@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.d.ts

@@ -65,6 +65,21 @@ export declare function createApiKeyExtendExpiryFactories(): ResourceCustomServi
 export declare function createApiKeyDeactivateFactories(): ResourceCustomServiceImplementationFactory[];
 /** REACTIVATE impls — INACTIVE → ACTIVE, forced. An EXPIRED key is NOT revivable (409). */
 export declare function createApiKeyReactivateFactories(): ResourceCustomServiceImplementationFactory[];
+/**
+ * EXPIRE impls — ACTIVE → EXPIRED, forced, dispatched by the credential-expiry sweep (#413).
+ *
+ * Registered separately from every other api-key op rather than through
+ * `apiKeyFactoriesForOperation`, and the difference is the whole point: that helper hardcodes
+ * `variantType: API_CALL` and fans out over each resource's HTTP variants (including the org
+ * resource's cross-tenant `admin` one). EXPIRE is INTERNAL_CALL with a single default variant on
+ * both resources — no route, no operator affordance — so it needs its own registration or the
+ * lookup key would never match and the guard below would be silently unreachable.
+ *
+ * The ACTIVE-only precondition is the reason this verb exists at all: a sweep writing `status`
+ * directly would relabel an INACTIVE key as EXPIRED and erase the fact that an administrator
+ * retired it.
+ */
+export declare function createApiKeyExpireFactories(): ResourceCustomServiceImplementationFactory[];
 /** USAGE_STATS impls — interim zeroed payload. */
 export declare function createApiKeyUsageStatsFactories(): ResourceCustomServiceImplementationFactory[];
 //# sourceMappingURL=api-keys.custom-impl.backend.service.d.ts.map

package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EACL,WAAW,EASZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,EACzC,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAMpH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AA6DnH,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AA4D7G,uDAAuD;AACvD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,GAAG,kBAAkB,CAyB5H;AA0LD,8DAA8D;AAC9D,wBAAgB,2BAA2B,IAAI,0CAA0C,EAAE,CAK1F;AAED,2CAA2C;AAC3C,wBAAgB,2BAA2B,IAAI,0CAA0C,EAAE,CAK1F;AAED,6CAA6C;AAC7C,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CAK9F;AAED,+FAA+F;AAC/F,wBAAgB,iCAAiC,IAAI,0CAA0C,EAAE,CAKhG;AAED,oDAAoD;AACpD,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CAK9F;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CAK9F;AAED,kDAAkD;AAClD,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CAK9F"}
+{"version":3,"file":"api-keys.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EACL,WAAW,EASZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,EACzC,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAMpH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AA8DnH,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AA4D7G,uDAAuD;AACvD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,GAAG,kBAAkB,CAyB5H;AA0LD,8DAA8D;AAC9D,wBAAgB,2BAA2B,IAAI,0CAA0C,EAAE,CAK1F;AAED,2CAA2C;AAC3C,wBAAgB,2BAA2B,IAAI,0CAA0C,EAAE,CAK1F;AAED,6CAA6C;AAC7C,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CAK9F;AAED,+FAA+F;AAC/F,wBAAgB,iCAAiC,IAAI,0CAA0C,EAAE,CAKhG;AAED,oDAAoD;AACpD,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CAK9F;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CAK9F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,IAAI,0CAA0C,EAAE,CAc1F;AAED,kDAAkD;AAClD,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CAK9F"}

package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.js

@@ -352,6 +352,34 @@ export function createApiKeyDeactivateFactories() {
 export function createApiKeyReactivateFactories() {
     return apiKeyFactoriesForOperation((target) => target.ops.REACTIVATE, () => buildApiKeyStatusTransitionHandlers(ApiKeyStatus.INACTIVE, ApiKeyStatus.ACTIVE));
 }
+/**
+ * EXPIRE impls — ACTIVE → EXPIRED, forced, dispatched by the credential-expiry sweep (#413).
+ *
+ * Registered separately from every other api-key op rather than through
+ * `apiKeyFactoriesForOperation`, and the difference is the whole point: that helper hardcodes
+ * `variantType: API_CALL` and fans out over each resource's HTTP variants (including the org
+ * resource's cross-tenant `admin` one). EXPIRE is INTERNAL_CALL with a single default variant on
+ * both resources — no route, no operator affordance — so it needs its own registration or the
+ * lookup key would never match and the guard below would be silently unreachable.
+ *
+ * The ACTIVE-only precondition is the reason this verb exists at all: a sweep writing `status`
+ * directly would relabel an INACTIVE key as EXPIRED and erase the fact that an administrator
+ * retired it.
+ */
+export function createApiKeyExpireFactories() {
+    return API_KEY_TARGETS.map((target) => {
+        const factory = (_resourcesRegistryService, _container) => createResourceCustomServiceImplementation({
+            operationPath: {
+                resourceIdentifier: target.resourceType,
+                operationIdentifier: target.ops.EXPIRE,
+                variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                isOperationDefault: true,
+            },
+            handlers: buildApiKeyStatusTransitionHandlers(ApiKeyStatus.ACTIVE, ApiKeyStatus.EXPIRED),
+        });
+        return factory;
+    });
+}
 /** USAGE_STATS impls — interim zeroed payload. */
 export function createApiKeyUsageStatsFactories() {
     return apiKeyFactoriesForOperation((target) => target.ops.USAGE_STATS, () => buildApiKeyUsageStatsHandlers());

package/dist/esm/security/api-keys/api-keys.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EACL,WAAW,EACX,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,uCAAuC,EAAE,2BAA2B,EAAE,MAAM,uEAAuE,CAAC;AAG7J;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAiC,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAyF,CAAC;AAElI,mFAAmF;AACnF,IAAK,iBAGJ;AAHD,WAAK,iBAAiB;IACpB,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHI,iBAAiB,KAAjB,iBAAiB,QAGrB;AAiCD;;;;;;;GAOG;AACH,MAAM,eAAe,GAAgC;IACnD;QACE,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;YAC5B,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;SACnD;KACF;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;QACnD,KAAK,EAAE,WAAW,CAAC,WAAW;QAC9B,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7B;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,2BAA2B,CAClC,sBAAgF,EAChF,WAA+E;IAE/E,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,6EAA6E;gBAC7E,4EAA4E;gBAC5E,2DAA2D;gBAC3D,mBAAmB,EAAE,sBAAsB,CAAC,MAAM,CAAC;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB;gBAClB,UAAU;aACX;YACD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;SACzC,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB,CAAC,KAAkB,EAAE,qBAA4C;IACtG,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,gGAAgG;YAChG,gGAAgG;YAChG,iGAAiG;YACjG,4EAA4E;YAC5E,mGAAmG;YACnG,uCAAuC,CAAC,gBAAgB,EAAG,KAA8B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAC5I,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzE,+FAA+F;YAC/F,mBAAmB,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACpD,gFAAgF;YAChF,kFAAkF;YAClF,8DAA8D;YAC9D,OAAO,EAAE,GAAI,KAAiC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACzE,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YACzF,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAAE,OAAO,UAAU,CAAC;YACrE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ;gBAAE,OAAO,UAAU,CAAC;YACjC,OAAO,EAAE,GAAI,UAAsC,EAAE,QAAQ,EAAE,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,KAAkB,EAAE,IAAuB;IAC7E,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8EAA8E;YAC9E,oFAAoF;YACpF,MAAM,OAAO,GAAG,KAAK,CAAC,aAA6C,CAAC;YAEpE,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;gBACtD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,yCAAyC,OAAO,CAAC,MAAM,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE;iBAC/G,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzE,MAAM,2BAA2B,GAAG,IAAI,KAAK,iBAAiB,CAAC,MAAM;gBACnE,CAAC,CAAC,CAAE,KAA2C,CAAC,sBAAsB,IAAI,IAAI,IAAI,EAAE,CAAC;gBACrF,CAAC,CAAC,IAAI,CAAC;YACT,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAEtF,OAAO;gBACL,GAAI,KAAiC;gBACrC,SAAS;gBACT,SAAS;gBACT,uEAAuE;gBACvE,yEAAyE;gBACzE,iBAAiB,EAAE,OAAO,EAAE,SAAS;gBACrC,iBAAiB,EAAE,OAAO,EAAE,SAAS;gBACrC,2BAA2B;aAC5B,CAAC;QACJ,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YACtF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAkC,CAAC;YAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE9C,MAAM,YAAY,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YACnG,IAAI,IAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBACtC,gFAAgF;gBAChF,4EAA4E;gBAC5E,OAAO,EAAE,GAAG,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAsB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YAC1G,CAAC;YACD,yDAAyD;YACzD,OAAO,YAAY,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,+BAA+B;IACtC,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,0EAA0E;YAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,aAA0D,CAAC;YAEjF,wEAAwE;YACxE,qFAAqF;YACrF,4EAA4E;YAC5E,gFAAgF;YAChF,iFAAiF;YACjF,4EAA4E;YAC5E,oGAAoG;YACpG,kEAAkE;YAClE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC/E,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE;iBACxD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,YAAY,EAAE,GAAG,KAAgC,CAAC;YAC1D,OAAO,EAAE,GAAI,KAAiC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,mCAAmC,CAC1C,qBAAmC,EACnC,UAAwB;IAExB,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YACnF,0EAA0E;YAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,aAAuD,CAAC;YAE9E,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBACxD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,2BAA2B,UAAU,kBAAkB,OAAO,CAAC,MAAM,GAAG;wBACjF,YAAY,EAAE,OAAO,CAAC,MAAM;qBAC7B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,6BAA6B;IACpC,OAAO;QACL,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YACpF,MAAM,GAAG,GAAG,KAAK,CAAC,aAAuC,CAAC;YAC1D,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC;YAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;oBACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;oBAC7D,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE;iBAC/D,CAAC,CAAC;YACL,CAAC;YACD,OAAO;gBACL,KAAK;gBACL,aAAa,EAAE,CAAC;gBAChB,gBAAgB,EAAE,CAAC;gBACnB,eAAe,EAAE,CAAC;gBAClB,gBAAgB,EAAE,CAAC;gBACnB,UAAU,EAAE,SAAS;gBACrB,gBAAgB,EAAE,SAAS;gBAC3B,SAAS,EAAE,CAAC;gBACZ,aAAa,EAAE,CAAC;aACjB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,2BAA2B;IACzC,OAAO,2BAA2B,CAChC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAClC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,2BAA2B;IACzC,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,+BAA+B;IAC7C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,UAAU,CAAC,CACnF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iCAAiC;IAC/C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EACpC,GAAG,EAAE,CAAC,+BAA+B,EAAE,CACxC,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,+BAA+B;IAC7C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,GAAG,EAAE,CAAC,mCAAmC,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CACtF,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,+BAA+B;IAC7C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,GAAG,EAAE,CAAC,mCAAmC,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CACtF,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,+BAA+B;IAC7C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAClC,GAAG,EAAE,CAAC,6BAA6B,EAAE,CACtC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * API Keys Custom Implementations\n *\n * Implements the server-side behaviour for the organization + application API-key\n * resources (`organizationApiKeys`, `applicationApiKeys`) that the schema alone\n * cannot express:\n *\n *   CREATE      → mint fresh key material (the client must never supply it).\n *   ROTATE      → reissue the secret; retain the prior secret in a grace window that\n *                 stops authenticating at the caller-chosen `oldKeyInvalidationDate`.\n *   REGENERATE  → reissue the secret; keep the prior secret valid open-endedly (until\n *                 the next rotation) for a zero-downtime overlap.\n *   EXTEND_EXPIRY → push out an existing key's `expiresAt` (409 if the key has no expiry\n *                 to extend). No new secret is minted — it is a plain field update.\n *   USAGE_STATS → return per-key usage metrics (see the zeroed-stats note below).\n *\n * WHY MINTING NEEDS AN IMPL: the schema requires `keyPrefix` + `hashedKey`, but both\n * are `.excludeFromCreate().excludeFromUpdate()` (the client must never supply them)\n * and `plainKey` is an ephemeral response-only field. Nothing generated them, so a\n * bare create/update persisted a row missing the required fields. These impls are the\n * single server-side choke point that mints key material.\n *\n * PATTERN (CREATE / ROTATE / REGENERATE — all \"mint a secret\" ops):\n *   prefixCoreOperations  → mint material; inject the persisted `keyPrefix` +\n *                           `hashedKey` (and, for rotate/regenerate, the previous-key\n *                           grace-window fields) into the payload. Those fields are\n *                           `.excludeFrom{Create,Update}()`, so returning them from the\n *                           prefix is what carries them into the core write — the\n *                           orchestration diffs the prefix-added keys and forwards them\n *                           to the repository's `preserveServerInjectedFields` allowlist\n *                           so the final strict parse re-attaches (rather than strips)\n *                           them. Stash the one-time `plainKey` for the postfix.\n *   postfixCoreOperations → attach the one-time `plainKey` (+ rotate's `oldKeyId` /\n *                           `oldKeyInvalidationDate`) to the response so the operation's\n *                           ephemeral `plainKey` field surfaces it.\n * The core write still runs, so notifications / websocket events fire normally — which\n * is why this is prefix+postfix rather than `replaceCoreOperations`.\n *\n * VARIANT COVERAGE: a custom impl is matched to a running op by its FULL operation-path\n * identity — `isOperationDefault` (the `isDefault` sentinel) vs `variantKey` produce\n * DISTINCT keys (`createOperationPathKey`). So a single default registration only\n * intercepts the default variant; the cross-tenant app-super-admin `admin` variant\n * (org keys only) needs its own registration or it runs the bare core op and fails.\n * `API_KEY_TARGETS` enumerates every (resource × variant) each op exposes. Minting is\n * org-agnostic — the target `organizationId` rides in the payload / pre-fetched record,\n * never from these handlers — so the admin variant reuses the identical handlers and\n * (per the user security decision) also receives the tenant's one-time `plainKey`.\n */\n\nimport {\n  ApiKeyScope,\n  ApiKeyStatus,\n  AppApiKeys_Operations,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  OrgApiKeys_Operations,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type { ApiKeyBase } from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { generateApiKeyMaterial } from './api-key-generation.backend.utils';\nimport type { Container } from 'inversify';\nimport { assertRequestedRolesWithinCallerCeiling, createRoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\nimport type { RoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\n\n/**\n * Bridge for the one-time plaintext key between the CREATE prefix (which mints it) and\n * the postfix (which returns it), keyed by the per-operation `ExecutionContext` INSTANCE.\n * The orchestration threads the SAME `executionContext` through both handlers\n * (`services-registry-handler.backend.service.ts` prefix + postfix calls), so it is a\n * stable, per-invocation correlation key.\n *\n * A `WeakMap` keyed by the EC is deliberately chosen over a `Map` keyed by `hashedKey` /\n * `_id`: (1) NO LEAK — the entry is reclaimed by GC when the request's EC becomes\n * unreachable, so a core-write failure between prefix and postfix cannot strand the\n * plaintext in memory; (2) NO RACE — concurrent operations run on DISTINCT EC instances,\n * so two simultaneous mints/reissues never collide on a shared key. `plainKey` is never\n * persisted; the postfix also deletes the entry for promptness.\n */\nconst PLAINTEXT_KEY_BY_EC = new WeakMap<ExecutionContext<any>, string>();\n\n/**\n * Bridge for ROTATE / REGENERATE, keyed by the same per-operation `ExecutionContext`\n * instance (see {@link PLAINTEXT_KEY_BY_EC}). Carries the one-time `plainKey` AND the\n * applied `previousKeyInvalidationDate`, so the postfix builds ROTATE's\n * `oldKeyInvalidationDate` from the value the prefix actually applied — independent of\n * whether the update result round-trips that field.\n */\nconst REISSUE_BRIDGE_BY_EC = new WeakMap<ExecutionContext<any>, { plainKey: string; previousKeyInvalidationDate: Date | null }>();\n\n/** ROTATE keeps a bounded grace window; REGENERATE keeps an open-ended overlap. */\nenum ApiKeyReissueKind {\n  ROTATE = 'rotate',\n  REGENERATE = 'regenerate',\n}\n\n/**\n * The pre-fetched key fields the reissue prefix reads. `hashedKey`/`keyPrefix` are\n * declared on the concrete org/app schemas rather than `ApiKeyBase`, but are present on\n * every persisted key of either scope, so a structural view covers both.\n */\ntype ReissuableApiKey = Pick<ApiKeyBase, 'status'> & { hashedKey: string; keyPrefix: string };\n\n/**\n * Structural view of a per-resource custom-operation enum — the members that have a\n * backend impl in this file. Both `OrgApiKeys_Operations` and `AppApiKeys_Operations`\n * satisfy it (identical string values).\n */\ntype ApiKeyCustomOps = {\n  ROTATE: string;\n  REGENERATE: string;\n  EXTEND_EXPIRY: string;\n  USAGE_STATS: string;\n  DEACTIVATE: string;\n  REACTIVATE: string;\n};\n\ntype ApiKeyTarget = {\n  resourceType: CoreResourceType;\n  scope: ApiKeyScope;\n  ops: ApiKeyCustomOps;\n  variants: ReadonlyArray<{ isOperationDefault: boolean; variantKey?: string }>;\n};\n\n/** The handler-object shape accepted by `createResourceCustomServiceImplementation`. */\nexport type ApiKeyImplHandlers = Parameters<typeof createResourceCustomServiceImplementation>[0]['handlers'];\n\n/**\n * The API-key resources, their scope (drives the `sk_org_` / `sk_app_` prefix), the\n * per-resource custom-op enum, and every op VARIANT each resource exposes.\n *\n * - ORG keys expose an org-admin DEFAULT + a cross-tenant app-super-admin `admin`\n *   variant → both registered.\n * - APP keys are single-variant (APP_ADMIN-scoped) → default only.\n */\nconst API_KEY_TARGETS: ReadonlyArray<ApiKeyTarget> = [\n  {\n    resourceType: CoreResourceType.ORG_API_KEYS,\n    scope: ApiKeyScope.ORGANIZATION,\n    ops: OrgApiKeys_Operations,\n    variants: [\n      { isOperationDefault: true },\n      { isOperationDefault: false, variantKey: 'admin' },\n    ],\n  },\n  {\n    resourceType: CoreResourceType.APPLICATION_API_KEYS,\n    scope: ApiKeyScope.APPLICATION,\n    ops: AppApiKeys_Operations,\n    variants: [\n      { isOperationDefault: true },\n    ],\n  },\n];\n\n/**\n * Register one custom-impl factory per (target × variant) for a single operation.\n * Every api-key op is API_CALL and needs a distinct registration per variant identity\n * (see the module header) — this centralizes that fan-out.\n */\nfunction apiKeyFactoriesForOperation(\n  operationIdentifierFor: (target: ApiKeyTarget) => string | CoreResourceOperation,\n  handlersFor: (target: ApiKeyTarget, container: Container) => ApiKeyImplHandlers,\n): ResourceCustomServiceImplementationFactory[] {\n  return API_KEY_TARGETS.flatMap((target) =>\n    target.variants.map(({ isOperationDefault, variantKey }) => {\n      const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n        createResourceCustomServiceImplementation({\n          operationPath: {\n            resourceIdentifier: target.resourceType,\n            // API_CALL: the lookup key is built from the RUNNING operation's variantType\n            // (`extractOperationPath` passes it through unchanged), and api-key ops are\n            // dispatched as direct HTTP API_CALLs. Must match exactly.\n            operationIdentifier: operationIdentifierFor(target),\n            variantType: ResourceOperationVariantType.API_CALL,\n            isOperationDefault,\n            variantKey,\n          },\n          handlers: handlersFor(target, container),\n        });\n      return factory as unknown as ResourceCustomServiceImplementationFactory;\n    }),\n  );\n}\n\n/** CREATE — mint material; surface `plainKey` once. */\nexport function buildApiKeyMintHandlers(scope: ApiKeyScope, roleHierarchyResolver: RoleHierarchyResolver): ApiKeyImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // Role-ceiling gate — a principal cannot mint an api-key carrying roles it does not itself hold\n      // (self-service privilege-escalation prevention; APPLICATION-scoped super-admin + system writes\n      // bypass). The ceiling is hierarchy-aware, so an ORG_ADMIN may mint a key carrying the roles its\n      // own role confers (ORG_MANAGER/ORG_MEMBER/…) but never ORG_OWNER above it.\n      // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on machine-credential minting.\n      assertRequestedRolesWithinCallerCeiling(executionContext, (input as { roles?: string[] }).roles, utils.errorBuilder, roleHierarchyResolver);\n      const { plainKey, keyPrefix, hashedKey } = generateApiKeyMaterial(scope);\n      // Bridge the one-time secret to the postfix, keyed by the per-op EC instance; never persisted.\n      PLAINTEXT_KEY_BY_EC.set(executionContext, plainKey);\n      // keyPrefix + hashedKey are `.excludeFromCreate()`; returning them injects them\n      // into the create payload (preserveServerInjectedFields re-attaches them past the\n      // strict parse) so the row persists with the required fields.\n      return { ...(input as Record<string, unknown>), keyPrefix, hashedKey };\n    },\n    postfixCoreOperations: async (_id, createdKey, executionContext, _operationPath, _utils) => {\n      if (!createdKey || typeof createdKey !== 'object') return createdKey;\n      const plainKey = PLAINTEXT_KEY_BY_EC.get(executionContext);\n      PLAINTEXT_KEY_BY_EC.delete(executionContext);\n      if (!plainKey) return createdKey;\n      return { ...(createdKey as Record<string, unknown>), plainKey };\n    },\n  };\n}\n\n/**\n * ROTATE / REGENERATE — reissue the secret on the SAME record, moving the prior secret\n * into the grace-window slot. The bearer-token auth path keeps honoring the prior\n * secret until `previousKeyInvalidationDate` (ROTATE: the caller-chosen instant,\n * defaulting to now = immediate cutover; REGENERATE: `null` = open-ended overlap).\n */\nfunction buildApiKeyReissueHandlers(scope: ApiKeyScope, kind: ApiKeyReissueKind): ApiKeyImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op — it\n      // includes the backend-only `hashedKey`/`keyPrefix` we move into the previous slot.\n      const current = utils.currentObject as ReissuableApiKey | undefined;\n\n      // Only an ACTIVE key can be reissued (spec: 409 for a revoked/expired key —\n      // otherwise rotation would silently re-arm a deactivated credential).\n      if (current && current.status !== ApiKeyStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: { message: `API key cannot be reissued in status '${current.status}'`, apiKeyStatus: current.status },\n        });\n      }\n\n      const { plainKey, keyPrefix, hashedKey } = generateApiKeyMaterial(scope);\n      const previousKeyInvalidationDate = kind === ApiKeyReissueKind.ROTATE\n        ? ((input as { oldKeyInvalidationDate?: Date }).oldKeyInvalidationDate ?? new Date())\n        : null;\n      REISSUE_BRIDGE_BY_EC.set(executionContext, { plainKey, previousKeyInvalidationDate });\n\n      return {\n        ...(input as Record<string, unknown>),\n        hashedKey,\n        keyPrefix,\n        // Move the outgoing secret into the grace-window slot (server-managed,\n        // excludeFrom{Create,Update} → carried by preserveServerInjectedFields).\n        previousHashedKey: current?.hashedKey,\n        previousKeyPrefix: current?.keyPrefix,\n        previousKeyInvalidationDate,\n      };\n    },\n    postfixCoreOperations: async (_id, updated, executionContext, _operationPath, _utils) => {\n      if (!updated || typeof updated !== 'object') return updated;\n      const record = updated as Record<string, unknown>;\n      const bridged = REISSUE_BRIDGE_BY_EC.get(executionContext);\n      REISSUE_BRIDGE_BY_EC.delete(executionContext);\n\n      const withPlainKey = bridged?.plainKey ? { ...record, plainKey: bridged.plainKey } : { ...record };\n      if (kind === ApiKeyReissueKind.ROTATE) {\n        // ROTATE's response DTO additionally carries the rotated record's id + when the\n        // prior secret is invalidated. Same record, so `oldKeyId` is its own `_id`.\n        return { ...withPlainKey, oldKeyId: _id, oldKeyInvalidationDate: bridged?.previousKeyInvalidationDate };\n      }\n      // REGENERATE's response DTO is resource + plainKey only.\n      return withPlainKey;\n    },\n  };\n}\n\n/**\n * EXTEND_EXPIRY — push out an EXISTING key's expiration date. Unlike rotate/regenerate\n * this mints NO material: it borrows UPDATE and simply maps the request-only\n * `newExpiresAt` onto the schema field `expiresAt`.\n *\n * WHY A PREFIX (not replace): `expiresAt` is a normal, updatable field (NOT\n * `.excludeFromUpdate()`), so returning it from the prefix lets the core UPDATE's own\n * strict parse persist it directly — no `preserveServerInjectedFields` allowlisting is\n * needed (contrast rotate/regenerate, whose `hashedKey`/`previous*` writes ARE\n * excludeFromUpdate). The op declares no `customResponseDto`, so its response is the\n * updated resource object = the core UPDATE's default (`mainSchema`) — no postfix.\n *\n * The leftover request-only `newExpiresAt` key rides along in the returned payload and is\n * dropped by the core UPDATE's strict parse (it is not a schema field), exactly as\n * ROTATE's `oldKeyInvalidationDate` is.\n */\nfunction buildApiKeyExtendExpiryHandlers(): ApiKeyImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op.\n      const current = utils.currentObject as Pick<ApiKeyBase, 'expiresAt'> | undefined;\n\n      // 409 guard: a key with no expiry has no window to extend. The frontend\n      // `enabledCondition` (`expiresAt != null`) merely HIDES the action — it is a display\n      // affordance, and the cross-tenant app-super-admin `admin` variant omits it\n      // entirely — so this backend guard is the real enforcement (the paired resource\n      // spec declares CONFLICT_409 \"no expiry to extend\" for both scopes). Without it,\n      // extending a never-expiring key would silently ARM an expiry it never had.\n      // spec-cite: N/A — \"spec\" here is Wildo's OWN paired resource specification, and the quoted text is\n      // its declared conflict message. No external standard is invoked.\n      if (current && (current.expiresAt === null || current.expiresAt === undefined)) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: { message: 'API key has no expiry to extend' },\n        });\n      }\n\n      const { newExpiresAt } = input as { newExpiresAt?: Date };\n      return { ...(input as Record<string, unknown>), expiresAt: newExpiresAt };\n    },\n  };\n}\n\n/**\n * DEACTIVATE / REACTIVATE — FORCE one API-key status transition.\n *\n * WHY THIS EXISTS AT ALL: both verbs used to have no implementation and no `requestDto`, so\n * they borrowed UPDATE and inherited the resource's ENTIRE update contract\n * (`{name, description, roles, status, expiresAt}`). `PUT .../deactivate` could therefore\n * carry `status: active` — the verb doing the exact opposite of its name — and could rewrite\n * `roles` on a machine credential, on a resource that deliberately exposes NO core UPDATE and\n * whose only role-ceiling gate lives in the CREATE handler. The paired configs now narrow the\n * request contract to `z.object({})`; this handler supplies the transition the verb names.\n *\n * WHY A PREFIX (not replace): `status` is a normal updatable field, so returning it lets the\n * core UPDATE persist it directly and keeps the operation's response the updated resource —\n * the same shape EXTEND_EXPIRY uses. Note the dispatcher MERGES a prefix's return onto the\n * caller payload rather than substituting it, so the narrowed DTO is what actually bounds the\n * write; this return only adds the forced field.\n *\n * WHY A BACKEND PRECONDITION: the resource `enabledCondition` is a DISPLAY affordance and the\n * cross-tenant app-super-admin `admin` variants omit it entirely, so this 409 is the real\n * enforcement. Without it, \"reactivate\" would silently re-arm an EXPIRED key — reviving a\n * credential whose expiry was the thing retiring it.\n *\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential state transitions are explicit and\n * validated, never inferred from a caller-supplied field.\n */\nfunction buildApiKeyStatusTransitionHandlers(\n  requiredCurrentStatus: ApiKeyStatus,\n  nextStatus: ApiKeyStatus,\n): ApiKeyImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, _input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op.\n      const current = utils.currentObject as Pick<ApiKeyBase, 'status'> | undefined;\n\n      if (current && current.status !== requiredCurrentStatus) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: {\n            message: `API key cannot move to '${nextStatus}' from status '${current.status}'`,\n            apiKeyStatus: current.status,\n          },\n        });\n      }\n\n      return { status: nextStatus };\n    },\n  };\n}\n\n/**\n * USAGE_STATS — INTERIM zeroed payload. There is NO per-key usage data source yet: the\n * bearer-token auth path does not record request/error/rate-limit counts (or even\n * `lastUsedAt`) for api-keys. Until a usage-tracking subsystem exists, return a\n * well-formed ALL-ZERO payload so the operation's response DTO validates instead of\n * 500ing. This deliberately reports zeros (reads as \"no usage recorded\"), NOT fabricated\n * metrics — replace with real aggregation when tracking lands. See the plan\n * `.claude/plans/api-key-rotation-grace-window.md`.\n */\nfunction buildApiKeyUsageStatsHandlers(): ApiKeyImplHandlers {\n  return {\n    replaceCoreOperations: async (_id, _input, executionContext, _operationPath, utils) => {\n      const key = utils.currentObject as ApiKeyBase | undefined;\n      const keyId = key?._id ?? _id;\n      if (!keyId) {\n        throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n          context: { message: 'API key not found for usage statistics' },\n        });\n      }\n      return {\n        keyId,\n        totalRequests: 0,\n        requestsLastHour: 0,\n        requestsLastDay: 0,\n        requestsLastWeek: 0,\n        lastUsedAt: undefined,\n        mostUsedEndpoint: undefined,\n        errorRate: 0,\n        rateLimitHits: 0,\n      };\n    },\n  };\n}\n\n/** CREATE impls — org default + org `admin` + app default. */\nexport function createApiKeyCreateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    () => CoreResourceOperation.CREATE,\n    (target, container) => buildApiKeyMintHandlers(target.scope, createRoleHierarchyResolver(container)),\n  );\n}\n\n/** ROTATE impls — bounded grace window. */\nexport function createApiKeyRotateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.ROTATE,\n    (target) => buildApiKeyReissueHandlers(target.scope, ApiKeyReissueKind.ROTATE),\n  );\n}\n\n/** REGENERATE impls — open-ended overlap. */\nexport function createApiKeyRegenerateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.REGENERATE,\n    (target) => buildApiKeyReissueHandlers(target.scope, ApiKeyReissueKind.REGENERATE),\n  );\n}\n\n/** EXTEND_EXPIRY impls — map `newExpiresAt` → the persisted `expiresAt` on an existing key. */\nexport function createApiKeyExtendExpiryFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.EXTEND_EXPIRY,\n    () => buildApiKeyExtendExpiryHandlers(),\n  );\n}\n\n/** DEACTIVATE impls — ACTIVE → INACTIVE, forced. */\nexport function createApiKeyDeactivateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.DEACTIVATE,\n    () => buildApiKeyStatusTransitionHandlers(ApiKeyStatus.ACTIVE, ApiKeyStatus.INACTIVE),\n  );\n}\n\n/** REACTIVATE impls — INACTIVE → ACTIVE, forced. An EXPIRED key is NOT revivable (409). */\nexport function createApiKeyReactivateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.REACTIVATE,\n    () => buildApiKeyStatusTransitionHandlers(ApiKeyStatus.INACTIVE, ApiKeyStatus.ACTIVE),\n  );\n}\n\n/** USAGE_STATS impls — interim zeroed payload. */\nexport function createApiKeyUsageStatsFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.USAGE_STATS,\n    () => buildApiKeyUsageStatsHandlers(),\n  );\n}\n"]}
+{"version":3,"file":"api-keys.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EACL,WAAW,EACX,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,uCAAuC,EAAE,2BAA2B,EAAE,MAAM,uEAAuE,CAAC;AAG7J;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAiC,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAyF,CAAC;AAElI,mFAAmF;AACnF,IAAK,iBAGJ;AAHD,WAAK,iBAAiB;IACpB,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHI,iBAAiB,KAAjB,iBAAiB,QAGrB;AAkCD;;;;;;;GAOG;AACH,MAAM,eAAe,GAAgC;IACnD;QACE,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;YAC5B,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;SACnD;KACF;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;QACnD,KAAK,EAAE,WAAW,CAAC,WAAW;QAC9B,GAAG,EAAE,qBAAqB;QAC1B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7B;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,2BAA2B,CAClC,sBAAgF,EAChF,WAA+E;IAE/E,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,6EAA6E;gBAC7E,4EAA4E;gBAC5E,2DAA2D;gBAC3D,mBAAmB,EAAE,sBAAsB,CAAC,MAAM,CAAC;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB;gBAClB,UAAU;aACX;YACD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;SACzC,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB,CAAC,KAAkB,EAAE,qBAA4C;IACtG,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,gGAAgG;YAChG,gGAAgG;YAChG,iGAAiG;YACjG,4EAA4E;YAC5E,mGAAmG;YACnG,uCAAuC,CAAC,gBAAgB,EAAG,KAA8B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAC5I,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzE,+FAA+F;YAC/F,mBAAmB,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACpD,gFAAgF;YAChF,kFAAkF;YAClF,8DAA8D;YAC9D,OAAO,EAAE,GAAI,KAAiC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACzE,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YACzF,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAAE,OAAO,UAAU,CAAC;YACrE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ;gBAAE,OAAO,UAAU,CAAC;YACjC,OAAO,EAAE,GAAI,UAAsC,EAAE,QAAQ,EAAE,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,KAAkB,EAAE,IAAuB;IAC7E,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8EAA8E;YAC9E,oFAAoF;YACpF,MAAM,OAAO,GAAG,KAAK,CAAC,aAA6C,CAAC;YAEpE,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;gBACtD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,yCAAyC,OAAO,CAAC,MAAM,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE;iBAC/G,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzE,MAAM,2BAA2B,GAAG,IAAI,KAAK,iBAAiB,CAAC,MAAM;gBACnE,CAAC,CAAC,CAAE,KAA2C,CAAC,sBAAsB,IAAI,IAAI,IAAI,EAAE,CAAC;gBACrF,CAAC,CAAC,IAAI,CAAC;YACT,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAEtF,OAAO;gBACL,GAAI,KAAiC;gBACrC,SAAS;gBACT,SAAS;gBACT,uEAAuE;gBACvE,yEAAyE;gBACzE,iBAAiB,EAAE,OAAO,EAAE,SAAS;gBACrC,iBAAiB,EAAE,OAAO,EAAE,SAAS;gBACrC,2BAA2B;aAC5B,CAAC;QACJ,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YACtF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAkC,CAAC;YAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE9C,MAAM,YAAY,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YACnG,IAAI,IAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBACtC,gFAAgF;gBAChF,4EAA4E;gBAC5E,OAAO,EAAE,GAAG,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAsB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YAC1G,CAAC;YACD,yDAAyD;YACzD,OAAO,YAAY,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,+BAA+B;IACtC,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,0EAA0E;YAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,aAA0D,CAAC;YAEjF,wEAAwE;YACxE,qFAAqF;YACrF,4EAA4E;YAC5E,gFAAgF;YAChF,iFAAiF;YACjF,4EAA4E;YAC5E,oGAAoG;YACpG,kEAAkE;YAClE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC/E,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE;iBACxD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,YAAY,EAAE,GAAG,KAAgC,CAAC;YAC1D,OAAO,EAAE,GAAI,KAAiC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,mCAAmC,CAC1C,qBAAmC,EACnC,UAAwB;IAExB,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YACnF,0EAA0E;YAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,aAAuD,CAAC;YAE9E,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBACxD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,2BAA2B,UAAU,kBAAkB,OAAO,CAAC,MAAM,GAAG;wBACjF,YAAY,EAAE,OAAO,CAAC,MAAM;qBAC7B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,6BAA6B;IACpC,OAAO;QACL,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YACpF,MAAM,GAAG,GAAG,KAAK,CAAC,aAAuC,CAAC;YAC1D,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC;YAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;oBACzE,sBAAsB,EAAE,2BAA2B,CAAC,SAAS;oBAC7D,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE;iBAC/D,CAAC,CAAC;YACL,CAAC;YACD,OAAO;gBACL,KAAK;gBACL,aAAa,EAAE,CAAC;gBAChB,gBAAgB,EAAE,CAAC;gBACnB,eAAe,EAAE,CAAC;gBAClB,gBAAgB,EAAE,CAAC;gBACnB,UAAU,EAAE,SAAS;gBACrB,gBAAgB,EAAE,SAAS;gBAC3B,SAAS,EAAE,CAAC;gBACZ,aAAa,EAAE,CAAC;aACjB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,2BAA2B;IACzC,OAAO,2BAA2B,CAChC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAClC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,2BAA2B;IACzC,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,+BAA+B;IAC7C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,UAAU,CAAC,CACnF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iCAAiC;IAC/C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EACpC,GAAG,EAAE,CAAC,+BAA+B,EAAE,CACxC,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,+BAA+B;IAC7C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,GAAG,EAAE,CAAC,mCAAmC,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CACtF,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,+BAA+B;IAC7C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,GAAG,EAAE,CAAC,mCAAmC,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CACtF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,UAAqB,EAAE,EAAE,CACpG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM;gBACtC,WAAW,EAAE,4BAA4B,CAAC,aAAa;gBACvD,kBAAkB,EAAE,IAAI;aACzB;YACD,QAAQ,EAAE,mCAAmC,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;SACzF,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,+BAA+B;IAC7C,OAAO,2BAA2B,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAClC,GAAG,EAAE,CAAC,6BAA6B,EAAE,CACtC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * API Keys Custom Implementations\n *\n * Implements the server-side behaviour for the organization + application API-key\n * resources (`organizationApiKeys`, `applicationApiKeys`) that the schema alone\n * cannot express:\n *\n *   CREATE      → mint fresh key material (the client must never supply it).\n *   ROTATE      → reissue the secret; retain the prior secret in a grace window that\n *                 stops authenticating at the caller-chosen `oldKeyInvalidationDate`.\n *   REGENERATE  → reissue the secret; keep the prior secret valid open-endedly (until\n *                 the next rotation) for a zero-downtime overlap.\n *   EXTEND_EXPIRY → push out an existing key's `expiresAt` (409 if the key has no expiry\n *                 to extend). No new secret is minted — it is a plain field update.\n *   USAGE_STATS → return per-key usage metrics (see the zeroed-stats note below).\n *\n * WHY MINTING NEEDS AN IMPL: the schema requires `keyPrefix` + `hashedKey`, but both\n * are `.excludeFromCreate().excludeFromUpdate()` (the client must never supply them)\n * and `plainKey` is an ephemeral response-only field. Nothing generated them, so a\n * bare create/update persisted a row missing the required fields. These impls are the\n * single server-side choke point that mints key material.\n *\n * PATTERN (CREATE / ROTATE / REGENERATE — all \"mint a secret\" ops):\n *   prefixCoreOperations  → mint material; inject the persisted `keyPrefix` +\n *                           `hashedKey` (and, for rotate/regenerate, the previous-key\n *                           grace-window fields) into the payload. Those fields are\n *                           `.excludeFrom{Create,Update}()`, so returning them from the\n *                           prefix is what carries them into the core write — the\n *                           orchestration diffs the prefix-added keys and forwards them\n *                           to the repository's `preserveServerInjectedFields` allowlist\n *                           so the final strict parse re-attaches (rather than strips)\n *                           them. Stash the one-time `plainKey` for the postfix.\n *   postfixCoreOperations → attach the one-time `plainKey` (+ rotate's `oldKeyId` /\n *                           `oldKeyInvalidationDate`) to the response so the operation's\n *                           ephemeral `plainKey` field surfaces it.\n * The core write still runs, so notifications / websocket events fire normally — which\n * is why this is prefix+postfix rather than `replaceCoreOperations`.\n *\n * VARIANT COVERAGE: a custom impl is matched to a running op by its FULL operation-path\n * identity — `isOperationDefault` (the `isDefault` sentinel) vs `variantKey` produce\n * DISTINCT keys (`createOperationPathKey`). So a single default registration only\n * intercepts the default variant; the cross-tenant app-super-admin `admin` variant\n * (org keys only) needs its own registration or it runs the bare core op and fails.\n * `API_KEY_TARGETS` enumerates every (resource × variant) each op exposes. Minting is\n * org-agnostic — the target `organizationId` rides in the payload / pre-fetched record,\n * never from these handlers — so the admin variant reuses the identical handlers and\n * (per the user security decision) also receives the tenant's one-time `plainKey`.\n */\n\nimport {\n  ApiKeyScope,\n  ApiKeyStatus,\n  AppApiKeys_Operations,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  OrgApiKeys_Operations,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type { ApiKeyBase } from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { generateApiKeyMaterial } from './api-key-generation.backend.utils';\nimport type { Container } from 'inversify';\nimport { assertRequestedRolesWithinCallerCeiling, createRoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\nimport type { RoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\n\n/**\n * Bridge for the one-time plaintext key between the CREATE prefix (which mints it) and\n * the postfix (which returns it), keyed by the per-operation `ExecutionContext` INSTANCE.\n * The orchestration threads the SAME `executionContext` through both handlers\n * (`services-registry-handler.backend.service.ts` prefix + postfix calls), so it is a\n * stable, per-invocation correlation key.\n *\n * A `WeakMap` keyed by the EC is deliberately chosen over a `Map` keyed by `hashedKey` /\n * `_id`: (1) NO LEAK — the entry is reclaimed by GC when the request's EC becomes\n * unreachable, so a core-write failure between prefix and postfix cannot strand the\n * plaintext in memory; (2) NO RACE — concurrent operations run on DISTINCT EC instances,\n * so two simultaneous mints/reissues never collide on a shared key. `plainKey` is never\n * persisted; the postfix also deletes the entry for promptness.\n */\nconst PLAINTEXT_KEY_BY_EC = new WeakMap<ExecutionContext<any>, string>();\n\n/**\n * Bridge for ROTATE / REGENERATE, keyed by the same per-operation `ExecutionContext`\n * instance (see {@link PLAINTEXT_KEY_BY_EC}). Carries the one-time `plainKey` AND the\n * applied `previousKeyInvalidationDate`, so the postfix builds ROTATE's\n * `oldKeyInvalidationDate` from the value the prefix actually applied — independent of\n * whether the update result round-trips that field.\n */\nconst REISSUE_BRIDGE_BY_EC = new WeakMap<ExecutionContext<any>, { plainKey: string; previousKeyInvalidationDate: Date | null }>();\n\n/** ROTATE keeps a bounded grace window; REGENERATE keeps an open-ended overlap. */\nenum ApiKeyReissueKind {\n  ROTATE = 'rotate',\n  REGENERATE = 'regenerate',\n}\n\n/**\n * The pre-fetched key fields the reissue prefix reads. `hashedKey`/`keyPrefix` are\n * declared on the concrete org/app schemas rather than `ApiKeyBase`, but are present on\n * every persisted key of either scope, so a structural view covers both.\n */\ntype ReissuableApiKey = Pick<ApiKeyBase, 'status'> & { hashedKey: string; keyPrefix: string };\n\n/**\n * Structural view of a per-resource custom-operation enum — the members that have a\n * backend impl in this file. Both `OrgApiKeys_Operations` and `AppApiKeys_Operations`\n * satisfy it (identical string values).\n */\ntype ApiKeyCustomOps = {\n  ROTATE: string;\n  REGENERATE: string;\n  EXTEND_EXPIRY: string;\n  USAGE_STATS: string;\n  DEACTIVATE: string;\n  REACTIVATE: string;\n  EXPIRE: string;\n};\n\ntype ApiKeyTarget = {\n  resourceType: CoreResourceType;\n  scope: ApiKeyScope;\n  ops: ApiKeyCustomOps;\n  variants: ReadonlyArray<{ isOperationDefault: boolean; variantKey?: string }>;\n};\n\n/** The handler-object shape accepted by `createResourceCustomServiceImplementation`. */\nexport type ApiKeyImplHandlers = Parameters<typeof createResourceCustomServiceImplementation>[0]['handlers'];\n\n/**\n * The API-key resources, their scope (drives the `sk_org_` / `sk_app_` prefix), the\n * per-resource custom-op enum, and every op VARIANT each resource exposes.\n *\n * - ORG keys expose an org-admin DEFAULT + a cross-tenant app-super-admin `admin`\n *   variant → both registered.\n * - APP keys are single-variant (APP_ADMIN-scoped) → default only.\n */\nconst API_KEY_TARGETS: ReadonlyArray<ApiKeyTarget> = [\n  {\n    resourceType: CoreResourceType.ORG_API_KEYS,\n    scope: ApiKeyScope.ORGANIZATION,\n    ops: OrgApiKeys_Operations,\n    variants: [\n      { isOperationDefault: true },\n      { isOperationDefault: false, variantKey: 'admin' },\n    ],\n  },\n  {\n    resourceType: CoreResourceType.APPLICATION_API_KEYS,\n    scope: ApiKeyScope.APPLICATION,\n    ops: AppApiKeys_Operations,\n    variants: [\n      { isOperationDefault: true },\n    ],\n  },\n];\n\n/**\n * Register one custom-impl factory per (target × variant) for a single operation.\n * Every api-key op is API_CALL and needs a distinct registration per variant identity\n * (see the module header) — this centralizes that fan-out.\n */\nfunction apiKeyFactoriesForOperation(\n  operationIdentifierFor: (target: ApiKeyTarget) => string | CoreResourceOperation,\n  handlersFor: (target: ApiKeyTarget, container: Container) => ApiKeyImplHandlers,\n): ResourceCustomServiceImplementationFactory[] {\n  return API_KEY_TARGETS.flatMap((target) =>\n    target.variants.map(({ isOperationDefault, variantKey }) => {\n      const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n        createResourceCustomServiceImplementation({\n          operationPath: {\n            resourceIdentifier: target.resourceType,\n            // API_CALL: the lookup key is built from the RUNNING operation's variantType\n            // (`extractOperationPath` passes it through unchanged), and api-key ops are\n            // dispatched as direct HTTP API_CALLs. Must match exactly.\n            operationIdentifier: operationIdentifierFor(target),\n            variantType: ResourceOperationVariantType.API_CALL,\n            isOperationDefault,\n            variantKey,\n          },\n          handlers: handlersFor(target, container),\n        });\n      return factory as unknown as ResourceCustomServiceImplementationFactory;\n    }),\n  );\n}\n\n/** CREATE — mint material; surface `plainKey` once. */\nexport function buildApiKeyMintHandlers(scope: ApiKeyScope, roleHierarchyResolver: RoleHierarchyResolver): ApiKeyImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // Role-ceiling gate — a principal cannot mint an api-key carrying roles it does not itself hold\n      // (self-service privilege-escalation prevention; APPLICATION-scoped super-admin + system writes\n      // bypass). The ceiling is hierarchy-aware, so an ORG_ADMIN may mint a key carrying the roles its\n      // own role confers (ORG_MANAGER/ORG_MEMBER/…) but never ORG_OWNER above it.\n      // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on machine-credential minting.\n      assertRequestedRolesWithinCallerCeiling(executionContext, (input as { roles?: string[] }).roles, utils.errorBuilder, roleHierarchyResolver);\n      const { plainKey, keyPrefix, hashedKey } = generateApiKeyMaterial(scope);\n      // Bridge the one-time secret to the postfix, keyed by the per-op EC instance; never persisted.\n      PLAINTEXT_KEY_BY_EC.set(executionContext, plainKey);\n      // keyPrefix + hashedKey are `.excludeFromCreate()`; returning them injects them\n      // into the create payload (preserveServerInjectedFields re-attaches them past the\n      // strict parse) so the row persists with the required fields.\n      return { ...(input as Record<string, unknown>), keyPrefix, hashedKey };\n    },\n    postfixCoreOperations: async (_id, createdKey, executionContext, _operationPath, _utils) => {\n      if (!createdKey || typeof createdKey !== 'object') return createdKey;\n      const plainKey = PLAINTEXT_KEY_BY_EC.get(executionContext);\n      PLAINTEXT_KEY_BY_EC.delete(executionContext);\n      if (!plainKey) return createdKey;\n      return { ...(createdKey as Record<string, unknown>), plainKey };\n    },\n  };\n}\n\n/**\n * ROTATE / REGENERATE — reissue the secret on the SAME record, moving the prior secret\n * into the grace-window slot. The bearer-token auth path keeps honoring the prior\n * secret until `previousKeyInvalidationDate` (ROTATE: the caller-chosen instant,\n * defaulting to now = immediate cutover; REGENERATE: `null` = open-ended overlap).\n */\nfunction buildApiKeyReissueHandlers(scope: ApiKeyScope, kind: ApiKeyReissueKind): ApiKeyImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op — it\n      // includes the backend-only `hashedKey`/`keyPrefix` we move into the previous slot.\n      const current = utils.currentObject as ReissuableApiKey | undefined;\n\n      // Only an ACTIVE key can be reissued (spec: 409 for a revoked/expired key —\n      // otherwise rotation would silently re-arm a deactivated credential).\n      if (current && current.status !== ApiKeyStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: { message: `API key cannot be reissued in status '${current.status}'`, apiKeyStatus: current.status },\n        });\n      }\n\n      const { plainKey, keyPrefix, hashedKey } = generateApiKeyMaterial(scope);\n      const previousKeyInvalidationDate = kind === ApiKeyReissueKind.ROTATE\n        ? ((input as { oldKeyInvalidationDate?: Date }).oldKeyInvalidationDate ?? new Date())\n        : null;\n      REISSUE_BRIDGE_BY_EC.set(executionContext, { plainKey, previousKeyInvalidationDate });\n\n      return {\n        ...(input as Record<string, unknown>),\n        hashedKey,\n        keyPrefix,\n        // Move the outgoing secret into the grace-window slot (server-managed,\n        // excludeFrom{Create,Update} → carried by preserveServerInjectedFields).\n        previousHashedKey: current?.hashedKey,\n        previousKeyPrefix: current?.keyPrefix,\n        previousKeyInvalidationDate,\n      };\n    },\n    postfixCoreOperations: async (_id, updated, executionContext, _operationPath, _utils) => {\n      if (!updated || typeof updated !== 'object') return updated;\n      const record = updated as Record<string, unknown>;\n      const bridged = REISSUE_BRIDGE_BY_EC.get(executionContext);\n      REISSUE_BRIDGE_BY_EC.delete(executionContext);\n\n      const withPlainKey = bridged?.plainKey ? { ...record, plainKey: bridged.plainKey } : { ...record };\n      if (kind === ApiKeyReissueKind.ROTATE) {\n        // ROTATE's response DTO additionally carries the rotated record's id + when the\n        // prior secret is invalidated. Same record, so `oldKeyId` is its own `_id`.\n        return { ...withPlainKey, oldKeyId: _id, oldKeyInvalidationDate: bridged?.previousKeyInvalidationDate };\n      }\n      // REGENERATE's response DTO is resource + plainKey only.\n      return withPlainKey;\n    },\n  };\n}\n\n/**\n * EXTEND_EXPIRY — push out an EXISTING key's expiration date. Unlike rotate/regenerate\n * this mints NO material: it borrows UPDATE and simply maps the request-only\n * `newExpiresAt` onto the schema field `expiresAt`.\n *\n * WHY A PREFIX (not replace): `expiresAt` is a normal, updatable field (NOT\n * `.excludeFromUpdate()`), so returning it from the prefix lets the core UPDATE's own\n * strict parse persist it directly — no `preserveServerInjectedFields` allowlisting is\n * needed (contrast rotate/regenerate, whose `hashedKey`/`previous*` writes ARE\n * excludeFromUpdate). The op declares no `customResponseDto`, so its response is the\n * updated resource object = the core UPDATE's default (`mainSchema`) — no postfix.\n *\n * The leftover request-only `newExpiresAt` key rides along in the returned payload and is\n * dropped by the core UPDATE's strict parse (it is not a schema field), exactly as\n * ROTATE's `oldKeyInvalidationDate` is.\n */\nfunction buildApiKeyExtendExpiryHandlers(): ApiKeyImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op.\n      const current = utils.currentObject as Pick<ApiKeyBase, 'expiresAt'> | undefined;\n\n      // 409 guard: a key with no expiry has no window to extend. The frontend\n      // `enabledCondition` (`expiresAt != null`) merely HIDES the action — it is a display\n      // affordance, and the cross-tenant app-super-admin `admin` variant omits it\n      // entirely — so this backend guard is the real enforcement (the paired resource\n      // spec declares CONFLICT_409 \"no expiry to extend\" for both scopes). Without it,\n      // extending a never-expiring key would silently ARM an expiry it never had.\n      // spec-cite: N/A — \"spec\" here is Wildo's OWN paired resource specification, and the quoted text is\n      // its declared conflict message. No external standard is invoked.\n      if (current && (current.expiresAt === null || current.expiresAt === undefined)) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: { message: 'API key has no expiry to extend' },\n        });\n      }\n\n      const { newExpiresAt } = input as { newExpiresAt?: Date };\n      return { ...(input as Record<string, unknown>), expiresAt: newExpiresAt };\n    },\n  };\n}\n\n/**\n * DEACTIVATE / REACTIVATE — FORCE one API-key status transition.\n *\n * WHY THIS EXISTS AT ALL: both verbs used to have no implementation and no `requestDto`, so\n * they borrowed UPDATE and inherited the resource's ENTIRE update contract\n * (`{name, description, roles, status, expiresAt}`). `PUT .../deactivate` could therefore\n * carry `status: active` — the verb doing the exact opposite of its name — and could rewrite\n * `roles` on a machine credential, on a resource that deliberately exposes NO core UPDATE and\n * whose only role-ceiling gate lives in the CREATE handler. The paired configs now narrow the\n * request contract to `z.object({})`; this handler supplies the transition the verb names.\n *\n * WHY A PREFIX (not replace): `status` is a normal updatable field, so returning it lets the\n * core UPDATE persist it directly and keeps the operation's response the updated resource —\n * the same shape EXTEND_EXPIRY uses. Note the dispatcher MERGES a prefix's return onto the\n * caller payload rather than substituting it, so the narrowed DTO is what actually bounds the\n * write; this return only adds the forced field.\n *\n * WHY A BACKEND PRECONDITION: the resource `enabledCondition` is a DISPLAY affordance and the\n * cross-tenant app-super-admin `admin` variants omit it entirely, so this 409 is the real\n * enforcement. Without it, \"reactivate\" would silently re-arm an EXPIRED key — reviving a\n * credential whose expiry was the thing retiring it.\n *\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential state transitions are explicit and\n * validated, never inferred from a caller-supplied field.\n */\nfunction buildApiKeyStatusTransitionHandlers(\n  requiredCurrentStatus: ApiKeyStatus,\n  nextStatus: ApiKeyStatus,\n): ApiKeyImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, _input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op.\n      const current = utils.currentObject as Pick<ApiKeyBase, 'status'> | undefined;\n\n      if (current && current.status !== requiredCurrentStatus) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: {\n            message: `API key cannot move to '${nextStatus}' from status '${current.status}'`,\n            apiKeyStatus: current.status,\n          },\n        });\n      }\n\n      return { status: nextStatus };\n    },\n  };\n}\n\n/**\n * USAGE_STATS — INTERIM zeroed payload. There is NO per-key usage data source yet: the\n * bearer-token auth path does not record request/error/rate-limit counts (or even\n * `lastUsedAt`) for api-keys. Until a usage-tracking subsystem exists, return a\n * well-formed ALL-ZERO payload so the operation's response DTO validates instead of\n * 500ing. This deliberately reports zeros (reads as \"no usage recorded\"), NOT fabricated\n * metrics — replace with real aggregation when tracking lands. See the plan\n * `.claude/plans/api-key-rotation-grace-window.md`.\n */\nfunction buildApiKeyUsageStatsHandlers(): ApiKeyImplHandlers {\n  return {\n    replaceCoreOperations: async (_id, _input, executionContext, _operationPath, utils) => {\n      const key = utils.currentObject as ApiKeyBase | undefined;\n      const keyId = key?._id ?? _id;\n      if (!keyId) {\n        throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.NOT_FOUND,\n          context: { message: 'API key not found for usage statistics' },\n        });\n      }\n      return {\n        keyId,\n        totalRequests: 0,\n        requestsLastHour: 0,\n        requestsLastDay: 0,\n        requestsLastWeek: 0,\n        lastUsedAt: undefined,\n        mostUsedEndpoint: undefined,\n        errorRate: 0,\n        rateLimitHits: 0,\n      };\n    },\n  };\n}\n\n/** CREATE impls — org default + org `admin` + app default. */\nexport function createApiKeyCreateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    () => CoreResourceOperation.CREATE,\n    (target, container) => buildApiKeyMintHandlers(target.scope, createRoleHierarchyResolver(container)),\n  );\n}\n\n/** ROTATE impls — bounded grace window. */\nexport function createApiKeyRotateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.ROTATE,\n    (target) => buildApiKeyReissueHandlers(target.scope, ApiKeyReissueKind.ROTATE),\n  );\n}\n\n/** REGENERATE impls — open-ended overlap. */\nexport function createApiKeyRegenerateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.REGENERATE,\n    (target) => buildApiKeyReissueHandlers(target.scope, ApiKeyReissueKind.REGENERATE),\n  );\n}\n\n/** EXTEND_EXPIRY impls — map `newExpiresAt` → the persisted `expiresAt` on an existing key. */\nexport function createApiKeyExtendExpiryFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.EXTEND_EXPIRY,\n    () => buildApiKeyExtendExpiryHandlers(),\n  );\n}\n\n/** DEACTIVATE impls — ACTIVE → INACTIVE, forced. */\nexport function createApiKeyDeactivateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.DEACTIVATE,\n    () => buildApiKeyStatusTransitionHandlers(ApiKeyStatus.ACTIVE, ApiKeyStatus.INACTIVE),\n  );\n}\n\n/** REACTIVATE impls — INACTIVE → ACTIVE, forced. An EXPIRED key is NOT revivable (409). */\nexport function createApiKeyReactivateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.REACTIVATE,\n    () => buildApiKeyStatusTransitionHandlers(ApiKeyStatus.INACTIVE, ApiKeyStatus.ACTIVE),\n  );\n}\n\n/**\n * EXPIRE impls — ACTIVE → EXPIRED, forced, dispatched by the credential-expiry sweep (#413).\n *\n * Registered separately from every other api-key op rather than through\n * `apiKeyFactoriesForOperation`, and the difference is the whole point: that helper hardcodes\n * `variantType: API_CALL` and fans out over each resource's HTTP variants (including the org\n * resource's cross-tenant `admin` one). EXPIRE is INTERNAL_CALL with a single default variant on\n * both resources — no route, no operator affordance — so it needs its own registration or the\n * lookup key would never match and the guard below would be silently unreachable.\n *\n * The ACTIVE-only precondition is the reason this verb exists at all: a sweep writing `status`\n * directly would relabel an INACTIVE key as EXPIRED and erase the fact that an administrator\n * retired it.\n */\nexport function createApiKeyExpireFactories(): ResourceCustomServiceImplementationFactory[] {\n  return API_KEY_TARGETS.map((target) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, _container: Container) =>\n      createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: target.resourceType,\n          operationIdentifier: target.ops.EXPIRE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: buildApiKeyStatusTransitionHandlers(ApiKeyStatus.ACTIVE, ApiKeyStatus.EXPIRED),\n      });\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\n/** USAGE_STATS impls — interim zeroed payload. */\nexport function createApiKeyUsageStatsFactories(): ResourceCustomServiceImplementationFactory[] {\n  return apiKeyFactoriesForOperation(\n    (target) => target.ops.USAGE_STATS,\n    () => buildApiKeyUsageStatsHandlers(),\n  );\n}\n"]}

package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.d.ts

@@ -1,7 +1,11 @@
 /**
  * Anonymous Session Cleanup Batch Job (W7.3a)
  *
- * Runs daily and cleans up orphaned anonymous sessions:
+ * Runs daily. It is BOTH the repair pass and the cleanup pass over the anonymous-session
+ * population, in that order — the ordering matters, because step 3 below retires the only record of
+ * which account a half-transposed session belongs to:
+ * 0. Finish the ownership transpositions that stopped part-way (converted sessions whose rows are
+ *    still split between the anonymous identity and the account)
  * 1. Find AnonymousUser records that were never converted and are past TTL
  * 2. For each, delete all isAnonymizable resources owned by that anonymous user
  * 3. Archive the AnonymousUser record itself

package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-session-cleanup.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAqB/I,wBAAgB,kCAAkC,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CA+BzG"}
+{"version":3,"file":"anonymous-session-cleanup.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAgC/I,wBAAgB,kCAAkC,IAAI,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAoCzG"}

package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.js

@@ -1,7 +1,11 @@
 /**
  * Anonymous Session Cleanup Batch Job (W7.3a)
  *
- * Runs daily and cleans up orphaned anonymous sessions:
+ * Runs daily. It is BOTH the repair pass and the cleanup pass over the anonymous-session
+ * population, in that order — the ordering matters, because step 3 below retires the only record of
+ * which account a half-transposed session belongs to:
+ * 0. Finish the ownership transpositions that stopped part-way (converted sessions whose rows are
+ *    still split between the anonymous identity and the account)
  * 1. Find AnonymousUser records that were never converted and are past TTL
  * 2. For each, delete all isAnonymizable resources owned by that anonymous user
  * 3. Archive the AnonymousUser record itself
@@ -29,6 +33,17 @@ const AnonymousSessionCleanupOutputSchema = z.object({
     usersArchived: z.number().int().min(0),
     errors: z.number().int().min(0),
     durationMs: z.number().int().min(0),
+    /**
+     * Phase 0 (transposition reconciliation) counters, flattened into the batch output because a job
+     * record is the only place an operator sees this pass at all.
+     *
+     * `transpositionsStillIncomplete` is the one to watch: it counts converted visitors whose rows are
+     * STILL split between the anonymous session and their account after a repair attempt, i.e. a
+     * resource type whose write path fails repeatedly rather than transiently. A non-zero value that
+     * does not fall on the next run is a defect, not a backlog.
+     */
+    transpositionsRepaired: z.number().int().min(0),
+    transpositionsStillIncomplete: z.number().int().min(0),
 });
 export function createAnonymousSessionCleanupBatch() {
     return createCustomBatchExecutionService({
@@ -46,13 +61,18 @@ export function createAnonymousSessionCleanupBatch() {
         doHandle: async (input, { logger, dependencies }) => {
             const startTime = Date.now();
             const { anonymousSessionService } = dependencies;
-            const result = await anonymousSessionService.cleanupExpiredSessions({
+            const { transpositionsReconciled, ...result } = await anonymousSessionService.cleanupExpiredSessions({
                 sessionTtlMs: input.sessionTtlMs,
                 batchSize: input.batchSize,
             });
             const durationMs = Date.now() - startTime;
-            logger.info('Anonymous session cleanup batch completed', { ...result, durationMs });
-            return { ...result, durationMs };
+            logger.info('Anonymous session cleanup batch completed', { ...result, transpositionsReconciled, durationMs });
+            return {
+                ...result,
+                durationMs,
+                transpositionsRepaired: transpositionsReconciled.sessionsRepaired,
+                transpositionsStillIncomplete: transpositionsReconciled.sessionsStillIncomplete,
+            };
         },
     });
 }

package/dist/esm/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-session-cleanup.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAC/I,OAAO,EAAE,+CAA+C,EAAE,MAAM,gFAAgF,CAAC;AACjJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,6EAA6E;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,wEAAwE;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC;QACvC,KAAK,EAAE,kCAAkC;QACzC,MAAM,EAAE,mCAAmC;QAC3C,oBAAoB,EAAE;YACpB,IAAI,EAAE,+CAA+C,CAAC,IAAI;YAC1D,kBAAkB,EAAE,+CAA+C,CAAC,kBAAkB;YACtF,mBAAmB,EAAE,+CAA+C,CAAC,mBAAmB;YACxF,iBAAiB,EAAE,+CAA+C,CAAC,cAAc;SAClF;QACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YACjC,uBAAuB,EAAE,GAAG,CAC1B,kBAAkB,CAAC,uBAAuB,CAC3C;SACF,CAAC;QACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,EAAE,uBAAuB,EAAE,GAAG,YAAY,CAAC;YAEjD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,sBAAsB,CAAC;gBAClE,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAEpF,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC;QACnC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,kFAAkF;AAClF,wEAAwE;AACxE,kCAAkC","sourcesContent":["/**\n * Anonymous Session Cleanup Batch Job (W7.3a)\n *\n * Runs daily and cleans up orphaned anonymous sessions:\n * 1. Find AnonymousUser records that were never converted and are past TTL\n * 2. For each, delete all isAnonymizable resources owned by that anonymous user\n * 3. Archive the AnonymousUser record itself\n *\n * Delegates actual cleanup logic to AnonymousSessionBackendService.cleanupExpiredSessions().\n *\n * Integration with Queue System:\n * - Registered as a core engine batch in StartApplicationBackendService\n * - Scheduled via crontabs-batches-manager (daily at 03:00 UTC)\n * - Executed by BatchesCronjobsExecutor_BackendService\n */\n\nimport { createCustomBatchExecutionService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { AnonymousSessionBackendService } from '~wildo-backend-lib/security/authentications/services/anonymous-session.backend.service';\nimport { z } from 'zod';\n\nconst AnonymousSessionCleanupInputSchema = z.object({\n  /** Override: TTL for anonymous sessions before cleanup (ms). Default: 48h */\n  sessionTtlMs: z.number().int().min(0).optional(),\n  /** Override: batch size for processing anonymous users. Default: 100 */\n  batchSize: z.number().int().min(1).optional(),\n});\n\nconst AnonymousSessionCleanupOutputSchema = z.object({\n  expiredUsersFound: z.number().int().min(0),\n  resourcesDeleted: z.number().int().min(0),\n  usersArchived: z.number().int().min(0),\n  errors: z.number().int().min(0),\n  durationMs: z.number().int().min(0),\n});\n\nexport function createAnonymousSessionCleanupBatch(): ReturnType<typeof createCustomBatchExecutionService> {\n  return createCustomBatchExecutionService({\n    input: AnonymousSessionCleanupInputSchema,\n    output: AnonymousSessionCleanupOutputSchema,\n    batchCronjob_Context: {\n      kind: ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST.kind,\n      resourceIdentifier: ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST.resourceIdentifier,\n      operationIdentifier: ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST.operationIdentifier,\n      cronJobExpression: ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST.cronExpression,\n    },\n    resolveDependencies: ({ get }) => ({\n      anonymousSessionService: get<AnonymousSessionBackendService>(\n        SAAS_SERVICE_TYPES.AnonymousSessionService,\n      ),\n    }),\n    doHandle: async (input, { logger, dependencies }) => {\n      const startTime = Date.now();\n      const { anonymousSessionService } = dependencies;\n\n      const result = await anonymousSessionService.cleanupExpiredSessions({\n        sessionTtlMs: input.sessionTtlMs,\n        batchSize: input.batchSize,\n      });\n\n      const durationMs = Date.now() - startTime;\n\n      logger.info('Anonymous session cleanup batch completed', { ...result, durationMs });\n\n      return { ...result, durationMs };\n    },\n  });\n}\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `ANONYMOUS_SESSION_CLEANUP_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring and\n// specification cross-validation.\n"]}
+{"version":3,"file":"anonymous-session-cleanup.batch.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/batches/anonymous-session-cleanup.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAC/I,OAAO,EAAE,+CAA+C,EAAE,MAAM,gFAAgF,CAAC;AACjJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,6EAA6E;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,wEAAwE;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC;;;;;;;;OAQG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,UAAU,kCAAkC;IAChD,OAAO,iCAAiC,CAAC;QACvC,KAAK,EAAE,kCAAkC;QACzC,MAAM,EAAE,mCAAmC;QAC3C,oBAAoB,EAAE;YACpB,IAAI,EAAE,+CAA+C,CAAC,IAAI;YAC1D,kBAAkB,EAAE,+CAA+C,CAAC,kBAAkB;YACtF,mBAAmB,EAAE,+CAA+C,CAAC,mBAAmB;YACxF,iBAAiB,EAAE,+CAA+C,CAAC,cAAc;SAClF;QACD,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YACjC,uBAAuB,EAAE,GAAG,CAC1B,kBAAkB,CAAC,uBAAuB,CAC3C;SACF,CAAC;QACF,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,EAAE,uBAAuB,EAAE,GAAG,YAAY,CAAC;YAEjD,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,sBAAsB,CAAC;gBACnG,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,GAAG,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,CAAC,CAAC;YAE9G,OAAO;gBACL,GAAG,MAAM;gBACT,UAAU;gBACV,sBAAsB,EAAE,wBAAwB,CAAC,gBAAgB;gBACjE,6BAA6B,EAAE,wBAAwB,CAAC,uBAAuB;aAChF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,kFAAkF;AAClF,wEAAwE;AACxE,kCAAkC","sourcesContent":["/**\n * Anonymous Session Cleanup Batch Job (W7.3a)\n *\n * Runs daily. It is BOTH the repair pass and the cleanup pass over the anonymous-session\n * population, in that order — the ordering matters, because step 3 below retires the only record of\n * which account a half-transposed session belongs to:\n * 0. Finish the ownership transpositions that stopped part-way (converted sessions whose rows are\n *    still split between the anonymous identity and the account)\n * 1. Find AnonymousUser records that were never converted and are past TTL\n * 2. For each, delete all isAnonymizable resources owned by that anonymous user\n * 3. Archive the AnonymousUser record itself\n *\n * Delegates actual cleanup logic to AnonymousSessionBackendService.cleanupExpiredSessions().\n *\n * Integration with Queue System:\n * - Registered as a core engine batch in StartApplicationBackendService\n * - Scheduled via crontabs-batches-manager (daily at 03:00 UTC)\n * - Executed by BatchesCronjobsExecutor_BackendService\n */\n\nimport { createCustomBatchExecutionService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { AnonymousSessionBackendService } from '~wildo-backend-lib/security/authentications/services/anonymous-session.backend.service';\nimport { z } from 'zod';\n\nconst AnonymousSessionCleanupInputSchema = z.object({\n  /** Override: TTL for anonymous sessions before cleanup (ms). Default: 48h */\n  sessionTtlMs: z.number().int().min(0).optional(),\n  /** Override: batch size for processing anonymous users. Default: 100 */\n  batchSize: z.number().int().min(1).optional(),\n});\n\nconst AnonymousSessionCleanupOutputSchema = z.object({\n  expiredUsersFound: z.number().int().min(0),\n  resourcesDeleted: z.number().int().min(0),\n  usersArchived: z.number().int().min(0),\n  errors: z.number().int().min(0),\n  durationMs: z.number().int().min(0),\n  /**\n   * Phase 0 (transposition reconciliation) counters, flattened into the batch output because a job\n   * record is the only place an operator sees this pass at all.\n   *\n   * `transpositionsStillIncomplete` is the one to watch: it counts converted visitors whose rows are\n   * STILL split between the anonymous session and their account after a repair attempt, i.e. a\n   * resource type whose write path fails repeatedly rather than transiently. A non-zero value that\n   * does not fall on the next run is a defect, not a backlog.\n   */\n  transpositionsRepaired: z.number().int().min(0),\n  transpositionsStillIncomplete: z.number().int().min(0),\n});\n\nexport function createAnonymousSessionCleanupBatch(): ReturnType<typeof createCustomBatchExecutionService> {\n  return createCustomBatchExecutionService({\n    input: AnonymousSessionCleanupInputSchema,\n    output: AnonymousSessionCleanupOutputSchema,\n    batchCronjob_Context: {\n      kind: ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST.kind,\n      resourceIdentifier: ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST.resourceIdentifier,\n      operationIdentifier: ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST.operationIdentifier,\n      cronJobExpression: ENGINE_ANONYMOUS_SESSION_CLEANUP_BATCH_MANIFEST.cronExpression,\n    },\n    resolveDependencies: ({ get }) => ({\n      anonymousSessionService: get<AnonymousSessionBackendService>(\n        SAAS_SERVICE_TYPES.AnonymousSessionService,\n      ),\n    }),\n    doHandle: async (input, { logger, dependencies }) => {\n      const startTime = Date.now();\n      const { anonymousSessionService } = dependencies;\n\n      const { transpositionsReconciled, ...result } = await anonymousSessionService.cleanupExpiredSessions({\n        sessionTtlMs: input.sessionTtlMs,\n        batchSize: input.batchSize,\n      });\n\n      const durationMs = Date.now() - startTime;\n\n      logger.info('Anonymous session cleanup batch completed', { ...result, transpositionsReconciled, durationMs });\n\n      return {\n        ...result,\n        durationMs,\n        transpositionsRepaired: transpositionsReconciled.sessionsRepaired,\n        transpositionsStillIncomplete: transpositionsReconciled.sessionsStillIncomplete,\n      };\n    },\n  });\n}\n\n// Batch reference identifier lives in the declarative manifest registry\n// (`engine-custom-batch-manifests`); import `ANONYMOUS_SESSION_CLEANUP_BATCH_REF`\n// from there to keep a single source of truth across runtime wiring and\n// specification cross-validation.\n"]}

package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-controller.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/controllers/authentication-controller.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAEvG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,EACL,wCAAwC,EAEzC,MAAM,kGAAkG,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAkC,MAAM,wFAAwF,CAAC;AACvK,OAAO,EAAE,kCAAkC,EAAE,MAAM,yGAAyG,CAAC;AAC7J,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,6BAA6B,EAAwC,MAAM,yFAAyF,CAAC;AAE9K,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AACpI,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,uGAAuG,CAAC;AACzJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,iGAAiG,CAAC;AAC7I,OAAO,EACL,mBAAmB,EAEpB,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mEAAmE,CAAC;AACtG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAUhK,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AACnJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,yEAAyE,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,uGAAuG,CAAC;AACxJ,OAAO,EAAE,8BAA8B,EAA2B,MAAM,qGAAqG,CAAC;AAC9K,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,2GAA2G,CAAC;AAChK,OAAO,EAAE,kCAAkC,EAAE,MAAM,0GAA0G,CAAC;AAC9J,OAAO,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACxI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAIlI,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEtK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AA+HxG,qBACa,sCAAuC,SAAQ,gCAAgC;IAqChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAoBtC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAGnB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IA3DpG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2C;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyC;IACxE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAkC;IACpE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAmC;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAiC;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAsC;IAC/E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAqC;IAC7E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAiC;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;gBAGrB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACnB,WAAW,EAAE,wCAAwC,EACvE,WAAW,EAAE,6BAA6B,EAC9B,aAAa,EAAE,kCAAkC,EAC7C,cAAc,EAAE,sCAAsC,EAC/D,sBAAsB,EAAE,6BAA6B,EAC1D,UAAU,EAAE,iBAAiB,EAClC,YAAY,EAAE,mBAAmB,EACD,aAAa,EAAE,yCAAyC,EACpF,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EAClC,gBAAgB,EAAE,uBAAuB,EACjD,eAAe,EAAE,sBAAsB,EAC5C,UAAU,EAAE,iBAAiB,EACf,iBAAiB,EAAE,+BAA+B,EACjD,eAAe,EAAE,gCAAgC,EACvD,mBAAmB,EAAE,0BAA0B,EACzC,kBAAkB,EAAE,gCAAgC,EAC1D,YAAY,EAAE,0BAA0B,EACnC,oBAAoB,EAAE,+BAA+B,EACtD,mBAAmB,EAAE,8BAA8B,EAC5D,UAAU,EAAE,qBAAqB,EACnB,wBAAwB,EAAE,mCAAmC,EAC9D,uBAAuB,EAAE,kCAAkC,EAC/D,uBAAuB,EAAE,8BAA8B,EACzD,UAAU,EAAE,4BAA4B,EAGzB,mBAAmB,EAAE,0BAA0B,EAG9B,gBAAgB,EAAE,oCAAoC;IA6B1I,SAAS,CAAC,WAAW,IAAI,IAAI;YAqPf,QAAQ;YA4FR,oBAAoB;YAuBpB,YAAY;IAY1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,YAAY;YAoEZ,eAAe;IAuC7B;;;;;;;OAOG;YACW,eAAe;IAoF7B;;;;;;;;;;OAUG;YACW,sBAAsB;IAuCpC;;;;;OAKG;YACW,yBAAyB;IA4CvC;;;;;;;OAOG;YACW,eAAe;IAsC7B;;;;;;;;;OASG;YACW,aAAa;IA4D3B;;;;;;;;;;OAUG;YACW,kBAAkB;IAuChC;;;;;;;;OAQG;YACW,iBAAiB;IA8D/B;;;;;;;OAOG;YACW,kBAAkB;IA8ChC;;;;;;;;;;;;;;OAcG;YACW,kBAAkB;IA6ChC;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IA0L5B;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,aAAa;IA6G3B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,oBAAoB;IAgMlC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,MAAM;IAyDpB;;;;;;;;;;;;;;;;;OAiBG;YACW,SAAS;IA0CvB;;OAEG;YACW,oBAAoB;IA8ElC;;OAEG;YACW,qBAAqB;IAgBnC;;OAEG;YACW,QAAQ;IAsHtB;;;;;;OAMG;YACW,iBAAiB;IAc/B;;OAEG;YACW,gBAAgB;IA6D9B;;OAEG;YACW,gBAAgB;IA8B9B;;;;;;;OAOG;YACW,iBAAiB;IAY/B;;;;;;OAMG;YACW,kBAAkB;IAehC;;;;;;OAMG;YACW,kBAAkB;IAiBhC;;OAEG;YACW,WAAW;IAmBzB;;OAEG;YACW,uBAAuB;IAsErC;;OAEG;YACW,qBAAqB;IA0CnC;;;;;;;OAOG;YACW,eAAe;IA+E7B;;;;;;;OAOG;YACW,iBAAiB;IAyC/B;;;;;;;;;;OAUG;YACW,YAAY;IA2C1B;;;;;;;;;OASG;YACW,kBAAkB;IA8BhC;;;;;;;OAOG;YACW,aAAa;IAiC3B;;;;;;;;;OASG;YACW,4BAA4B;IAwC1C;;;;;;;;;OASG;YACW,2BAA2B;IA+DzC;;;;;;OAMG;YACW,wBAAwB;IA+CtC;;;;;;OAMG;YACW,uBAAuB;IA0CrC;;;;;;OAMG;YACW,iBAAiB;IAwB/B;;;;;;;OAOG;YACW,mBAAmB;IA+CjC;;;;;;;OAOG;YACW,mBAAmB;IA0BjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,6BAA6B;IAiBrC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;;;;;;;OAQG;YACW,2BAA2B;IAIzC;;;;;;;OAOG;YACW,iCAAiC;IAQ/C;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAqBlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,2BAA2B;IAsBnC,OAAO,CAAC,yBAAyB;IAyCjC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IAgBnC;;;OAGG;IACH,OAAO,CAAC,kDAAkD;IAI1D;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAahC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAiDlC;;;;;;;;OAQG;IACH,OAAO,CAAC,mCAAmC;IAmC3C;;;;;;;OAOG;YACW,aAAa;IA8E3B;;;;;;OAMG;YACW,mBAAmB;IAsDjC;;;;;;;;OAQG;YACW,eAAe;IA0C7B;;;;;;;OAOG;YACW,UAAU;IA2CxB;;;;;;;OAOG;YACW,eAAe;IAuF7B;;;;;;;OAOG;YACW,kBAAkB;YAuElB,iBAAiB;YAoIjB,mBAAmB;IAoIjC;;;;;;;;;;;;;;;;;;OAkBG;YACW,iBAAiB;IAuE/B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,kCAAkC;IAkB1C;;;;;;OAMG;YACW,4BAA4B;IA0C1C;;;OAGG;YACW,4CAA4C;IA0B1D,OAAO,CAAC,0BAA0B;CAKnC"}
+{"version":3,"file":"authentication-controller.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/controllers/authentication-controller.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAC5I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAEvG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,EACL,wCAAwC,EAEzC,MAAM,kGAAkG,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAkC,MAAM,wFAAwF,CAAC;AACvK,OAAO,EAAE,kCAAkC,EAAE,MAAM,yGAAyG,CAAC;AAC7J,OAAO,EAAE,sCAAsC,EAAE,MAAM,8GAA8G,CAAC;AACtK,OAAO,EAAE,6BAA6B,EAAwC,MAAM,yFAAyF,CAAC;AAE9K,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AACpI,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,uGAAuG,CAAC;AACzJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,iGAAiG,CAAC;AAC7I,OAAO,EACL,mBAAmB,EAEpB,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mEAAmE,CAAC;AACtG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAUhK,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AACnJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,yEAAyE,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,uGAAuG,CAAC;AACxJ,OAAO,EAAE,8BAA8B,EAA2B,MAAM,qGAAqG,CAAC;AAC9K,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,2GAA2G,CAAC;AAChK,OAAO,EAAE,kCAAkC,EAAE,MAAM,0GAA0G,CAAC;AAC9J,OAAO,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACxI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAIlI,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEtK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AA+HxG,qBACa,sCAAuC,SAAQ,gCAAgC;IAqChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAoBtC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAGnB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IA3DpG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2C;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyC;IACxE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;IAC3D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAkC;IACpE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAmC;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAiC;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAsC;IAC/E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAqC;IAC7E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAiC;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;gBAGrB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACnB,WAAW,EAAE,wCAAwC,EACvE,WAAW,EAAE,6BAA6B,EAC9B,aAAa,EAAE,kCAAkC,EAC7C,cAAc,EAAE,sCAAsC,EAC/D,sBAAsB,EAAE,6BAA6B,EAC1D,UAAU,EAAE,iBAAiB,EAClC,YAAY,EAAE,mBAAmB,EACD,aAAa,EAAE,yCAAyC,EACpF,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EAClC,gBAAgB,EAAE,uBAAuB,EACjD,eAAe,EAAE,sBAAsB,EAC5C,UAAU,EAAE,iBAAiB,EACf,iBAAiB,EAAE,+BAA+B,EACjD,eAAe,EAAE,gCAAgC,EACvD,mBAAmB,EAAE,0BAA0B,EACzC,kBAAkB,EAAE,gCAAgC,EAC1D,YAAY,EAAE,0BAA0B,EACnC,oBAAoB,EAAE,+BAA+B,EACtD,mBAAmB,EAAE,8BAA8B,EAC5D,UAAU,EAAE,qBAAqB,EACnB,wBAAwB,EAAE,mCAAmC,EAC9D,uBAAuB,EAAE,kCAAkC,EAC/D,uBAAuB,EAAE,8BAA8B,EACzD,UAAU,EAAE,4BAA4B,EAGzB,mBAAmB,EAAE,0BAA0B,EAG9B,gBAAgB,EAAE,oCAAoC;IA6B1I,SAAS,CAAC,WAAW,IAAI,IAAI;YAqPf,QAAQ;YA4FR,oBAAoB;YAuBpB,YAAY;IAY1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,YAAY;YAoEZ,eAAe;IAuC7B;;;;;;;OAOG;YACW,eAAe;IAoF7B;;;;;;;;;;OAUG;YACW,sBAAsB;IAuCpC;;;;;OAKG;YACW,yBAAyB;IA4CvC;;;;;;;OAOG;YACW,eAAe;IAsC7B;;;;;;;;;OASG;YACW,aAAa;IA4D3B;;;;;;;;;;OAUG;YACW,kBAAkB;IAuChC;;;;;;;;OAQG;YACW,iBAAiB;IA8D/B;;;;;;;OAOG;YACW,kBAAkB;IA8ChC;;;;;;;;;;;;;;OAcG;YACW,kBAAkB;IA6ChC;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IA0L5B;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,aAAa;IA6G3B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,oBAAoB;IAgMlC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,MAAM;IAyDpB;;;;;;;;;;;;;;;;;OAiBG;YACW,SAAS;IA0CvB;;OAEG;YACW,oBAAoB;IA8ElC;;OAEG;YACW,qBAAqB;IAwCnC;;OAEG;YACW,QAAQ;IAuHtB;;;;;;OAMG;YACW,iBAAiB;IAc/B;;OAEG;YACW,gBAAgB;IA6D9B;;OAEG;YACW,gBAAgB;IA8B9B;;;;;;;OAOG;YACW,iBAAiB;IAY/B;;;;;;OAMG;YACW,kBAAkB;IAehC;;;;;;OAMG;YACW,kBAAkB;IAiBhC;;OAEG;YACW,WAAW;IAmBzB;;OAEG;YACW,uBAAuB;IAsErC;;OAEG;YACW,qBAAqB;IA0CnC;;;;;;;OAOG;YACW,eAAe;IA+E7B;;;;;;;OAOG;YACW,iBAAiB;IAyC/B;;;;;;;;;;OAUG;YACW,YAAY;IA2C1B;;;;;;;;;OASG;YACW,kBAAkB;IA8BhC;;;;;;;OAOG;YACW,aAAa;IAiC3B;;;;;;;;;OASG;YACW,4BAA4B;IAwC1C;;;;;;;;;OASG;YACW,2BAA2B;IA+DzC;;;;;;OAMG;YACW,wBAAwB;IA+CtC;;;;;;OAMG;YACW,uBAAuB;IA0CrC;;;;;;OAMG;YACW,iBAAiB;IAwB/B;;;;;;;OAOG;YACW,mBAAmB;IA+CjC;;;;;;;OAOG;YACW,mBAAmB;IA0BjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,6BAA6B;IAiBrC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;;;;;;;OAQG;YACW,2BAA2B;IAIzC;;;;;;;OAOG;YACW,iCAAiC;IAQ/C;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAqBlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,2BAA2B;IAsBnC,OAAO,CAAC,yBAAyB;IAyCjC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IAgBnC;;;OAGG;IACH,OAAO,CAAC,kDAAkD;IAI1D;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAahC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAiDlC;;;;;;;;OAQG;IACH,OAAO,CAAC,mCAAmC;IAmC3C;;;;;;;OAOG;YACW,aAAa;IA8E3B;;;;;;OAMG;YACW,mBAAmB;IAsDjC;;;;;;;;OAQG;YACW,eAAe;IA0C7B;;;;;;;OAOG;YACW,UAAU;IA2CxB;;;;;;;OAOG;YACW,eAAe;IAuF7B;;;;;;;OAOG;YACW,kBAAkB;YAuElB,iBAAiB;YAoIjB,mBAAmB;IAoIjC;;;;;;;;;;;;;;;;;;OAkBG;YACW,iBAAiB;IAuE/B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,kCAAkC;IAkB1C;;;;;;OAMG;YACW,4BAA4B;IA8C1C;;;OAGG;YACW,4CAA4C;IA2B1D,OAAO,CAAC,0BAA0B;CAKnC"}

package/dist/esm/security/authentications/controllers/authentication-controller.backend.service.js

@@ -1775,8 +1775,26 @@ let AuthenticationControllerBackendService = class AuthenticationControllerBacke
      * POST /auth/password-reset/complete → AuthPasswordResetService.completePasswordReset
      */
     async passwordResetComplete(req, res) {
-        const ec = await this._getPreAuthExecutionContext();
+        /*
+         * The REQUEST leg carries two policies and this leg carried none, so the half of the flow that
+         * consumes a token and WRITES A CREDENTIAL was the unlimited one.
+         *
+         * IP-keyed and single-bucket, unlike the request leg's email+IP pair, because the caller supplies
+         * no email here — only a token. Keying on the token would defeat the defence it exists for: the
+         * bucket would reset on every guess, which is exactly the note `magicLinkVerify` already makes
+         * for the same reason.
+         *
+         * 10/min matches `auth:invitation:accept:by-ip`, the nearest peer in shape — a one-off token
+         * that sets a password. The cost being bounded is not only the token lookup: every attempt runs
+         * an argon2 hash of the submitted password, which is deliberately expensive, so an unlimited
+         * endpoint is a CPU-exhaustion surface as much as a token-guessing one.
+         *
+         * Ordering follows `passwordResetRequest` and `acceptInvitation`: limit BEFORE the body parse and
+         * before EC construction, so an over-budget caller pays for neither.
+         */
+        await this.rateLimitService.checkPolicy(req, res, { requestsPerMinute: 10 }, 'auth:password-reset:complete:by-ip');
         const { token, newPassword } = PasswordResetCompleteDtoSchema.parse(req.body || {});
+        const ec = await this._getPreAuthExecutionContext();
         const result = await this.passwordResetService.completePasswordReset(ec, {
             token, newPassword,
             ipAddress: getClientIpFromRequest(req),
@@ -1793,7 +1811,7 @@ let AuthenticationControllerBackendService = class AuthenticationControllerBacke
     async register(req, res) {
         // PR-7b-fixes F-22 fail-fast ordering: body parse → rate-limit → ec
         // (see `passwordResetRequest` for rationale).
-        const { email, firstName, lastName, password, organizationName } = UserRegisterApiDtoSchema.parse(req.body || {});
+        const { email, firstName, lastName, password, organizationName, method } = UserRegisterApiDtoSchema.parse(req.body || {});
         const ipAddress = getClientIpFromRequest(req);
         // PR 7b — register migration. THREE policies AND-ed (PR 8a Option D
         // lifted the per-email-domain bucket UP from `auth-registration.backend.service.ts`;
@@ -1861,7 +1879,9 @@ let AuthenticationControllerBackendService = class AuthenticationControllerBacke
         const activeUserTypeReg = frontendServiceNameReg
             ? this.appConfigService.resolveUserTypeFromFrontendServiceName(frontendServiceNameReg) ?? undefined
             : undefined;
-        const result = await this.registrationService.registerUser(ec, { email, firstName, lastName, password, organizationName }, { frontendUrl, ipAddress, userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown', frontendServiceName: frontendServiceNameReg, activeUserType: activeUserTypeReg });
+        const result = await this.registrationService.registerUser(ec, 
+        // `method` absent ⇒ the service defaults to PASSWORD, so a client predating #463 is unchanged.
+        { email, firstName, lastName, password, organizationName, method }, { frontendUrl, ipAddress, userAgent: req.headers[WildoHeaderKeys.USER_AGENT] || 'unknown', frontendServiceName: frontendServiceNameReg, activeUserType: activeUserTypeReg });
         // Deferred-verification registration issues tokens immediately (see
         // `registerUser`), so this is the anonymous→authenticated conversion moment
         // for direct-register users. Transpose the anonymous website capture onto
@@ -3724,6 +3744,10 @@ let AuthenticationControllerBackendService = class AuthenticationControllerBacke
                 userType,
                 status: result.status,
                 transposedTypes: result.transposedTypes,
+                // Reported beside `transposedTypes`, never merged into it: a DISCARD type's rows were
+                // DELETED, not carried over. A support answer built from the transposed list alone would
+                // say "nothing happened" about data the conversion destroyed on purpose.
+                discardedTypes: result.discardedTypes,
                 failedCount: result.failedTypes.length,
             });
         }
@@ -3752,7 +3776,8 @@ let AuthenticationControllerBackendService = class AuthenticationControllerBacke
             }
             this.logDebug('Anonymous session transposition completed (token exchange)', {
                 anonymousUserId, userId, userType, status: result.status,
-                transposedTypes: result.transposedTypes, failedCount: result.failedTypes.length,
+                transposedTypes: result.transposedTypes, discardedTypes: result.discardedTypes,
+                failedCount: result.failedTypes.length,
             });
         }
         catch (error) {