@vertesia/common 1.5.0-dev.20260722.120446Z → 1.5.0-dev.20260804.124748Z

package/lib/apikey.d.ts

@@ -1,7 +1,14 @@
+import type { z } from 'zod';
 import type { PropertyConditions } from './access-control.js';
+import type { ApiKeyArraySchema, ApiKeyListQuerySchema, ApiKeyReadQuerySchema, ApiKeyReadResponseSchema, ApiKeySchema, ApiKeyWithValueSchema, AuthTokenResponseSchema, CreateApiKeyPayloadSchema, UpdateApiKeyPayloadSchema } from './api-schemas/apikey.js';
 import type { UserGroupRef } from './group.js';
 import type { ProjectRef, SystemRoles } from './project.js';
 import type { AccountRef } from './user.js';
+/**
+ * `ApiKeyTypes` lives in `./apikey-values.js` so the API schemas can read it without importing this
+ * module back. Re-exported here so every existing import path keeps working.
+ */
+export * from './apikey-values.js';
 /**
  * Per-scope, per-verb property-condition arrays that narrow content visibility
  * at query time. Each value array uses $or semantics — any matching condition
@@ -26,47 +33,36 @@ export interface ContentSecurity {
     /** Scope-prefixed entries: `'collection:read'`, `'task:write'`, etc. */
     [scopedKey: string]: PropertyConditions[] | undefined;
 }
-export declare enum ApiKeyTypes {
-    secret = "sk"
-}
-export interface ApiKey {
-    id: string;
-    name: string;
-    type: ApiKeyTypes;
-    role: SystemRoles;
-    maskedValue?: string;
-    can_retrieve_value?: boolean;
-    account: string;
-    project: ProjectRef;
-    enabled: boolean;
-    created_by: string;
-    updated_by: string;
-    created_at: Date;
-    updated_at: Date;
-    expires_at?: Date;
-}
-export interface CreateOrUpdateApiKeyPayload extends Partial<ApiKey> {
-}
-export interface ApiKeyWithValue extends ApiKey {
-    value: string;
-}
-export interface ApiKeyReadResponse extends ApiKey {
-    value?: string;
-}
+/**
+ * The API key wire types, inferred from the schemas in `./api-schemas/apikey.js` — what OpenAPI
+ * publishes and AJV compiles.
+ *
+ * NOTE the timestamps are `string`, not `Date`. The document has always published them as
+ * `format: date-time` strings and JSON has no date type, so the previous `Date` declaration
+ * described the Mongoose document rather than the response a client parses.
+ */
+export type ApiKey = z.infer<typeof ApiKeySchema>;
+export type ApiKeyArray = z.infer<typeof ApiKeyArraySchema>;
+/**
+ * Create and update take DIFFERENT payloads, and did not before.
+ *
+ * `CreateOrUpdateApiKeyPayload` was `Partial<ApiKey>` shared by both, which meant the type permitted
+ * a create with no `role` (rejected by Mongoose inside the handler) and an update that omitted
+ * `role` (which unset a required path). Splitting it is source-breaking for the SDK and is announced
+ * as a release operation; the two names say which operation they belong to.
+ */
+export type CreateApiKeyPayload = z.infer<typeof CreateApiKeyPayloadSchema>;
+export type UpdateApiKeyPayload = z.infer<typeof UpdateApiKeyPayloadSchema>;
+export type ApiKeyWithValue = z.infer<typeof ApiKeyWithValueSchema>;
+export type ApiKeyReadResponse = z.infer<typeof ApiKeyReadResponseSchema>;
 export interface CreatePublicKeyPayload {
     name?: string;
     projectId?: string;
     ttl?: number;
 }
-export interface AuthTokenResponse {
-    token: string;
-}
-export interface ApiKeyListQuery {
-    level?: 'account' | 'project';
-}
-export interface ApiKeyReadQuery {
-    withValue?: boolean;
-}
+export type AuthTokenResponse = z.infer<typeof AuthTokenResponseSchema>;
+export type ApiKeyListQuery = z.infer<typeof ApiKeyListQuerySchema>;
+export type ApiKeyReadQuery = z.infer<typeof ApiKeyReadQuerySchema>;
 export interface AuthTokenPayload {
     sub: string;
     name: string;
@@ -150,6 +146,11 @@ export interface AuthTokenPayload {
         onBehalfOf?: AuthTokenPayload;
         [key: string]: unknown;
     };
+    /**
+     * Set only by STS for tokens minted by an attested internal workflow-launching service.
+     * API servers use this claim before accepting a caller-supplied logical request identity.
+     */
+    trusted_request_identity?: boolean;
 }
 export declare enum PrincipalType {
     User = "user",

package/lib/apikey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apikey.d.ts","sourceRoot":"","sources":["../src/apikey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,eAAe;IAC5B,IAAI,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B,wEAAwE;IACxE,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE,GAAG,SAAS,CAAC;CACzD;AAED,oBAAY,WAAW;IACnB,MAAM,OAAO;CAChB;AACD,MAAM,WAAW,MAAM;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,2BAA4B,SAAQ,OAAO,CAAC,MAAM,CAAC;CAAG;AAEvE,MAAM,WAAW,eAAgB,SAAQ,MAAM;IAC3C,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,MAAM;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAC9B,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC5B,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,UAAU,CAAC;IAEpB,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,QAAQ,EAAE,UAAU,EAAE,CAAC;IAEvB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAE9B;;OAEG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IAEf;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,aAAa;IACb,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IAExB;;;;;4DAKwD;IACxD,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IAEvB;;;;OAIG;IACH,SAAS,CAAC,EACJ,MAAM,GACN;QACI,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IAER,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACb,8EAA8E;QAC9E,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KAC1B,CAAC;CACL;AAED,oBAAY,aAAa;IACrB,IAAI,SAAS;IACb,WAAW,iBAAiB;IAC5B,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,cAAc,oBAAoB;IAClC,KAAK,UAAU;IACf,QAAQ,aAAa;CACxB"}
+{"version":3,"file":"apikey.d.ts","sourceRoot":"","sources":["../src/apikey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EACR,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C;;;GAGG;AACH,cAAc,oBAAoB,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,eAAe;IAC5B,IAAI,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B,wEAAwE;IACxE,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAClD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,WAAW,sBAAsB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,UAAU,CAAC;IAEpB,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,QAAQ,EAAE,UAAU,EAAE,CAAC;IAEvB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAE9B;;OAEG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IAEf;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,aAAa;IACb,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IAExB;;;;;4DAKwD;IACxD,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IAEvB;;;;OAIG;IACH,SAAS,CAAC,EACJ,MAAM,GACN;QACI,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IAER,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACb,8EAA8E;QAC9E,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KAC1B,CAAC;IAEF;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,oBAAY,aAAa;IACrB,IAAI,SAAS;IACb,WAAW,iBAAiB;IAC5B,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,cAAc,oBAAoB;IAClC,KAAK,UAAU;IACf,QAAQ,aAAa;CACxB"}

package/lib/apikey.js

@@ -1,7 +1,8 @@
-export var ApiKeyTypes;
-(function (ApiKeyTypes) {
-    ApiKeyTypes["secret"] = "sk";
-})(ApiKeyTypes || (ApiKeyTypes = {}));
+/**
+ * `ApiKeyTypes` lives in `./apikey-values.js` so the API schemas can read it without importing this
+ * module back. Re-exported here so every existing import path keeps working.
+ */
+export * from './apikey-values.js';
 export var PrincipalType;
 (function (PrincipalType) {
     PrincipalType["User"] = "user";

package/lib/apikey.js.map

@@ -1 +1 @@
-{"version":3,"file":"apikey.js","sourceRoot":"","sources":["../src/apikey.ts"],"names":[],"mappings":"AA8BA,MAAM,CAAN,IAAY,WAEX;AAFD,WAAY,WAAW;IACnB,4BAAa,CAAA;AACjB,CAAC,EAFW,WAAW,KAAX,WAAW,QAEtB;AAiJD,MAAM,CAAN,IAAY,aAQX;AARD,WAAY,aAAa;IACrB,8BAAa,CAAA;IACb,6CAA4B,CAAA;IAC5B,gCAAe,CAAA;IACf,kCAAiB,CAAA;IACjB,mDAAkC,CAAA;IAClC,gCAAe,CAAA;IACf,sCAAqB,CAAA;AACzB,CAAC,EARW,aAAa,KAAb,aAAa,QAQxB"}
+{"version":3,"file":"apikey.js","sourceRoot":"","sources":["../src/apikey.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,cAAc,oBAAoB,CAAC;AAqKnC,MAAM,CAAN,IAAY,aAQX;AARD,WAAY,aAAa;IACrB,8BAAa,CAAA;IACb,6CAA4B,CAAA;IAC5B,gCAAe,CAAA;IACf,kCAAiB,CAAA;IACjB,mDAAkC,CAAA;IAClC,gCAAe,CAAA;IACf,sCAAqB,CAAA;AACzB,CAAC,EARW,aAAa,KAAb,aAAa,QAQxB"}