@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/runtime/execution-context.shared.schemas.d.ts

@@ -1,11 +1,32 @@
 import { z } from "zod";
-import { ResourcePrimaryScope } from "../resources/resources.shared.schemas.js";
+import { ResourcePrimaryScope } from "../resources/resources.shared.schemas";
 /**
- * Execution type enum defining how the execution context was initiated
+ * Execution type enum defining how the execution context was initiated.
+ *
+ * Design rule: an execution type is a PRINCIPAL CATEGORY, never an auth method. A
+ * human authenticates via many methods (password, SSO, SAML, WebAuthn, OAuth-social,
+ * OIDC authorization-code) but is always one `USER_REQUEST`. Machines follow the same
+ * discipline: an organization/application MACHINE principal is authenticated by EITHER
+ * a static API key OR an OAuth 2.0 client-credentials flow — the credential type is
+ * recorded on `initiatorIds.machineCredential`, it is NOT its own execution type.
  */
 export declare enum ExecutionContext_ExecutionType {
-    ORG_API_KEY = "org_api_key",
-    APP_API_KEY = "app_api_key",
+    /**
+     * An organization-scoped MACHINE principal (non-human). Authenticated by EITHER a
+     * static organization API key (`sk_org_…`) OR an OAuth 2.0 client-credentials flow
+     * for an organization OAuth client (`oc_org_…`, direct secret or exchanged token).
+     * Carries `organizationId` + roles; never a `userId`, so `authorizeUserSelf` and
+     * user-FK paths fail closed for it by design. The specific credential is recorded on
+     * `initiatorIds.machineCredential` for audit.
+     */
+    ORGANIZATION_MACHINE = "organization_machine",
+    /**
+     * An application-scoped MACHINE principal — the APPLICATION-scope peer of
+     * `ORGANIZATION_MACHINE`. Authenticated by an app API key (`sk_app_…`) OR an OAuth
+     * client-credentials flow for an application OAuth client (`oc_app_…`). Carries
+     * `applicationId` + roles; never a `userId`.
+     */
+    APPLICATION_MACHINE = "application_machine",
     USER_REQUEST = "user_request",
     CONSUMABLE_TOKEN = "consumable_token",
     INTERNALLY_INITIATED_REQUEST = "internally_initiated_request",
@@ -18,6 +39,22 @@ export declare enum ExecutionContext_ExecutionType {
     WEBHOOK_CALLBACK = "webhook_callback",
     ANONYMOUS_SESSION = "anonymous_session"
 }
+/**
+ * How a MACHINE principal ({@link ExecutionContext_ExecutionType.ORGANIZATION_MACHINE} /
+ * {@link ExecutionContext_ExecutionType.APPLICATION_MACHINE}) authenticated. This is
+ * credential PROVENANCE (for audit), NOT a principal distinction — both methods resolve
+ * to the same per-scope machine principal.
+ */
+export declare enum MachineAuthMethod {
+    /** A static, long-lived API key (`sk_org_…` / `sk_app_…`) presented per-request. */
+    API_KEY = "api_key",
+    /**
+     * A registered OAuth 2.0 client (`oc_org_…` / `oc_app_…`) acting as itself
+     * (client-credentials), presented either as a direct secret or an exchanged
+     * audience-bound bearer token.
+     */
+    OAUTH_CLIENT = "oauth_client"
+}
 export declare enum ExecutionContext_ExecutionType_Frontend {
     USER_REQUEST = "user_request",
     CONSUMABLE_TOKEN = "consumable_token",
@@ -34,16 +71,32 @@ export declare enum SessionType {
 /**
  * Initiator IDs structure for non-internal and non-public executions
  */
+/**
+ * Credential provenance for a MACHINE principal — WHICH credential authenticated and
+ * of WHAT type. Replaces the former `organizationApiKeyId` / `applicationApiKeyId` /
+ * `m2mClientId` triple: those forked one concept ("which machine credential") into
+ * three auth-method-specific fields. The principal's SCOPE lives on `organizationId` /
+ * `applicationId` (as for any principal); this records only the credential, for audit
+ * and attribution (e.g. a File's `uploadedBy`). Only populated for
+ * `ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`.
+ */
+export declare const ExecutionContext_MachineCredentialSchema: z.ZodObject<{
+    authMethod: z.ZodEnum<typeof MachineAuthMethod>;
+    credentialId: z.ZodString;
+}, z.core.$strip>;
+export type ExecutionContext_MachineCredential = z.infer<typeof ExecutionContext_MachineCredentialSchema>;
 export declare const ExecutionContext_InitiatorIdsSchema: z.ZodObject<{
     organizationId: z.ZodOptional<z.ZodString>;
     userId: z.ZodOptional<z.ZodString>;
     applicationId: z.ZodOptional<z.ZodString>;
-    organizationApiKeyId: z.ZodOptional<z.ZodString>;
-    applicationApiKeyId: z.ZodOptional<z.ZodString>;
+    machineCredential: z.ZodOptional<z.ZodObject<{
+        authMethod: z.ZodEnum<typeof MachineAuthMethod>;
+        credentialId: z.ZodString;
+    }, z.core.$strip>>;
     consumableTokenId: z.ZodOptional<z.ZodString>;
     webhookProviderId: z.ZodOptional<z.ZodString>;
     anonymousUserId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type ExecutionContext_InitiatorIds = z.infer<typeof ExecutionContext_InitiatorIdsSchema>;
 /**
  * Role information with related scope and resource context
@@ -52,8 +105,38 @@ export declare const ExecutionContext_RoleInfoSchema: z.ZodObject<{
     roles: z.ZodArray<z.ZodString>;
     relatedPrimaryScope: z.ZodEnum<typeof ResourcePrimaryScope>;
     relatedResourceId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    organizationUnitId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export type ExecutionContext_RoleInfo = z.infer<typeof ExecutionContext_RoleInfoSchema>;
+/**
+ * Does this entry confer authority across the WHOLE owning scope?
+ *
+ * `false` for a unit-scoped grant, which is only meaningful for resources that opted into unit
+ * narrowing (D-C3) and must be ignored entirely by anything asking an organization-wide question.
+ *
+ * This is the single definition of that rule. Consumers call it instead of writing
+ * `!roleInfo.organizationUnitId` inline, so a future narrowing dimension extends one function rather
+ * than needing every call site to be rediscovered — the class of miss that made the per-unit `role`
+ * field inert-but-dangerous in the first place.
+ */
+export declare function isOrganizationWideRoleInfo(roleInfo: ExecutionContext_RoleInfo): boolean;
+/**
+ * The roles a principal holds across the whole scope, with every narrowed grant removed.
+ *
+ * The safe default for any "does this caller hold role X?" question. Reach past it only where the
+ * question is explicitly unit-aware.
+ */
+export declare function selectOrganizationWideRoles(initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined): string[];
+/**
+ * The unit-scoped grants a principal holds, as `(organizationUnitId, roles)` pairs.
+ *
+ * The complement of {@link selectOrganizationWideRoles} — the input to unit narrowing in
+ * `buildContextualFilter` and to inheritance traversal.
+ */
+export declare function selectUnitScopedRoleGrants(initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined): {
+    organizationUnitId: string;
+    roles: string[];
+}[];
 /**
  * Tracks the relationship path used to access a resource.
  * Captures FK relationship fields for authorization and filtering.
@@ -72,6 +155,7 @@ export declare const ExecutionContext_RelationshipContextSchema: z.ZodObject<{
     resourceType: z.ZodString;
     relationshipField: z.ZodOptional<z.ZodString>;
     resourceId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    scopeViaJunction: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 export type ExecutionContext_RelationshipContext = z.infer<typeof ExecutionContext_RelationshipContextSchema>;
 //# sourceMappingURL=execution-context.shared.schemas.d.ts.map

package/dist/esm/runtime/execution-context.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/runtime/execution-context.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E;;GAEG;AACH,oBAAY,8BAA8B;IACtC,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,4BAA4B,iCAAiC;IAC7D,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CAC1C;AAED,oBAAY,uCAAuC;IAC/C,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CAC1C;AAED;;GAEG;AACH,oBAAY,WAAW;IACrB,UAAU,eAAe;IACzB,OAAO,YAAY;CACpB;AAEC;;GAEG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;uCAa9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAIlG;;GAEG;AAGH,eAAO,MAAM,+BAA+B;;;;uCAIxC,CAAC;AAEL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0CAA0C;;;;uCAUrD,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}
+{"version":3,"file":"execution-context.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/runtime/execution-context.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E;;;;;;;;;GASG;AACH,oBAAY,8BAA8B;IACtC;;;;;;;OAOG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAC3C,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,4BAA4B,iCAAiC;IAC7D,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CAC1C;AAED;;;;;GAKG;AACH,oBAAY,iBAAiB;IACzB,oFAAoF;IACpF,OAAO,YAAY;IACnB;;;;OAIG;IACH,YAAY,iBAAiB;CAChC;AAED,oBAAY,uCAAuC;IAC/C,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CAC1C;AAED;;GAEG;AACH,oBAAY,WAAW;IACrB,UAAU,eAAe;IACzB,OAAO,YAAY;CACpB;AAEC;;GAEG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,wCAAwC;;;iBAKnD,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,mCAAmC;;;;;;;;;;;iBAiB9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAIlG;;GAEG;AAGH,eAAO,MAAM,+BAA+B;;;;;iBAoBxC,CAAC;AAEL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAEvF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAEtH;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,SAAS,yBAAyB,EAAE,GAAG,SAAS,GAC/D;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,CAInD;AAGD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0CAA0C;;;;;iBAkBrD,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}

package/dist/esm/runtime/execution-context.shared.schemas.js

@@ -1,12 +1,33 @@
 import { z } from "zod";
 import { ResourcePrimaryScope } from "../resources/resources.shared.schemas.js";
 /**
- * Execution type enum defining how the execution context was initiated
+ * Execution type enum defining how the execution context was initiated.
+ *
+ * Design rule: an execution type is a PRINCIPAL CATEGORY, never an auth method. A
+ * human authenticates via many methods (password, SSO, SAML, WebAuthn, OAuth-social,
+ * OIDC authorization-code) but is always one `USER_REQUEST`. Machines follow the same
+ * discipline: an organization/application MACHINE principal is authenticated by EITHER
+ * a static API key OR an OAuth 2.0 client-credentials flow — the credential type is
+ * recorded on `initiatorIds.machineCredential`, it is NOT its own execution type.
  */
 export var ExecutionContext_ExecutionType;
 (function (ExecutionContext_ExecutionType) {
-    ExecutionContext_ExecutionType["ORG_API_KEY"] = "org_api_key";
-    ExecutionContext_ExecutionType["APP_API_KEY"] = "app_api_key";
+    /**
+     * An organization-scoped MACHINE principal (non-human). Authenticated by EITHER a
+     * static organization API key (`sk_org_…`) OR an OAuth 2.0 client-credentials flow
+     * for an organization OAuth client (`oc_org_…`, direct secret or exchanged token).
+     * Carries `organizationId` + roles; never a `userId`, so `authorizeUserSelf` and
+     * user-FK paths fail closed for it by design. The specific credential is recorded on
+     * `initiatorIds.machineCredential` for audit.
+     */
+    ExecutionContext_ExecutionType["ORGANIZATION_MACHINE"] = "organization_machine";
+    /**
+     * An application-scoped MACHINE principal — the APPLICATION-scope peer of
+     * `ORGANIZATION_MACHINE`. Authenticated by an app API key (`sk_app_…`) OR an OAuth
+     * client-credentials flow for an application OAuth client (`oc_app_…`). Carries
+     * `applicationId` + roles; never a `userId`.
+     */
+    ExecutionContext_ExecutionType["APPLICATION_MACHINE"] = "application_machine";
     ExecutionContext_ExecutionType["USER_REQUEST"] = "user_request";
     ExecutionContext_ExecutionType["CONSUMABLE_TOKEN"] = "consumable_token";
     ExecutionContext_ExecutionType["INTERNALLY_INITIATED_REQUEST"] = "internally_initiated_request";
@@ -19,6 +40,23 @@ export var ExecutionContext_ExecutionType;
     ExecutionContext_ExecutionType["WEBHOOK_CALLBACK"] = "webhook_callback";
     ExecutionContext_ExecutionType["ANONYMOUS_SESSION"] = "anonymous_session";
 })(ExecutionContext_ExecutionType || (ExecutionContext_ExecutionType = {}));
+/**
+ * How a MACHINE principal ({@link ExecutionContext_ExecutionType.ORGANIZATION_MACHINE} /
+ * {@link ExecutionContext_ExecutionType.APPLICATION_MACHINE}) authenticated. This is
+ * credential PROVENANCE (for audit), NOT a principal distinction — both methods resolve
+ * to the same per-scope machine principal.
+ */
+export var MachineAuthMethod;
+(function (MachineAuthMethod) {
+    /** A static, long-lived API key (`sk_org_…` / `sk_app_…`) presented per-request. */
+    MachineAuthMethod["API_KEY"] = "api_key";
+    /**
+     * A registered OAuth 2.0 client (`oc_org_…` / `oc_app_…`) acting as itself
+     * (client-credentials), presented either as a direct secret or an exchanged
+     * audience-bound bearer token.
+     */
+    MachineAuthMethod["OAUTH_CLIENT"] = "oauth_client";
+})(MachineAuthMethod || (MachineAuthMethod = {}));
 export var ExecutionContext_ExecutionType_Frontend;
 (function (ExecutionContext_ExecutionType_Frontend) {
     ExecutionContext_ExecutionType_Frontend["USER_REQUEST"] = "user_request";
@@ -37,12 +75,31 @@ export var SessionType;
 /**
  * Initiator IDs structure for non-internal and non-public executions
  */
+/**
+ * Credential provenance for a MACHINE principal — WHICH credential authenticated and
+ * of WHAT type. Replaces the former `organizationApiKeyId` / `applicationApiKeyId` /
+ * `m2mClientId` triple: those forked one concept ("which machine credential") into
+ * three auth-method-specific fields. The principal's SCOPE lives on `organizationId` /
+ * `applicationId` (as for any principal); this records only the credential, for audit
+ * and attribution (e.g. a File's `uploadedBy`). Only populated for
+ * `ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`.
+ */
+export const ExecutionContext_MachineCredentialSchema = z.object({
+    /** Whether authentication used a static API key or an OAuth client. */
+    authMethod: z.enum(MachineAuthMethod),
+    /** The authenticating credential's `_id` (the ApiKey row, or the OAuthClient row). */
+    credentialId: z.string(),
+});
 export const ExecutionContext_InitiatorIdsSchema = z.object({
     organizationId: z.string().optional(),
     userId: z.string().optional(),
     applicationId: z.string().optional(),
-    organizationApiKeyId: z.string().optional(),
-    applicationApiKeyId: z.string().optional(),
+    /**
+     * Credential provenance for a machine principal (see
+     * {@link ExecutionContext_MachineCredentialSchema}). Absent for human / anonymous /
+     * webhook / internal principals.
+     */
+    machineCredential: ExecutionContext_MachineCredentialSchema.optional(),
     consumableTokenId: z.string().optional(),
     /**
      * Provider reference that triggered the webhook (e.g., 'stripe', 'google').
@@ -57,8 +114,58 @@ export const ExecutionContext_InitiatorIdsSchema = z.object({
 export const ExecutionContext_RoleInfoSchema = z.object({
     roles: z.array(z.string()), // Will be validated against Roles type at runtime
     relatedPrimaryScope: z.enum(ResourcePrimaryScope),
-    relatedResourceId: z.string().optional()
+    relatedResourceId: z.string().optional(),
+    /**
+     * Present ⇒ these roles are held ONLY inside one organization unit, not across the organization.
+     *
+     * Organization units are a NARROWING dimension within `ResourcePrimaryScope.ORGANIZATIONS`, not a
+     * primary scope of their own (plan decision D-C1): a unit is owned BY an organization, so it is
+     * not an ownership root, and adding a fifth scope would fracture the tenant boundary every
+     * exhaustive switch currently relies on.
+     *
+     * ⚠️ **A unit-scoped entry must NEVER be read as organization-wide authority.** Absolutely every
+     * consumer that unions `initiatorRoles` has to partition on this field first — otherwise
+     * "ORG_MANAGER of Sales" silently becomes "ORG_MANAGER of the whole tenant", which is a
+     * privilege escalation, not a convenience. Use {@link isOrganizationWideRoleInfo} /
+     * {@link selectOrganizationWideRoles} rather than testing this property by hand, so the rule has
+     * exactly one definition.
+     */
+    organizationUnitId: z.string().optional(),
 });
+/**
+ * Does this entry confer authority across the WHOLE owning scope?
+ *
+ * `false` for a unit-scoped grant, which is only meaningful for resources that opted into unit
+ * narrowing (D-C3) and must be ignored entirely by anything asking an organization-wide question.
+ *
+ * This is the single definition of that rule. Consumers call it instead of writing
+ * `!roleInfo.organizationUnitId` inline, so a future narrowing dimension extends one function rather
+ * than needing every call site to be rediscovered — the class of miss that made the per-unit `role`
+ * field inert-but-dangerous in the first place.
+ */
+export function isOrganizationWideRoleInfo(roleInfo) {
+    return roleInfo.organizationUnitId === undefined;
+}
+/**
+ * The roles a principal holds across the whole scope, with every narrowed grant removed.
+ *
+ * The safe default for any "does this caller hold role X?" question. Reach past it only where the
+ * question is explicitly unit-aware.
+ */
+export function selectOrganizationWideRoles(initiatorRoles) {
+    return (initiatorRoles ?? []).filter(isOrganizationWideRoleInfo).flatMap((roleInfo) => roleInfo.roles);
+}
+/**
+ * The unit-scoped grants a principal holds, as `(organizationUnitId, roles)` pairs.
+ *
+ * The complement of {@link selectOrganizationWideRoles} — the input to unit narrowing in
+ * `buildContextualFilter` and to inheritance traversal.
+ */
+export function selectUnitScopedRoleGrants(initiatorRoles) {
+    return (initiatorRoles ?? [])
+        .filter((roleInfo) => roleInfo.organizationUnitId !== undefined)
+        .map((roleInfo) => ({ organizationUnitId: roleInfo.organizationUnitId, roles: roleInfo.roles }));
+}
 /**
  * Tracks the relationship path used to access a resource.
  * Captures FK relationship fields for authorization and filtering.
@@ -83,5 +190,13 @@ export const ExecutionContext_RelationshipContextSchema = z.object({
     relationshipField: z.string().optional(),
     /** The ID value from the URL for this relationship */
     resourceId: z.string(),
+    /**
+     * Scope-via-junction tag (scope-required reference search). When set (e.g. on
+     * the `organizationId` param of `/organizations/{id}/users/search`), the
+     * backend scopes this (target) resource's SEARCH/LIST through the named
+     * junction rather than via a column it owns, and authorizes by the anchor
+     * scope's membership. Propagated from the URL param. Absent on normal params.
+     */
+    scopeViaJunction: z.string().optional(),
 });
-//# sourceMappingURL=execution-context.shared.schemas.js.map
+//# sourceMappingURL=execution-context.shared.schemas.js.map

package/dist/esm/runtime/execution-context.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.shared.schemas.js","sourceRoot":"","sources":["../../../src/runtime/execution-context.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E;;GAEG;AACH,MAAM,CAAN,IAAY,8BAcX;AAdD,WAAY,8BAA8B;IACtC,6DAA2B,CAAA;IAC3B,6DAA2B,CAAA;IAC3B,+DAA6B,CAAA;IAC7B,uEAAqC,CAAA;IACrC,+FAA6D,CAAA;IAC7D,uEAAqC,CAAA;IACrC;;;;OAIG;IACH,uEAAqC,CAAA;IACrC,yEAAuC,CAAA;AAC3C,CAAC,EAdW,8BAA8B,KAA9B,8BAA8B,QAczC;AAED,MAAM,CAAN,IAAY,uCAKX;AALD,WAAY,uCAAuC;IAC/C,wEAA6B,CAAA;IAC7B,gFAAqC,CAAA;IACrC,gFAAqC,CAAA;IACrC,kFAAuC,CAAA;AAC3C,CAAC,EALW,uCAAuC,KAAvC,uCAAuC,QAKlD;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,wCAAyB,CAAA;IACzB,kCAAmB,CAAA;AACrB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAEC;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAML;;GAEG;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,kDAAkD;IAC9E,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAKL;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,sDAAsD;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC"}
+{"version":3,"file":"execution-context.shared.schemas.js","sourceRoot":"","sources":["../../../../src/runtime/execution-context.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,8BA4BX;AA5BD,WAAY,8BAA8B;IACtC;;;;;;;OAOG;IACH,+EAA6C,CAAA;IAC7C;;;;;OAKG;IACH,6EAA2C,CAAA;IAC3C,+DAA6B,CAAA;IAC7B,uEAAqC,CAAA;IACrC,+FAA6D,CAAA;IAC7D,uEAAqC,CAAA;IACrC;;;;OAIG;IACH,uEAAqC,CAAA;IACrC,yEAAuC,CAAA;AAC3C,CAAC,EA5BW,8BAA8B,KAA9B,8BAA8B,QA4BzC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iBASX;AATD,WAAY,iBAAiB;IACzB,oFAAoF;IACpF,wCAAmB,CAAA;IACnB;;;;OAIG;IACH,kDAA6B,CAAA;AACjC,CAAC,EATW,iBAAiB,KAAjB,iBAAiB,QAS5B;AAED,MAAM,CAAN,IAAY,uCAKX;AALD,WAAY,uCAAuC;IAC/C,wEAA6B,CAAA;IAC7B,gFAAqC,CAAA;IACrC,gFAAqC,CAAA;IACrC,kFAAuC,CAAA;AAC3C,CAAC,EALW,uCAAuC,KAAvC,uCAAuC,QAKlD;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,wCAAyB,CAAA;IACzB,kCAAmB,CAAA;AACrB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAEC;;GAEG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACrC,sFAAsF;IACtF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;OAIG;IACH,iBAAiB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;IACtE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAML;;GAEG;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,kDAAkD;IAC9E,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIL;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAmC;IAC5E,OAAO,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,cAAgE;IAC1G,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,cAAgE;IAEhE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,QAAQ,EAA0E,EAAE,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC;SACvI,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAGD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,sDAAsD;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { ResourcePrimaryScope } from \"../resources/resources.shared.schemas\";\n\n/**\n * Execution type enum defining how the execution context was initiated.\n *\n * Design rule: an execution type is a PRINCIPAL CATEGORY, never an auth method. A\n * human authenticates via many methods (password, SSO, SAML, WebAuthn, OAuth-social,\n * OIDC authorization-code) but is always one `USER_REQUEST`. Machines follow the same\n * discipline: an organization/application MACHINE principal is authenticated by EITHER\n * a static API key OR an OAuth 2.0 client-credentials flow — the credential type is\n * recorded on `initiatorIds.machineCredential`, it is NOT its own execution type.\n */\nexport enum ExecutionContext_ExecutionType {\n    /**\n     * An organization-scoped MACHINE principal (non-human). Authenticated by EITHER a\n     * static organization API key (`sk_org_…`) OR an OAuth 2.0 client-credentials flow\n     * for an organization OAuth client (`oc_org_…`, direct secret or exchanged token).\n     * Carries `organizationId` + roles; never a `userId`, so `authorizeUserSelf` and\n     * user-FK paths fail closed for it by design. The specific credential is recorded on\n     * `initiatorIds.machineCredential` for audit.\n     */\n    ORGANIZATION_MACHINE = 'organization_machine',\n    /**\n     * An application-scoped MACHINE principal — the APPLICATION-scope peer of\n     * `ORGANIZATION_MACHINE`. Authenticated by an app API key (`sk_app_…`) OR an OAuth\n     * client-credentials flow for an application OAuth client (`oc_app_…`). Carries\n     * `applicationId` + roles; never a `userId`.\n     */\n    APPLICATION_MACHINE = 'application_machine',\n    USER_REQUEST = 'user_request',\n    CONSUMABLE_TOKEN = 'consumable_token',\n    INTERNALLY_INITIATED_REQUEST = 'internally_initiated_request',\n    PUBLIC_EXECUTION = 'public_execution',\n    /**\n     * Execution triggered by an external webhook callback (e.g., Stripe, Google).\n     * Carries resolved scope identifiers (organizationId, userId, etc.) but no authentication credentials.\n     * Created by WebhookHandlerBackendService after signature verification + scope resolution.\n     */\n    WEBHOOK_CALLBACK = 'webhook_callback',\n    ANONYMOUS_SESSION = 'anonymous_session',\n}\n\n/**\n * How a MACHINE principal ({@link ExecutionContext_ExecutionType.ORGANIZATION_MACHINE} /\n * {@link ExecutionContext_ExecutionType.APPLICATION_MACHINE}) authenticated. This is\n * credential PROVENANCE (for audit), NOT a principal distinction — both methods resolve\n * to the same per-scope machine principal.\n */\nexport enum MachineAuthMethod {\n    /** A static, long-lived API key (`sk_org_…` / `sk_app_…`) presented per-request. */\n    API_KEY = 'api_key',\n    /**\n     * A registered OAuth 2.0 client (`oc_org_…` / `oc_app_…`) acting as itself\n     * (client-credentials), presented either as a direct secret or an exchanged\n     * audience-bound bearer token.\n     */\n    OAUTH_CLIENT = 'oauth_client',\n}\n\nexport enum ExecutionContext_ExecutionType_Frontend {\n    USER_REQUEST = 'user_request',\n    CONSUMABLE_TOKEN = 'consumable_token',\n    PUBLIC_EXECUTION = 'public_execution',\n    ANONYMOUS_SESSION = 'anonymous_session',\n}\n\n/**\n * W7.3b: Session type — shared across JWT claims, backend EC, and frontend AuthState.\n */\nexport enum SessionType {\n  PERSISTENT = 'PERSISTENT',\n  ONE_OFF = 'ONE_OFF',\n}\n\n  /**\n   * Initiator IDs structure for non-internal and non-public executions\n   */\n  /**\n   * Credential provenance for a MACHINE principal — WHICH credential authenticated and\n   * of WHAT type. Replaces the former `organizationApiKeyId` / `applicationApiKeyId` /\n   * `m2mClientId` triple: those forked one concept (\"which machine credential\") into\n   * three auth-method-specific fields. The principal's SCOPE lives on `organizationId` /\n   * `applicationId` (as for any principal); this records only the credential, for audit\n   * and attribution (e.g. a File's `uploadedBy`). Only populated for\n   * `ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`.\n   */\n  export const ExecutionContext_MachineCredentialSchema = z.object({\n    /** Whether authentication used a static API key or an OAuth client. */\n    authMethod: z.enum(MachineAuthMethod),\n    /** The authenticating credential's `_id` (the ApiKey row, or the OAuthClient row). */\n    credentialId: z.string(),\n  });\n\n  export type ExecutionContext_MachineCredential = z.infer<typeof ExecutionContext_MachineCredentialSchema>;\n\n  export const ExecutionContext_InitiatorIdsSchema = z.object({\n    organizationId: z.string().optional(),\n    userId: z.string().optional(),\n    applicationId: z.string().optional(),\n    /**\n     * Credential provenance for a machine principal (see\n     * {@link ExecutionContext_MachineCredentialSchema}). Absent for human / anonymous /\n     * webhook / internal principals.\n     */\n    machineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n    consumableTokenId: z.string().optional(),\n    /**\n     * Provider reference that triggered the webhook (e.g., 'stripe', 'google').\n     * Only populated for WEBHOOK_CALLBACK execution type.\n     */\n    webhookProviderId: z.string().optional(),\n    anonymousUserId: z.string().optional(),\n  });\n\n  export type ExecutionContext_InitiatorIds = z.infer<typeof ExecutionContext_InitiatorIdsSchema>;\n\n\n\n/**\n * Role information with related scope and resource context\n */\n\n\nexport const ExecutionContext_RoleInfoSchema = z.object({\n    roles: z.array(z.string()), // Will be validated against Roles type at runtime\n    relatedPrimaryScope: z.enum(ResourcePrimaryScope),\n    relatedResourceId: z.string().optional(),\n    /**\n     * Present ⇒ these roles are held ONLY inside one organization unit, not across the organization.\n     *\n     * Organization units are a NARROWING dimension within `ResourcePrimaryScope.ORGANIZATIONS`, not a\n     * primary scope of their own (plan decision D-C1): a unit is owned BY an organization, so it is\n     * not an ownership root, and adding a fifth scope would fracture the tenant boundary every\n     * exhaustive switch currently relies on.\n     *\n     * ⚠️ **A unit-scoped entry must NEVER be read as organization-wide authority.** Absolutely every\n     * consumer that unions `initiatorRoles` has to partition on this field first — otherwise\n     * \"ORG_MANAGER of Sales\" silently becomes \"ORG_MANAGER of the whole tenant\", which is a\n     * privilege escalation, not a convenience. Use {@link isOrganizationWideRoleInfo} /\n     * {@link selectOrganizationWideRoles} rather than testing this property by hand, so the rule has\n     * exactly one definition.\n     */\n    organizationUnitId: z.string().optional(),\n  });\n\nexport type ExecutionContext_RoleInfo = z.infer<typeof ExecutionContext_RoleInfoSchema>;\n\n/**\n * Does this entry confer authority across the WHOLE owning scope?\n *\n * `false` for a unit-scoped grant, which is only meaningful for resources that opted into unit\n * narrowing (D-C3) and must be ignored entirely by anything asking an organization-wide question.\n *\n * This is the single definition of that rule. Consumers call it instead of writing\n * `!roleInfo.organizationUnitId` inline, so a future narrowing dimension extends one function rather\n * than needing every call site to be rediscovered — the class of miss that made the per-unit `role`\n * field inert-but-dangerous in the first place.\n */\nexport function isOrganizationWideRoleInfo(roleInfo: ExecutionContext_RoleInfo): boolean {\n  return roleInfo.organizationUnitId === undefined;\n}\n\n/**\n * The roles a principal holds across the whole scope, with every narrowed grant removed.\n *\n * The safe default for any \"does this caller hold role X?\" question. Reach past it only where the\n * question is explicitly unit-aware.\n */\nexport function selectOrganizationWideRoles(initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined): string[] {\n  return (initiatorRoles ?? []).filter(isOrganizationWideRoleInfo).flatMap((roleInfo) => roleInfo.roles);\n}\n\n/**\n * The unit-scoped grants a principal holds, as `(organizationUnitId, roles)` pairs.\n *\n * The complement of {@link selectOrganizationWideRoles} — the input to unit narrowing in\n * `buildContextualFilter` and to inheritance traversal.\n */\nexport function selectUnitScopedRoleGrants(\n  initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined,\n): { organizationUnitId: string; roles: string[] }[] {\n  return (initiatorRoles ?? [])\n    .filter((roleInfo): roleInfo is ExecutionContext_RoleInfo & { organizationUnitId: string } => roleInfo.organizationUnitId !== undefined)\n    .map((roleInfo) => ({ organizationUnitId: roleInfo.organizationUnitId, roles: roleInfo.roles }));\n}\n\n\n/**\n * Tracks the relationship path used to access a resource.\n * Captures FK relationship fields for authorization and filtering.\n *\n * Example: When accessing /assigned-to-users/{userId}/todos:\n * - resourceType: \"USERS\"\n * - relationshipField: \"assignedToUserId\" (the FK field on TODOS)\n * - resourceId: the userId value from the URL\n *\n * For standard parent relationships (no FK field):\n * - resourceType: \"ORGANIZATIONS\"\n * - relationshipField: undefined (uses default field identifier)\n * - resourceId: the organizationId value\n */\nexport const ExecutionContext_RelationshipContextSchema = z.object({\n  /** The parent/related resource type (e.g., \"USERS\", \"ORGANIZATIONS\") */\n  resourceType: z.string(),\n  /**\n   * The FK field name if via FK relationship (e.g., 'assignedToUserId').\n   * undefined for standard parent relationships.\n   */\n  relationshipField: z.string().optional(),\n  /** The ID value from the URL for this relationship */\n  resourceId: z.string(),\n  /**\n   * Scope-via-junction tag (scope-required reference search). When set (e.g. on\n   * the `organizationId` param of `/organizations/{id}/users/search`), the\n   * backend scopes this (target) resource's SEARCH/LIST through the named\n   * junction rather than via a column it owns, and authorizes by the anchor\n   * scope's membership. Propagated from the URL param. Absent on normal params.\n   */\n  scopeViaJunction: z.string().optional(),\n});\n\nexport type ExecutionContext_RelationshipContext = z.infer<typeof ExecutionContext_RelationshipContextSchema>;\n"]}

package/dist/esm/runtime/runtime.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/runtime/runtime.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,oBAAY,kBAAkB;IAC1B,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,IAAI,SAAS;CAChB"}
+{"version":3,"file":"runtime.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/runtime/runtime.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,oBAAY,kBAAkB;IAC1B,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,IAAI,SAAS;CAChB"}

package/dist/esm/runtime/runtime.shared.schemas.js

@@ -17,4 +17,4 @@ export var RuntimeEnvironment;
     RuntimeEnvironment["PRODUCTION"] = "production";
     RuntimeEnvironment["TEST"] = "test";
 })(RuntimeEnvironment || (RuntimeEnvironment = {}));
-//# sourceMappingURL=runtime.shared.schemas.js.map
+//# sourceMappingURL=runtime.shared.schemas.js.map

package/dist/esm/runtime/runtime.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.shared.schemas.js","sourceRoot":"","sources":["../../../src/runtime/runtime.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC1B,iDAA2B,CAAA;IAC3B,yCAAmB,CAAA;IACnB,+CAAyB,CAAA;IACzB,mCAAa,CAAA;AACjB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B"}
+{"version":3,"file":"runtime.shared.schemas.js","sourceRoot":"","sources":["../../../../src/runtime/runtime.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC1B,iDAA2B,CAAA;IAC3B,yCAAmB,CAAA;IACnB,+CAAyB,CAAA;IACzB,mCAAa,CAAA;AACjB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B","sourcesContent":["/**\n * Runtime environment values.\n *\n * Each running platform/application instance is mono-env (one env per deployment).\n * `APPLICATION_ENV` is an infra-provided runtime decorator used for:\n * - Dev-only behavior gating (retry logic, dev controllers)\n * - Logging configuration\n * - Feature flipping\n *\n * It is NOT used for multi-env routing, DB lookup keys, inter-service headers,\n * or naming/isolation (each deployment has its own infra).\n */\nexport enum RuntimeEnvironment {\n    DEVELOPMENT = 'development',\n    STAGING = 'staging',\n    PRODUCTION = 'production',\n    TEST = 'test'\n}\n"]}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts

@@ -5,10 +5,10 @@
  * Handles creation, management, rotation, and monitoring of API keys within applications.
  */
 import { z } from 'zod';
-import { ApiKeyStatus } from './api-keys.shared.schemas.js';
-import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
-import { ResourceRelationship } from '../../resources/resources.shared.schemas.js';
-import { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas.js';
+import { ApiKeyStatus } from './api-keys.shared.schemas';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../../resources/resources.shared.schemas';
+import { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';
 export declare enum AppApiKeys_Operations {
     ROTATE = "rotate",// Generate new key and invalidate old one
     REGENERATE = "regenerate",// Generate new key without invalidating old one
@@ -17,21 +17,24 @@ export declare enum AppApiKeys_Operations {
     EXTEND_EXPIRY = "extend_expiry",// Extend expiration date
     USAGE_STATS = "usage_stats"
 }
-type AppApiKeysCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE;
-export declare const appApiKeysResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../../index.js").ResourceConfiguration<typeof AppApiKeys_Operations, AppApiKeysCoreOperations, z.ZodObject<{
+type AppApiKeysCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE;
+export declare const appApiKeysResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof AppApiKeys_Operations, AppApiKeysCoreOperations, z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     name: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     description: z.ZodOptional<z.ZodString>;
-    roles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof import("../../index.js").CORE_ORG_ROLES>, z.ZodString]>>>;
-    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>;
+    roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-    scope: z.ZodLiteral<import("./api-keys.shared.schemas.js").ApiKeyScope.APPLICATION>;
+    previousHashedKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    previousKeyPrefix: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    previousKeyInvalidationDate: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    scope: z.ZodLiteral<import("./api-keys.shared.schemas").ApiKeyScope.APPLICATION>;
     applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    hashedKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    hashedKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
     keyPrefix: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 export {};
 //# sourceMappingURL=api-keys-application.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;wCAmNlH,CAAC"}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAmRlH,CAAC"}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js

@@ -46,7 +46,12 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.SEARCH,
-        CoreResourceOperation.CREATE
+        CoreResourceOperation.CREATE,
+        // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition
+        // onParentDelete cascade so key rows are physically removed when their owning
+        // application is deleted. Without it the cascade throws ErrorType.CONFIGURATION
+        // on any application that still has API-key rows.
+        CoreResourceOperation.DELETE
     ],
     customOperation: AppApiKeys_Operations,
     operationsConfiguration: {
@@ -106,6 +111,21 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 }
             ]
         },
+        // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition
+        // onParentDelete cascade so API-key rows are physically removed when their
+        // owning application is deleted. Without a DELETE op the cascade
+        // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application
+        // that still has key rows. Super-admin/HIGH: the app API-key admin tier.
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }
+            ],
+        },
         [AppApiKeys_Operations.ROTATE]: {
             variants: [
                 {
@@ -113,6 +133,20 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's
+                    // invalidation at the requested boundary (default: now) and returns the replacement in
+                    // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still
+                    // using the prior value break and it cannot be restored. An unauthorized rotate is not
+                    // merely destructive: the caller WALKS AWAY WITH the replacement credential.
+                    // A live session alone is deliberately not sufficient for that.
+                    //
+                    // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a
+                    // regenerate "keeps the prior secret working" (see its own declaration), so it is additive
+                    // and recoverable. Gate the irreversible, not merely the sensitive.
+                    //
+                    // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a
+                    // high-impact action.
+                    requiresStepUpAuthentication: true,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
                         oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
@@ -139,6 +173,23 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its
+                    // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously
+                    // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.
+                    // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps
+                    // the prior secret working) and wrong on the evidence axis; this declaration is exactly
+                    // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the
+                    // verb's danger. Same reasoning as `organizationMembers | UPDATE`.
+                    // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    // REGENERATE reissues the secret and nothing else — it takes no caller input
+                    // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the
+                    // auto-derived UPDATE contract would apply: the reissue prefix returns
+                    // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller
+                    // payload, so `roles` would be writable through "regenerate" — bypassing the
+                    // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`
+                    // runs in the CREATE handler only) on a resource with no core UPDATE.
+                    requestDto: z.object({}),
                     customResponseDto: ApiKeyApplicationSchema.extend({
                         plainKey: z.string().min(1).isEphemeral(),
                     }),
@@ -159,6 +210,15 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE
+                    // selects the core path that persists; it must NOT also hand the caller UPDATE's
+                    // request contract. Omitting `requestDto` here would auto-derive the resource's
+                    // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting
+                    // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and
+                    // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no
+                    // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix
+                    // implementation; see `api-keys.custom-impl.backend.service.ts`.
+                    requestDto: z.object({}),
                     enabledCondition: ({ currentObject }) => {
                         return currentObject.status === ApiKeyStatus.ACTIVE;
                     }
@@ -179,6 +239,9 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // No input: `status` is forced to ACTIVE by the paired prefix implementation.
+                    // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.
+                    requestDto: z.object({}),
                     enabledCondition: ({ currentObject }) => {
                         return currentObject.status === ApiKeyStatus.INACTIVE;
                     }
@@ -232,4 +295,4 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
         }
     },
 });
-//# sourceMappingURL=api-keys-application.shared.resources-config.schemas.js.map
+//# sourceMappingURL=api-keys-application.shared.resources-config.schemas.js.map

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,kDAAkD;AAElD,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAEhH,kDAAkD;AAClD,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,oDAA2B,CAAA;AAC7B,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAQD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAE1E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,kDAAkD;AAElD,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAEhH,kDAAkD;AAClD,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,oDAA2B,CAAA;AAC7B,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAE1E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,8EAA8E;QAC9E,gFAAgF;QAChF,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,iEAAiE;QACjE,8EAA8E;QAC9E,yEAAyE;QACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application API Keys Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within applications.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyApplicationSchema,\n  ApiKeyStatus\n} from './api-keys.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application API keys\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_API_KEYS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  hasExpiration: z.boolean(),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_API_KEYS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application API keys\nexport enum AppApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype AppApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication API Keys Resource Configuration Factory\n*/\nexport const appApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppApiKeys_Operations,\n  AppApiKeysCoreOperations,\n  typeof ApiKeyApplicationSchema\n>({\n  mainSchema: ApiKeyApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so key rows are physically removed when their owning\n    // application is deleted. Without it the cascade throws ErrorType.CONFIGURATION\n    // on any application that still has API-key rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so API-key rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has key rows. Super-admin/HIGH: the app API-key admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [AppApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        }\n      ]\n    }\n  },\n});\n"]}