+    .strict(),
+);
 export type ConfigureOrganizationRecoveryPolicyRequest = z.infer<
   typeof ConfigureOrganizationRecoveryPolicyRequest
 >;
 
-export const AcceptOrganizationRecoveryCustodyRequest = z
-  .object({
-    expectedPolicyRevision: ExpectedPolicyRevision,
-    operationId: CommandOperationId,
-  })
-  .strict();
+export const AcceptOrganizationRecoveryCustodyRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      expectedPolicyRevision: ExpectedPolicyRevision,
+      operationId: CommandOperationId,
+    })
+    .strict(),
+);
 export type AcceptOrganizationRecoveryCustodyRequest = z.infer<
   typeof AcceptOrganizationRecoveryCustodyRequest
 >;
@@ -154,33 +160,39 @@ export type DisableOrganizationRecoveryPolicyRequest = z.infer<
   typeof DisableOrganizationRecoveryPolicyRequest
 >;
 
-export const StartOrganizationRecoveryOperationRequest = z
-  .object({
-    targetMembershipId: Uuid,
-    expectedPolicyRevision: z.number().int().positive(),
-    operationId: CommandOperationId,
-  })
-  .strict();
+export const StartOrganizationRecoveryOperationRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      targetMembershipId: Uuid,
+      expectedPolicyRevision: z.number().int().positive(),
+      operationId: CommandOperationId,
+    })
+    .strict(),
+);
 export type StartOrganizationRecoveryOperationRequest = z.infer<
   typeof StartOrganizationRecoveryOperationRequest
 >;
 
-export const OrganizationRecoveryOperationCommandRequest = z
-  .object({
-    expectedOperationRevision: ExpectedOperationRevision,
-    operationId: CommandOperationId,
-  })
-  .strict();
+export const OrganizationRecoveryOperationCommandRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      expectedOperationRevision: ExpectedOperationRevision,
+      operationId: CommandOperationId,
+    })
+    .strict(),
+);
 export type OrganizationRecoveryOperationCommandRequest = z.infer<
   typeof OrganizationRecoveryOperationCommandRequest
 >;
 
-export const OrganizationRecoveryMutationResponse = z
-  .object({
-    replay: z.boolean(),
-    overview: OrganizationRecoveryOverview,
-  })
-  .strict();
+export const OrganizationRecoveryMutationResponse = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      replay: z.boolean(),
+      overview: OrganizationRecoveryOverview,
+    })
+    .strict(),
+);
 export type OrganizationRecoveryMutationResponse = z.infer<
   typeof OrganizationRecoveryMutationResponse
 >;

package/src/organization-usage.ts

@@ -0,0 +1,94 @@
+import { defineSchema } from "./define-schema";
+import { z } from "zod";
+
+export const OrganizationUsagePeriod = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["today", "week", "month", "ytd"]),
+);
+export type OrganizationUsagePeriod = z.infer<typeof OrganizationUsagePeriod>;
+export const OrganizationUsageQuery = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    period: OrganizationUsagePeriod.default("month"),
+  }),
+);
+export const OrganizationUsageWorkspacePageQuery = /* @__PURE__ */ defineSchema(() =>
+  OrganizationUsageQuery.extend({
+    until: z.string().datetime(),
+    afterWorkspaceId: z.string().uuid().optional(),
+  }),
+);
+// PostgreSQL SUM(bigint) must never pass through a JavaScript number.
+export const OrganizationUsageTotal = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    eventType: z.string(),
+    unit: z.string(),
+    quantity: z.string().regex(/^-?\d+$/),
+    eventCount: z.string().regex(/^\d+$/),
+  }),
+);
+/** One member's Personal workspace, as usage only. */
+export const OrganizationUsagePersonalWorkspace = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    membershipId: z.string().uuid(),
+    totals: z.array(OrganizationUsageTotal),
+  }),
+);
+export type OrganizationUsagePersonalWorkspace = z.infer<typeof OrganizationUsagePersonalWorkspace>;
+export const OrganizationUsageSummary = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    accountId: z.string().uuid(),
+    period: OrganizationUsagePeriod,
+    since: z.string().datetime(),
+    until: z.string().datetime(),
+    granularity: z.enum(["hour", "day"]),
+    totals: z.array(OrganizationUsageTotal),
+    buckets: z.array(z.object({ bucket: z.string(), totals: z.array(OrganizationUsageTotal) })),
+    workspaces: z
+      .array(
+        z.object({
+          workspaceId: z.string().uuid(),
+          name: z.string().nullable(),
+          totals: z.array(OrganizationUsageTotal),
+        }),
+      )
+      .max(50),
+    nextWorkspaceCursor: z.string().uuid().nullable(),
+    /**
+     * Usage in each member's Personal workspace, keyed by the owner's
+     * organization membership: amounts only, never the workspace's id, name or
+     * content. Only Personal workspaces with usage in the period, the 50 that
+     * spent the most. Absent before migration 0543, hence the defaults.
+     */
+    personalWorkspaces: z.array(OrganizationUsagePersonalWorkspace).max(50).default([]),
+    /** How many Personal workspaces had usage in the period, listed or not. */
+    personalWorkspaceCount: z.number().int().nonnegative().default(0),
+    /** Other people's Only-me chats in shared workspaces: member amounts only. */
+    privateChats: z
+      .array(
+        z.object({
+          workspaceId: z.string().uuid(),
+          membershipId: z.string().uuid().nullable(),
+          name: z.string().nullable(),
+          totals: z.array(OrganizationUsageTotal),
+        }),
+      )
+      .default([]),
+    privateChatsTruncated: z.boolean().default(false),
+  }),
+);
+export type OrganizationUsageSummary = z.infer<typeof OrganizationUsageSummary>;
+
+/**
+ * A page deliberately excludes totals, charts and Personal rows: those are not
+ * recomputed. Pages continue the shared workspaces only.
+ */
+export const OrganizationUsageWorkspacePage = /* @__PURE__ */ defineSchema(() =>
+  OrganizationUsageSummary.omit({
+    totals: true,
+    buckets: true,
+    personalWorkspaces: true,
+    personalWorkspaceCount: true,
+    privateChats: true,
+    privateChatsTruncated: true,
+  }),
+);
+export type OrganizationUsageWorkspacePage = z.infer<typeof OrganizationUsageWorkspacePage>;

package/src/permissions.ts

@@ -1,56 +1,92 @@
+import { defineSchema } from "./define-schema";
 import { z } from "zod";
 
 /** Canonical public permission vocabulary shared by operational and control-plane contracts. */
-export const Permission = z.enum([
-  "account:read",
-  "account:admin",
-  "members:manage",
-  "workspace:create",
-  "billing:read",
-  "billing:manage",
-  "workspace:read",
-  "workspace:admin",
-  "sessions:create",
-  "sessions:read",
-  "sessions:control",
-  "stream:view",
-  "stream:control",
-  "stream:acknowledge",
-  "files:upload",
-  "files:read",
-  "files:write",
-  "terminal:attach",
-  "documents:manage",
-  "documents:search",
-  "scheduled_tasks:manage",
-  "scheduled_tasks:run",
-  "github:manage",
-  "github:use",
-  "api_keys:manage",
-  "connections:read",
-  "connections:write",
-  "capabilities:manage",
-  /** @deprecated alias of variable-sets:manage */
-  "environments:manage",
-  /** @deprecated alias of variable-sets:use */
-  "environments:use",
-  "variable-sets:list",
-  "variable-sets:read",
-  "variable-sets:write",
-  "variable-sets:manage",
-  "variable-sets:attach",
-  "variable-sets:use",
-  "secrets:list",
-  "secrets:read",
-  "secrets:write",
-  "mcp_servers:attach",
-  "codemode:call",
-  "goals:manage",
-  "enrollments:read",
-  "enrollments:manage",
-  "rigs:use",
-  "rigs:manage",
-  "artifacts:read",
-  "artifacts:publish",
-]);
+export const Permission = /* @__PURE__ */ defineSchema(() =>
+  z.enum([
+    "account:read",
+    "account:admin",
+    "members:manage",
+    "workspace:create",
+    "billing:read",
+    "billing:manage",
+    "workspace:read",
+    "workspace:admin",
+    "sessions:create",
+    "sessions:read",
+    "sessions:control",
+    "stream:view",
+    "stream:control",
+    "stream:acknowledge",
+    "files:upload",
+    "files:read",
+    "files:write",
+    "terminal:attach",
+    "documents:manage",
+    "documents:search",
+    "scheduled_tasks:manage",
+    "scheduled_tasks:run",
+    "github:manage",
+    "github:use",
+    "api_keys:manage",
+    /** Literal organization-key authority to configure workspace usage allowances. */
+    "usage_allowances:manage",
+    "connections:read",
+    "connections:write",
+    "capabilities:manage",
+    /** @deprecated alias of secrets:write */
+    "environments:manage",
+    /** @deprecated alias of secrets:use */
+    "environments:use",
+    /** @deprecated alias of secrets:list */
+    "variable-sets:list",
+    /** @deprecated alias of secrets:list */
+    "variable-sets:read",
+    /** @deprecated alias of secrets:write */
+    "variable-sets:write",
+    /** @deprecated alias of secrets:write */
+    "variable-sets:manage",
+    /** @deprecated alias of secrets:use */
+    "variable-sets:attach",
+    /** @deprecated alias of secrets:use */
+    "variable-sets:use",
+    "secrets:list",
+    /** Literal plaintext read through a tool or API key (agents lack it by default). */
+    "secrets:read",
+    "secrets:write",
+    /** Use secrets by reference; for humans, also reveal ("use = reveal"). */
+    "secrets:use",
+    "mcp_servers:attach",
+    "codemode:call",
+    "goals:manage",
+    "enrollments:read",
+    "enrollments:manage",
+    "rigs:use",
+    "rigs:manage",
+    "artifacts:read",
+    "artifacts:publish",
+  ]),
+);
 export type Permission = z.infer<typeof Permission>;
+
+/**
+ * Legacy permission names and their secrets equivalents (Q-16). Stored role
+ * and API-key permission arrays are aliased at read time, never rewritten.
+ */
+export const SECRET_PERMISSION_ALIASES = {
+  "variable-sets:list": "secrets:list",
+  "variable-sets:read": "secrets:list",
+  "variable-sets:write": "secrets:write",
+  "variable-sets:manage": "secrets:write",
+  "environments:manage": "secrets:write",
+  "variable-sets:attach": "secrets:use",
+  "variable-sets:use": "secrets:use",
+  "environments:use": "secrets:use",
+} as const satisfies Readonly<Partial<Record<Permission, Permission>>>;
+
+/** Canonical name for a permission: legacy variable-set names map to `secrets:*`. */
+export function normalizePermission(name: string): string {
+  return Object.hasOwn(SECRET_PERMISSION_ALIASES, name)
+    ? SECRET_PERMISSION_ALIASES[name as keyof typeof SECRET_PERMISSION_ALIASES]
+    : name;
+}