npm - @wildo-ai/saas-models - Versions diffs - 1.1.3 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.3 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (890) hide show

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js CHANGED Viewed

@@ -7,7 +7,7 @@
 import { z } from 'zod';
 import { ApiKeyOrganizationSchema, ApiKeyStatus } from './api-keys.shared.schemas.js';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel } from '../../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../../resources/resources.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
@@ -185,6 +185,9 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's
                     // invalidation at the requested boundary (default: now) and returns the replacement in
                     // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,oCAAoC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,4EAA4E;oBAC5E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;oBAClD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization API Keys Shared Resource Configuration\n \n Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n /\n\nimport { z } from 'zod';\nimport {\n ApiKeyOrganizationSchema,\n ApiKeyStatus\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n status: z.enum(ApiKeyStatus),\n name: z.string(),\n organizationId: z.string(),\n hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n ...ORG_API_KEYS_FILTER_FIELDS,\n lastUsedAt: z.date(), // Admin can filter by last usage\n expiresAt: z.date(), // Admin can filter by expiration\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n ROTATE = 'rotate', // Generate new key and invalidate old one\n REGENERATE = 'regenerate', // Generate new key without invalidating old one\n DEACTIVATE = 'deactivate', // Deactivate key\n REACTIVATE = 'reactivate', // Reactivate key\n EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.COUNT;\n\n/\nOrganization API Keys Resource Configuration Factory\n/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof OrgApiKeys_Operations,\n OrgApiKeysCoreOperations,\n typeof ApiKeyOrganizationSchema\n>({\n mainSchema: ApiKeyOrganizationSchema,\n resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Organization API keys are a core system resource\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.COUNT,\n ],\n\n customOperation: OrgApiKeys_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n // Feature usage accounting counts org API keys through the repository\n // layer. This operation does not need public HTTP exposure.\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // requestDto auto-derived from decorators\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (it exists\n // nowhere else after this response — only its SHA-256 hash is persisted).\n // Security decision: an app-super-admin creating a key for another org\n // DOES receive the plaintext so they can relay it to the org. Mirror of\n // the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.ROTATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n oldKeyId: z.string(),\n oldKeyInvalidationDate: z.date()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Request AND response both MIRROR the org-admin\n // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n // operations across tenants\"):\n // - requestDto: an app-super-admin can choose the same future\n // `oldKeyInvalidationDate` window as an org admin. Without it the admin\n // variant would build no request DTO and the impl could only default the\n // invalidation to now — silently denying the future-window capability the\n // default variant exposes.\n // - customResponseDto: without it the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (plus the\n // rotated-out key's id + invalidation date). Security decision: an\n // app-super-admin rotating another org's key DOES receive the plaintext\n // so they can relay it to the org.\n // Keep both in sync with the default variant above.\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n oldKeyId: z.string(),\n oldKeyInvalidationDate: z.date()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REGENERATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // REGENERATE reissues the secret and nothing else — it takes no caller input\n // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n // auto-derived UPDATE contract would apply: the reissue prefix returns\n // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n // runs in the CREATE handler only) on a resource with no core UPDATE.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey`. Security\n // decision: an app-super-admin regenerating another org's key DOES\n // receive the plaintext so they can relay it to the org. Mirror of the\n // default variant's `customResponseDto` above — keep in sync.\n // `requestDto` mirrors the default variant too: no caller input, so the\n // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.DEACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n // selects the core path that persists; it must NOT also hand the caller UPDATE's\n // request contract. Omitting `requestDto` here would auto-derive the resource's\n // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n // implementation; see `api-keys.custom-impl.backend.service.ts`.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.ACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n // precondition is enforced solely by the prefix implementation's 409 guard.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.INACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n /\n ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n * the sweep is the only caller.\n \n Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n * hazard DEACTIVATE documents at length — with no route there is no request contract to\n * auto-derive and no `PUT .../expire` that could carry `status: active`.\n \n It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n * direct write would be a second authority over the field and would skip the ACTIVE-only\n * precondition, which lives in the paired prefix implementation\n * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n * `enabledCondition` cannot be.\n */\n [OrgApiKeys_Operations.EXPIRE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n // and the paired prefix implementation forces the status transition itself, so there is no field\n // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n requestDto: z.object({}),\n }\n ],\n // No notification: expiry is the scheduled consequence of a date the administrator set, not\n // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n // feature and is not this one.\n },\n\n [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can extend expiry\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Request parity with the org-admin default (spec: \"admin variants mirror\n // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n // no default, so without this requestDto the admin variant builds no request\n // DTO and an app-super-admin literally cannot pass the new expiry — the\n // operation is unusable for admins.\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n }),\n // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n // backend guard, and the app-super-admin cross-tenant surface is not\n // state-gated the way the in-tenant org-admin surface is.\n }\n ]\n },\n\n [OrgApiKeys_Operations.USAGE_STATS]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n customResponseDto: z.object({\n keyId: z.string(),\n totalRequests: z.number().min(0),\n requestsLastHour: z.number().min(0),\n requestsLastDay: z.number().min(0),\n requestsLastWeek: z.number().min(0),\n lastUsedAt: z.date().optional(),\n mostUsedEndpoint: z.string().optional(),\n errorRate: z.number().min(0).max(100), // Percentage\n rateLimitHits: z.number().min(0)\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` (the resource object); because the stats shape is DISJOINT\n // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n // serializer would reject the impl's output → latent 500. Stats are not a\n // secret — the app-super-admin gets the same oversight view as the org.\n // Mirror of the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: z.object({\n keyId: z.string(),\n totalRequests: z.number().min(0),\n requestsLastHour: z.number().min(0),\n requestsLastDay: z.number().min(0),\n requestsLastWeek: z.number().min(0),\n lastUsedAt: z.date().optional(),\n mostUsedEndpoint: z.string().optional(),\n errorRate: z.number().min(0).max(100), // Percentage\n rateLimitHits: z.number().min(0)\n }),\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'keyId'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,+GAA+G;oBAC/G,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,oCAAoC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,4EAA4E;oBAC5E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;oBAClD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization API Keys Shared Resource Configuration\n \n Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n /\n\nimport { z } from 'zod';\nimport {\n ApiKeyOrganizationSchema,\n ApiKeyStatus\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n status: z.enum(ApiKeyStatus),\n name: z.string(),\n organizationId: z.string(),\n hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n ...ORG_API_KEYS_FILTER_FIELDS,\n lastUsedAt: z.date(), // Admin can filter by last usage\n expiresAt: z.date(), // Admin can filter by expiration\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n ROTATE = 'rotate', // Generate new key and invalidate old one\n REGENERATE = 'regenerate', // Generate new key without invalidating old one\n DEACTIVATE = 'deactivate', // Deactivate key\n REACTIVATE = 'reactivate', // Reactivate key\n EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.COUNT;\n\n/\nOrganization API Keys Resource Configuration Factory\n/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof OrgApiKeys_Operations,\n OrgApiKeysCoreOperations,\n typeof ApiKeyOrganizationSchema\n>({\n mainSchema: ApiKeyOrganizationSchema,\n resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Organization API keys are a core system resource\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.COUNT,\n ],\n\n customOperation: OrgApiKeys_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n // Feature usage accounting counts org API keys through the repository\n // layer. This operation does not need public HTTP exposure.\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // requestDto auto-derived from decorators\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (it exists\n // nowhere else after this response — only its SHA-256 hash is persisted).\n // Security decision: an app-super-admin creating a key for another org\n // DOES receive the plaintext so they can relay it to the org. Mirror of\n // the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.ROTATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n oldKeyId: z.string(),\n oldKeyInvalidationDate: z.date()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Request AND response both MIRROR the org-admin\n // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n // operations across tenants\"):\n // - requestDto: an app-super-admin can choose the same future\n // `oldKeyInvalidationDate` window as an org admin. Without it the admin\n // variant would build no request DTO and the impl could only default the\n // invalidation to now — silently denying the future-window capability the\n // default variant exposes.\n // - customResponseDto: without it the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (plus the\n // rotated-out key's id + invalidation date). Security decision: an\n // app-super-admin rotating another org's key DOES receive the plaintext\n // so they can relay it to the org.\n // Keep both in sync with the default variant above.\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n oldKeyId: z.string(),\n oldKeyInvalidationDate: z.date()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REGENERATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // REGENERATE reissues the secret and nothing else — it takes no caller input\n // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n // auto-derived UPDATE contract would apply: the reissue prefix returns\n // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n // runs in the CREATE handler only) on a resource with no core UPDATE.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey`. Security\n // decision: an app-super-admin regenerating another org's key DOES\n // receive the plaintext so they can relay it to the org. Mirror of the\n // default variant's `customResponseDto` above — keep in sync.\n // `requestDto` mirrors the default variant too: no caller input, so the\n // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.DEACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n // selects the core path that persists; it must NOT also hand the caller UPDATE's\n // request contract. Omitting `requestDto` here would auto-derive the resource's\n // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n // implementation; see `api-keys.custom-impl.backend.service.ts`.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.ACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n // precondition is enforced solely by the prefix implementation's 409 guard.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.INACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n /\n ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n * the sweep is the only caller.\n \n Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n * hazard DEACTIVATE documents at length — with no route there is no request contract to\n * auto-derive and no `PUT .../expire` that could carry `status: active`.\n \n It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n * direct write would be a second authority over the field and would skip the ACTIVE-only\n * precondition, which lives in the paired prefix implementation\n * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n * `enabledCondition` cannot be.\n */\n [OrgApiKeys_Operations.EXPIRE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n // and the paired prefix implementation forces the status transition itself, so there is no field\n // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n requestDto: z.object({}),\n }\n ],\n // No notification: expiry is the scheduled consequence of a date the administrator set, not\n // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n // feature and is not this one.\n },\n\n [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can extend expiry\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Request parity with the org-admin default (spec: \"admin variants mirror\n // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n // no default, so without this requestDto the admin variant builds no request\n // DTO and an app-super-admin literally cannot pass the new expiry — the\n // operation is unusable for admins.\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n }),\n // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n // backend guard, and the app-super-admin cross-tenant surface is not\n // state-gated the way the in-tenant org-admin surface is.\n }\n ]\n },\n\n [OrgApiKeys_Operations.USAGE_STATS]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n customResponseDto: z.object({\n keyId: z.string(),\n totalRequests: z.number().min(0),\n requestsLastHour: z.number().min(0),\n requestsLastDay: z.number().min(0),\n requestsLastWeek: z.number().min(0),\n lastUsedAt: z.date().optional(),\n mostUsedEndpoint: z.string().optional(),\n errorRate: z.number().min(0).max(100), // Percentage\n rateLimitHits: z.number().min(0)\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` (the resource object); because the stats shape is DISJOINT\n // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n // serializer would reject the impl's output → latent 500. Stats are not a\n // secret — the app-super-admin gets the same oversight view as the org.\n // Mirror of the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: z.object({\n keyId: z.string(),\n totalRequests: z.number().min(0),\n requestsLastHour: z.number().min(0),\n requestsLastDay: z.number().min(0),\n requestsLastWeek: z.number().min(0),\n lastUsedAt: z.date().optional(),\n mostUsedEndpoint: z.string().optional(),\n errorRate: z.number().min(0).max(100), // Percentage\n rateLimitHits: z.number().min(0)\n }),\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'keyId'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ],\n },\n },\n});\n"]}

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts CHANGED Viewed

@@ -4,7 +4,7 @@
  * Core authentication schemas shared between frontend and backend
  */
 import { z } from 'zod';
-import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType } from './authentication.shared.schemas';
+import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType, SsoConnectionType } from './authentication.shared.schemas';
 import { SessionType } from '../../runtime/execution-context.shared.schemas';
 /**
  * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,
@@ -34,7 +34,8 @@ export declare const AuthInvitationInfoResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -88,7 +89,8 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -112,7 +114,8 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -222,13 +225,25 @@ export declare const TOTPAuthRequestSchema: z.ZodObject<{
 /**
  * SMS OTP Authentication (First or second factor)
  */
+/**
+ * Verifying an SMS one-time code.
+ *
+ * There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read
+ * by nothing: the code is matched by the session's account and the session id, and the destination
+ * was always resolved from the account. Its only effect was that the value a CALLER supplied was
+ * written into both audit rows as though it were the number the code went to, so a caller could
+ * attribute their own attempts to a number that was never involved. An audit trail whose subject
+ * chooses what it says about them is not attributable.
+ *
+ * No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls
+ * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.
+ */
 export declare const SMSOTPAuthRequestSchema: z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     method: z.ZodLiteral<AuthMethod.SMS_OTP>;
     factorLevel: z.ZodUnion<readonly [z.ZodLiteral<AuthFactorLevel.FIRST>, z.ZodLiteral<AuthFactorLevel.SECOND>]>;
-    phoneNumber: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
@@ -265,6 +280,22 @@ export declare const PasskeyAuthRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"public-key">;
     }, z.core.$strip>;
 }, z.core.$strip>;
+/**
+ * The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.
+ */
+export declare const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;
+/**
+ * Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the
+ * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.
+ *
+ * Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every
+ * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise
+ * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect
+ * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —
+ * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a
+ * person whose redirect was dropped still signs in, at the application home.
+ */
+export declare function carriedAuthRedirect(value: string | undefined): string | undefined;
 /**
  * Magic Link Send Request — triggers a magic link email to the user.
  * Separate from the main AuthenticationRequestSchema because it doesn't
@@ -273,6 +304,7 @@ export declare const PasskeyAuthRequestSchema: z.ZodObject<{
 export declare const MagicLinkSendRequestSchema: z.ZodObject<{
     email: z.ZodEmail;
     organizationId: z.ZodOptional<z.ZodString>;
+    redirect: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string, string>>;
 }, z.core.$strip>;
 /**
  * Magic Link Verify Request — verifies the token from the magic link.
@@ -347,7 +379,6 @@ export declare const AuthenticationRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     method: z.ZodLiteral<AuthMethod.SMS_OTP>;
     factorLevel: z.ZodUnion<readonly [z.ZodLiteral<AuthFactorLevel.FIRST>, z.ZodLiteral<AuthFactorLevel.SECOND>]>;
-    phoneNumber: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
@@ -414,6 +445,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
     user: z.ZodOptional<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>>>>;
+        emailVerifiedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
         status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserStatus>>>>>>;
         appRoles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodString]>>>>>;
         userTypes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
@@ -431,7 +463,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
             phoneNumber: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPhoneSchema>;
             title: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
         }, z.core.$strip>>;
-        userSelfPreference: z.ZodOptional<z.ZodObject<{
+        userSelfPreferences: z.ZodOptional<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
             userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
             notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
@@ -440,10 +472,10 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
                 sms: z.ZodDefault<z.ZodBoolean>;
                 inApp: z.ZodDefault<z.ZodBoolean>;
             }, z.core.$strip>>>;
-            privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-                dataProcessingConsent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").DataProcessingConsent>>>;
-                privacyLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").PrivacyLevel>>>;
-            }, z.core.$strip>>>;
+            privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+                consentedPurposes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("../..").ConsentPurpose>>>>>;
+                consentDecidedAt: z.ZodOptional<z.ZodDate>;
+            }, z.core.$strip>>>>;
             ui: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserTheme>>>;
             }, z.core.$strip>>>;
@@ -462,7 +494,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
         }, z.core.$strip>>;
         organizationMembers: z.ZodOptional<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
             userEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>>>>>;
             organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
             roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>>>;
@@ -490,7 +522,8 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -518,6 +551,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
     retryAllowed: z.ZodDefault<z.ZodBoolean>;
     remainingAttempts: z.ZodOptional<z.ZodNumber>;
     lockoutUntil: z.ZodOptional<z.ZodDate>;
+    passkeyCredentialUnknown: z.ZodOptional<z.ZodBoolean>;
     challengeData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     redirectUrl: z.ZodOptional<z.ZodURL>;
 }, z.core.$strip>;
@@ -543,6 +577,19 @@ export declare const MFASetupResponseSchema: z.ZodObject<{
 /**
  * Authentication Session State
  */
+/**
+ * Something an account owes before a parked sign-in may complete (#1374).
+ *
+ * `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry
+ * a second. Each member is derived from durable state, has its own step and completion door, and has its own
+ * "can this ever finish?" answer, so one unfulfillable obligation never strands an account that owes another.
+ */
+export declare enum OnboardingObligation {
+    /** The organization the user type names at onboarding (`pendingOrgType` names its type). */
+    ORGANIZATION = "organization",
+    /** The person's first and last name, when the user type collects them at onboarding. */
+    PROFILE_NAMES = "profile_names"
+}
 export declare enum AuthenticationSessionState {
     CREATED = "CREATED",// Session created, waiting for identification
     IDENTIFIED = "IDENTIFIED",// User identified, methods available
@@ -552,17 +599,41 @@ export declare enum AuthenticationSessionState {
     SECOND_FACTOR_IN_PROGRESS = "SECOND_FACTOR_IN_PROGRESS",// Second factor in progress
     COMPLETED = "COMPLETED",// Authentication completed successfully
     PASSWORD_EXPIRED = "PASSWORD_EXPIRED",// W2.2: Password expired, must change before token issuance
-    REGISTERED = "REGISTERED",// Account created, email verification pending/deferred
+    REGISTERED = "REGISTERED",// Invitation acceptance's correlation session (audit id only); self-registration creates none since #1010
     EMAIL_VERIFIED = "EMAIL_VERIFIED",// Email confirmed, checking MFA requirements
     MFA_ENROLLMENT_REQUIRED = "MFA_ENROLLMENT_REQUIRED",// MFA enrollment needed before tokens can be issued
     MFA_ENROLLMENT_GRACE = "MFA_ENROLLMENT_GRACE",// Within grace period — tokens issued with mfaGraceExpiresAt claim
-    ONBOARDING_PENDING = "ONBOARDING_PENDING",// Auth complete, guidance/onboarding steps remain
+    ONBOARDING_PENDING = "ONBOARDING_PENDING",// Auth complete, the organization named at onboarding is still owed — reached by the registration pipeline AND, since #1091, by a login of an account that owes one
     FAILED = "FAILED",// Authentication failed
     EXPIRED = "EXPIRED",// Session expired
     LOCKED = "LOCKED"
 }
 /** W4.2: Session purpose — drives UI rendering and valid state transitions. */
 export declare const AuthSessionPurposeSchema: z.ZodEnum<typeof AuthSessionPurpose>;
+/**
+ * #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the
+ * session it was parked on when the account still owed its organization at onboarding.
+ *
+ * A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked
+ * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object
+ * that completion could only record a generic login, losing which provider and connection proved the identity
+ * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).
+ * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated
+ * methods are OIDC).
+ */
+export declare const FederatedSignInEvidenceSchema: z.ZodObject<{
+    providerRef: z.ZodString;
+    connectionType: z.ZodEnum<typeof SsoConnectionType>;
+    scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
+    assurance: z.ZodOptional<z.ZodObject<{
+        decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+        reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+        enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type FederatedSignInEvidence = z.infer<typeof FederatedSignInEvidenceSchema>;
 /**
  * Authentication Session Schema
  * Tracks the complete state of an authentication session
@@ -581,8 +652,22 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
     nextStep: z.ZodOptional<z.ZodEnum<typeof AuthNextStep>>;
     mfaGraceExpiresAt: z.ZodOptional<z.ZodString>;
     pendingOrgType: z.ZodOptional<z.ZodString>;
+    pendingObligations: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof OnboardingObligation>>>;
+    federatedSignIn: z.ZodOptional<z.ZodObject<{
+        providerRef: z.ZodString;
+        connectionType: z.ZodEnum<typeof SsoConnectionType>;
+        scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+        organizationId: z.ZodOptional<z.ZodString>;
+        applicationId: z.ZodOptional<z.ZodString>;
+        assurance: z.ZodOptional<z.ZodObject<{
+            decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+            reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+            enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     availableEnrollmentMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
     completedFactors: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+    passkeyUserVerified: z.ZodOptional<z.ZodBoolean>;
     currentFactor: z.ZodOptional<z.ZodEnum<typeof AuthFactorLevel>>;
     availableFirstFactorMethods: z.ZodDefault<z.ZodArray<z.ZodObject<{
         method: z.ZodEnum<typeof AuthMethod>;
@@ -590,7 +675,8 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -613,7 +699,8 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -659,6 +746,15 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
  * Identify step form DTO — user enters email to discover auth methods.
  * Used by the public auth page's first step.
  */
+/**
+ * The sign-in identification form.
+ *
+ * The email field renders `autocomplete="username webauthn"`: `webauthn` is what lets the browser offer
+ * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can
+ * sign in by picking an account instead of typing an email and choosing a method.
+ *
+ * spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete="username webauthn"`: "Include both `username` and `webauthn` as space-separated values."
+ */
 export declare const AuthIdentifyFormDtoSchema: z.ZodObject<{
     email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
 }, z.core.$strip>;
@@ -713,6 +809,22 @@ export declare const PhoneEnrollmentVerifyFormDtoSchema: z.ZodObject<{
 export declare const TotpEnrollmentVerifyFormDtoSchema: z.ZodObject<{
     code: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization
+ * onboarding instead of signing it in (#1103).
+ *
+ * An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an
+ * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming
+ * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access
+ * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict
+ * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that
+ * shape would make every receiver narrow for a case only the SaaS frontend meets.
+ */
+export declare const TokenExchangeOrganizationOnboardingResponseSchema: z.ZodObject<{
+    nextStep: z.ZodLiteral<AuthNextStep.ONBOARDING>;
+    sessionId: z.ZodString;
+}, z.core.$strict>;
+export type TokenExchangeOrganizationOnboardingResponse = z.infer<typeof TokenExchangeOrganizationOnboardingResponseSchema>;
 /**
  * One-off session token exchange response.
  *

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,~~EAEd~~,MAAM,iCAAiC,CAAC;~~AAEzC~~,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBA8B3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,uBAAuB~~;;;;;;;;iBAKlC~~,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B~~;;;iBAGrC~~,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6CvC~~,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,~~uDAAuD~~;~~IACtG~~,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,~~kDAAkD~~;~~IAGjG~~,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+FtC~~,CAAC;AAWH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}
1	+ {"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8B3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAIlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;iBAWrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsDvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,oBAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,YAAY,iBAAiB;IAC7B,wFAAwF;IACxF,aAAa,kBAAkB;CAChC;AAED,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,0GAA0G;IACzJ,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,oKAAoK;IAGnN,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6ItC,CAAC;AAWH;;;GAGG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iDAAiD;;;kBAG5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}