@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.d.ts

@@ -5,10 +5,10 @@
  * Handles creation, management, rotation, and monitoring of API keys within organizations.
  */
 import { z } from 'zod';
-import { ApiKeyStatus } from './api-keys.shared.schemas.js';
-import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
-import { ResourceRelationship } from '../../resources/resources.shared.schemas.js';
-import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas.js';
+import { ApiKeyStatus } from './api-keys.shared.schemas';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../../resources/resources.shared.schemas';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';
 export declare enum OrgApiKeys_Operations {
     ROTATE = "rotate",// Generate new key and invalidate old one
     REGENERATE = "regenerate",// Generate new key without invalidating old one
@@ -17,21 +17,24 @@ export declare enum OrgApiKeys_Operations {
     EXTEND_EXPIRY = "extend_expiry",// Extend expiration date
     USAGE_STATS = "usage_stats"
 }
-type OrgApiKeysCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE;
-export declare const orgApiKeysResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../../index.js").ResourceConfiguration<typeof OrgApiKeys_Operations, OrgApiKeysCoreOperations, z.ZodObject<{
+type OrgApiKeysCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE | CoreResourceOperation.COUNT;
+export declare const orgApiKeysResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof OrgApiKeys_Operations, OrgApiKeysCoreOperations, z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     name: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     description: z.ZodOptional<z.ZodString>;
-    roles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>>;
-    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>;
+    roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-    scope: z.ZodLiteral<import("./api-keys.shared.schemas.js").ApiKeyScope.ORGANIZATION>;
+    previousHashedKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    previousKeyPrefix: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    previousKeyInvalidationDate: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    scope: z.ZodLiteral<import("./api-keys.shared.schemas").ApiKeyScope.ORGANIZATION>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-    hashedKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    hashedKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
     keyPrefix: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 export {};
 //# sourceMappingURL=api-keys-organization.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;wCA4UlH,CAAC"}
+{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBA8elH,CAAC"}

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js

@@ -57,9 +57,22 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
         CoreResourceOperation.SEARCH,
         CoreResourceOperation.CREATE,
         CoreResourceOperation.DELETE,
+        CoreResourceOperation.COUNT,
     ],
     customOperation: OrgApiKeys_Operations,
     operationsConfiguration: {
+        [CoreResourceOperation.COUNT]: {
+            variants: [
+                {
+                    // Feature usage accounting counts org API keys through the repository
+                    // layer. This operation does not need public HTTP exposure.
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_MEMBER],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
         [CoreResourceOperation.READ]: {
             variants: [
                 {
@@ -112,6 +125,16 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     variantKey: "admin",
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // Per-variant DTOs are NOT inherited from the default variant — each
+                    // variant builds its own. Without this, the admin response falls back to
+                    // `mainSchema` and silently strips the one-time `plainKey` (it exists
+                    // nowhere else after this response — only its SHA-256 hash is persisted).
+                    // Security decision: an app-super-admin creating a key for another org
+                    // DOES receive the plaintext so they can relay it to the org. Mirror of
+                    // the default variant's `customResponseDto` above — keep in sync.
+                    customResponseDto: ApiKeyOrganizationSchema.extend({
+                        plainKey: z.string().min(1).isEphemeral()
+                    }),
                 }
             ],
             userNotifications: [
@@ -161,6 +184,20 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's
+                    // invalidation at the requested boundary (default: now) and returns the replacement in
+                    // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still
+                    // using the prior value break and it cannot be restored. An unauthorized rotate is not
+                    // merely destructive: the caller WALKS AWAY WITH the replacement credential.
+                    // A live session alone is deliberately not sufficient for that.
+                    //
+                    // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a
+                    // regenerate "keeps the prior secret working" (see its own declaration), so it is additive
+                    // and recoverable. Gate the irreversible, not merely the sensitive.
+                    //
+                    // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a
+                    // high-impact action.
+                    requiresStepUpAuthentication: true,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
                         oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
@@ -177,7 +214,44 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     variantKey: "admin",
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's
+                    // invalidation at the requested boundary (default: now) and returns the replacement in
+                    // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still
+                    // using the prior value break and it cannot be restored. An unauthorized rotate is not
+                    // merely destructive: the caller WALKS AWAY WITH the replacement credential.
+                    // A live session alone is deliberately not sufficient for that.
+                    //
+                    // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a
+                    // regenerate "keeps the prior secret working" (see its own declaration), so it is additive
+                    // and recoverable. Gate the irreversible, not merely the sensitive.
+                    //
+                    // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a
+                    // high-impact action.
+                    requiresStepUpAuthentication: true,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // Per-variant DTOs are NOT inherited from the default variant — each
+                    // variant builds its own. Request AND response both MIRROR the org-admin
+                    // default (paired spec: "Super-admin `admin` HTTP variants mirror org-admin
+                    // operations across tenants"):
+                    //  - requestDto: an app-super-admin can choose the same future
+                    //    `oldKeyInvalidationDate` window as an org admin. Without it the admin
+                    //    variant would build no request DTO and the impl could only default the
+                    //    invalidation to now — silently denying the future-window capability the
+                    //    default variant exposes.
+                    //  - customResponseDto: without it the admin response falls back to
+                    //    `mainSchema` and silently strips the one-time `plainKey` (plus the
+                    //    rotated-out key's id + invalidation date). Security decision: an
+                    //    app-super-admin rotating another org's key DOES receive the plaintext
+                    //    so they can relay it to the org.
+                    // Keep both in sync with the default variant above.
+                    requestDto: z.object({
+                        oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                    }),
+                    customResponseDto: ApiKeyOrganizationSchema.extend({
+                        plainKey: z.string().min(1).isEphemeral(),
+                        oldKeyId: z.string(),
+                        oldKeyInvalidationDate: z.date()
+                    }),
                 }
             ],
             userNotifications: [
@@ -199,6 +273,23 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate keys
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its
+                    // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously
+                    // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.
+                    // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps
+                    // the prior secret working) and wrong on the evidence axis; this declaration is exactly
+                    // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the
+                    // verb's danger. Same reasoning as `organizationMembers | UPDATE`.
+                    // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    // REGENERATE reissues the secret and nothing else — it takes no caller input
+                    // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the
+                    // auto-derived UPDATE contract would apply: the reissue prefix returns
+                    // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller
+                    // payload, so `roles` would be writable through "regenerate" — bypassing the
+                    // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`
+                    // runs in the CREATE handler only) on a resource with no core UPDATE.
+                    requestDto: z.object({}),
                     customResponseDto: ApiKeyOrganizationSchema.extend({
                         plainKey: z.string().min(1).isEphemeral(),
                     }),
@@ -210,6 +301,27 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its
+                    // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously
+                    // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.
+                    // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps
+                    // the prior secret working) and wrong on the evidence axis; this declaration is exactly
+                    // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the
+                    // verb's danger. Same reasoning as `organizationMembers | UPDATE`.
+                    // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    // Per-variant DTOs are NOT inherited from the default variant — each
+                    // variant builds its own. Without this, the admin response falls back to
+                    // `mainSchema` and silently strips the one-time `plainKey`. Security
+                    // decision: an app-super-admin regenerating another org's key DOES
+                    // receive the plaintext so they can relay it to the org. Mirror of the
+                    // default variant's `customResponseDto` above — keep in sync.
+                    // `requestDto` mirrors the default variant too: no caller input, so the
+                    // cross-tenant variant cannot rewrite `roles` through "regenerate" either.
+                    requestDto: z.object({}),
+                    customResponseDto: ApiKeyOrganizationSchema.extend({
+                        plainKey: z.string().min(1).isEphemeral(),
+                    }),
                 }
             ],
             userNotifications: [
@@ -227,6 +339,15 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate keys
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE
+                    // selects the core path that persists; it must NOT also hand the caller UPDATE's
+                    // request contract. Omitting `requestDto` here would auto-derive the resource's
+                    // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting
+                    // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and
+                    // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no
+                    // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix
+                    // implementation; see `api-keys.custom-impl.backend.service.ts`.
+                    requestDto: z.object({}),
                     enabledCondition: ({ currentObject }) => {
                         return currentObject.status === ApiKeyStatus.ACTIVE;
                     }
@@ -238,6 +359,11 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // Per-variant DTOs are NOT inherited from the default variant — each variant builds
+                    // its own, so this cross-tenant variant needs its own narrowing or it re-derives the
+                    // full UPDATE contract. It also carries NO `enabledCondition`, so the transition
+                    // precondition is enforced solely by the prefix implementation's 409 guard.
+                    requestDto: z.object({}),
                 }
             ],
             userNotifications: [
@@ -255,6 +381,9 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate keys
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // No input: `status` is forced to ACTIVE by the paired prefix implementation.
+                    // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.
+                    requestDto: z.object({}),
                     enabledCondition: ({ currentObject }) => {
                         return currentObject.status === ApiKeyStatus.INACTIVE;
                     }
@@ -266,6 +395,8 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.
+                    requestDto: z.object({}),
                 }
             ],
             userNotifications: [
@@ -297,6 +428,18 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // Request parity with the org-admin default (spec: "admin variants mirror
+                    // org-admin operations across tenants"). `newExpiresAt` is REQUIRED and has
+                    // no default, so without this requestDto the admin variant builds no request
+                    // DTO and an app-super-admin literally cannot pass the new expiry — the
+                    // operation is unusable for admins.
+                    requestDto: z.object({
+                        newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')
+                    }),
+                    // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /
+                    // REACTIVATE admin variants: it is a frontend action-affordance gate, not a
+                    // backend guard, and the app-super-admin cross-tenant surface is not
+                    // state-gated the way the in-tenant org-admin surface is.
                 }
             ]
         },
@@ -327,6 +470,24 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     resourceOperationLike: CoreResourceOperation.READ,
+                    // Per-variant DTOs are NOT inherited from the default variant — each
+                    // variant builds its own. Without this, the admin response falls back to
+                    // `mainSchema` (the resource object); because the stats shape is DISJOINT
+                    // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the
+                    // serializer would reject the impl's output → latent 500. Stats are not a
+                    // secret — the app-super-admin gets the same oversight view as the org.
+                    // Mirror of the default variant's `customResponseDto` above — keep in sync.
+                    customResponseDto: z.object({
+                        keyId: z.string(),
+                        totalRequests: z.number().min(0),
+                        requestsLastHour: z.number().min(0),
+                        requestsLastDay: z.number().min(0),
+                        requestsLastWeek: z.number().min(0),
+                        lastUsedAt: z.date().optional(),
+                        mostUsedEndpoint: z.string().optional(),
+                        errorRate: z.number().min(0).max(100), // Percentage
+                        rateLimitHits: z.number().min(0)
+                    }),
                 }
             ]
         },
@@ -361,4 +522,4 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
         },
     },
 });
-//# sourceMappingURL=api-keys-organization.shared.resources-config.schemas.js.map
+//# sourceMappingURL=api-keys-organization.shared.resources-config.schemas.js.map

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,oDAA2B,CAAA;AAC7B,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;iBACpD;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;iBACpD;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;iBACpD;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;iBACpD;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,oCAAoC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;iBACpD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;iBAClD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;oBAClD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,oDAA2B,CAAA;AAC7B,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,oCAAoC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,4EAA4E;oBAC5E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;oBAClD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization API Keys Shared Resource Configuration\n *\n * Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyOrganizationSchema,\n  ApiKeyStatus\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  name: z.string(),\n  organizationId: z.string(),\n  hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n  ...ORG_API_KEYS_FILTER_FIELDS,\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.COUNT;\n\n/*\nOrganization API Keys Resource Configuration Factory\n*/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrgApiKeys_Operations,\n  OrgApiKeysCoreOperations,\n  typeof ApiKeyOrganizationSchema\n>({\n  mainSchema: ApiKeyOrganizationSchema,\n  resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Organization API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.DELETE,\n    CoreResourceOperation.COUNT,\n  ],\n\n  customOperation: OrgApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.COUNT]: {\n      variants: [\n        {\n          // Feature usage accounting counts org API keys through the repository\n          // layer. This operation does not need public HTTP exposure.\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainKey` (it exists\n          // nowhere else after this response — only its SHA-256 hash is persisted).\n          // Security decision: an app-super-admin creating a key for another org\n          // DOES receive the plaintext so they can relay it to the org. Mirror of\n          // the default variant's `customResponseDto` above — keep in sync.\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Request AND response both MIRROR the org-admin\n          // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n          // operations across tenants\"):\n          //  - requestDto: an app-super-admin can choose the same future\n          //    `oldKeyInvalidationDate` window as an org admin. Without it the admin\n          //    variant would build no request DTO and the impl could only default the\n          //    invalidation to now — silently denying the future-window capability the\n          //    default variant exposes.\n          //  - customResponseDto: without it the admin response falls back to\n          //    `mainSchema` and silently strips the one-time `plainKey` (plus the\n          //    rotated-out key's id + invalidation date). Security decision: an\n          //    app-super-admin rotating another org's key DOES receive the plaintext\n          //    so they can relay it to the org.\n          // Keep both in sync with the default variant above.\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainKey`. Security\n          // decision: an app-super-admin regenerating another org's key DOES\n          // receive the plaintext so they can relay it to the org. Mirror of the\n          // default variant's `customResponseDto` above — keep in sync.\n          // `requestDto` mirrors the default variant too: no caller input, so the\n          // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n          // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n          // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n          // precondition is enforced solely by the prefix implementation's 409 guard.\n          requestDto: z.object({}),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n          requestDto: z.object({}),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can extend expiry\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Request parity with the org-admin default (spec: \"admin variants mirror\n          // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n          // no default, so without this requestDto the admin variant builds no request\n          // DTO and an app-super-admin literally cannot pass the new expiry — the\n          // operation is unusable for admins.\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n          // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n          // backend guard, and the app-super-admin cross-tenant surface is not\n          // state-gated the way the in-tenant org-admin surface is.\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` (the resource object); because the stats shape is DISJOINT\n          // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n          // serializer would reject the impl's output → latent 500. Stats are not a\n          // secret — the app-super-admin gets the same oversight view as the org.\n          // Mirror of the default variant's `customResponseDto` above — keep in sync.\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_API_KEYS_FILTER_FIELDS,\n          sortFields: ORG_API_KEYS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description', 'keyId'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n  },\n});\n"]}