@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/runtime/execution-context.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.shared.schemas.js","sourceRoot":"","sources":["../../../../src/runtime/execution-context.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,8BA4BX;AA5BD,WAAY,8BAA8B;IACtC;;;;;;;OAOG;IACH,+EAA6C,CAAA;IAC7C;;;;;OAKG;IACH,6EAA2C,CAAA;IAC3C,+DAA6B,CAAA;IAC7B,uEAAqC,CAAA;IACrC,+FAA6D,CAAA;IAC7D,uEAAqC,CAAA;IACrC;;;;OAIG;IACH,uEAAqC,CAAA;IACrC,yEAAuC,CAAA;AAC3C,CAAC,EA5BW,8BAA8B,KAA9B,8BAA8B,QA4BzC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iBASX;AATD,WAAY,iBAAiB;IACzB,oFAAoF;IACpF,wCAAmB,CAAA;IACnB;;;;OAIG;IACH,kDAA6B,CAAA;AACjC,CAAC,EATW,iBAAiB,KAAjB,iBAAiB,QAS5B;AAED,MAAM,CAAN,IAAY,uCAKX;AALD,WAAY,uCAAuC;IAC/C,wEAA6B,CAAA;IAC7B,gFAAqC,CAAA;IACrC,gFAAqC,CAAA;IACrC,kFAAuC,CAAA;AAC3C,CAAC,EALW,uCAAuC,KAAvC,uCAAuC,QAKlD;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,wCAAyB,CAAA;IACzB,kCAAmB,CAAA;AACrB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAEC;;GAEG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACrC,sFAAsF;IACtF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;OAIG;IACH,iBAAiB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;IACtE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAML;;GAEG;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,kDAAkD;IAC9E,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIL;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAmC;IAC5E,OAAO,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,cAAgE;IAC1G,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,cAAgE;IAEhE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,QAAQ,EAA0E,EAAE,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC;SACvI,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAGD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,sDAAsD;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { ResourcePrimaryScope } from \"../resources/resources.shared.schemas\";\n\n/**\n * Execution type enum defining how the execution context was initiated.\n *\n * Design rule: an execution type is a PRINCIPAL CATEGORY, never an auth method. A\n * human authenticates via many methods (password, SSO, SAML, WebAuthn, OAuth-social,\n * OIDC authorization-code) but is always one `USER_REQUEST`. Machines follow the same\n * discipline: an organization/application MACHINE principal is authenticated by EITHER\n * a static API key OR an OAuth 2.0 client-credentials flow — the credential type is\n * recorded on `initiatorIds.machineCredential`, it is NOT its own execution type.\n */\nexport enum ExecutionContext_ExecutionType {\n    /**\n     * An organization-scoped MACHINE principal (non-human). Authenticated by EITHER a\n     * static organization API key (`sk_org_…`) OR an OAuth 2.0 client-credentials flow\n     * for an organization OAuth client (`oc_org_…`, direct secret or exchanged token).\n     * Carries `organizationId` + roles; never a `userId`, so `authorizeUserSelf` and\n     * user-FK paths fail closed for it by design. The specific credential is recorded on\n     * `initiatorIds.machineCredential` for audit.\n     */\n    ORGANIZATION_MACHINE = 'organization_machine',\n    /**\n     * An application-scoped MACHINE principal — the APPLICATION-scope peer of\n     * `ORGANIZATION_MACHINE`. Authenticated by an app API key (`sk_app_…`) OR an OAuth\n     * client-credentials flow for an application OAuth client (`oc_app_…`). Carries\n     * `applicationId` + roles; never a `userId`.\n     */\n    APPLICATION_MACHINE = 'application_machine',\n    USER_REQUEST = 'user_request',\n    CONSUMABLE_TOKEN = 'consumable_token',\n    INTERNALLY_INITIATED_REQUEST = 'internally_initiated_request',\n    PUBLIC_EXECUTION = 'public_execution',\n    /**\n     * Execution triggered by an external webhook callback (e.g., Stripe, Google).\n     * Carries resolved scope identifiers (organizationId, userId, etc.) but no authentication credentials.\n     * Created by WebhookHandlerBackendService after signature verification + scope resolution.\n     */\n    WEBHOOK_CALLBACK = 'webhook_callback',\n    ANONYMOUS_SESSION = 'anonymous_session',\n}\n\n/**\n * How a MACHINE principal ({@link ExecutionContext_ExecutionType.ORGANIZATION_MACHINE} /\n * {@link ExecutionContext_ExecutionType.APPLICATION_MACHINE}) authenticated. This is\n * credential PROVENANCE (for audit), NOT a principal distinction — both methods resolve\n * to the same per-scope machine principal.\n */\nexport enum MachineAuthMethod {\n    /** A static, long-lived API key (`sk_org_…` / `sk_app_…`) presented per-request. */\n    API_KEY = 'api_key',\n    /**\n     * A registered OAuth 2.0 client (`oc_org_…` / `oc_app_…`) acting as itself\n     * (client-credentials), presented either as a direct secret or an exchanged\n     * audience-bound bearer token.\n     */\n    OAUTH_CLIENT = 'oauth_client',\n}\n\nexport enum ExecutionContext_ExecutionType_Frontend {\n    USER_REQUEST = 'user_request',\n    CONSUMABLE_TOKEN = 'consumable_token',\n    PUBLIC_EXECUTION = 'public_execution',\n    ANONYMOUS_SESSION = 'anonymous_session',\n}\n\n/**\n * W7.3b: Session type — shared across JWT claims, backend EC, and frontend AuthState.\n */\nexport enum SessionType {\n  PERSISTENT = 'PERSISTENT',\n  ONE_OFF = 'ONE_OFF',\n}\n\n  /**\n   * Initiator IDs structure for non-internal and non-public executions\n   */\n  /**\n   * Credential provenance for a MACHINE principal — WHICH credential authenticated and\n   * of WHAT type. Replaces the former `organizationApiKeyId` / `applicationApiKeyId` /\n   * `m2mClientId` triple: those forked one concept (\"which machine credential\") into\n   * three auth-method-specific fields. The principal's SCOPE lives on `organizationId` /\n   * `applicationId` (as for any principal); this records only the credential, for audit\n   * and attribution (e.g. a File's `uploadedBy`). Only populated for\n   * `ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`.\n   */\n  export const ExecutionContext_MachineCredentialSchema = z.object({\n    /** Whether authentication used a static API key or an OAuth client. */\n    authMethod: z.enum(MachineAuthMethod),\n    /** The authenticating credential's `_id` (the ApiKey row, or the OAuthClient row). */\n    credentialId: z.string(),\n  });\n\n  export type ExecutionContext_MachineCredential = z.infer<typeof ExecutionContext_MachineCredentialSchema>;\n\n  export const ExecutionContext_InitiatorIdsSchema = z.object({\n    organizationId: z.string().optional(),\n    userId: z.string().optional(),\n    applicationId: z.string().optional(),\n    /**\n     * Credential provenance for a machine principal (see\n     * {@link ExecutionContext_MachineCredentialSchema}). Absent for human / anonymous /\n     * webhook / internal principals.\n     */\n    machineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n    consumableTokenId: z.string().optional(),\n    /**\n     * Provider reference that triggered the webhook (e.g., 'stripe', 'google').\n     * Only populated for WEBHOOK_CALLBACK execution type.\n     */\n    webhookProviderId: z.string().optional(),\n    anonymousUserId: z.string().optional(),\n  });\n\n  export type ExecutionContext_InitiatorIds = z.infer<typeof ExecutionContext_InitiatorIdsSchema>;\n\n\n\n/**\n * Role information with related scope and resource context\n */\n\n\nexport const ExecutionContext_RoleInfoSchema = z.object({\n    roles: z.array(z.string()), // Will be validated against Roles type at runtime\n    relatedPrimaryScope: z.enum(ResourcePrimaryScope),\n    relatedResourceId: z.string().optional(),\n    /**\n     * Present ⇒ these roles are held ONLY inside one organization unit, not across the organization.\n     *\n     * Organization units are a NARROWING dimension within `ResourcePrimaryScope.ORGANIZATIONS`, not a\n     * primary scope of their own (plan decision D-C1): a unit is owned BY an organization, so it is\n     * not an ownership root, and adding a fifth scope would fracture the tenant boundary every\n     * exhaustive switch currently relies on.\n     *\n     * ⚠️ **A unit-scoped entry must NEVER be read as organization-wide authority.** Absolutely every\n     * consumer that unions `initiatorRoles` has to partition on this field first — otherwise\n     * \"ORG_MANAGER of Sales\" silently becomes \"ORG_MANAGER of the whole tenant\", which is a\n     * privilege escalation, not a convenience. Use {@link isOrganizationWideRoleInfo} /\n     * {@link selectOrganizationWideRoles} rather than testing this property by hand, so the rule has\n     * exactly one definition.\n     */\n    organizationUnitId: z.string().optional(),\n  });\n\nexport type ExecutionContext_RoleInfo = z.infer<typeof ExecutionContext_RoleInfoSchema>;\n\n/**\n * Does this entry confer authority across the WHOLE owning scope?\n *\n * `false` for a unit-scoped grant, which is only meaningful for resources that opted into unit\n * narrowing (D-C3) and must be ignored entirely by anything asking an organization-wide question.\n *\n * This is the single definition of that rule. Consumers call it instead of writing\n * `!roleInfo.organizationUnitId` inline, so a future narrowing dimension extends one function rather\n * than needing every call site to be rediscovered — the class of miss that made the per-unit `role`\n * field inert-but-dangerous in the first place.\n */\nexport function isOrganizationWideRoleInfo(roleInfo: ExecutionContext_RoleInfo): boolean {\n  return roleInfo.organizationUnitId === undefined;\n}\n\n/**\n * The roles a principal holds across the whole scope, with every narrowed grant removed.\n *\n * The safe default for any \"does this caller hold role X?\" question. Reach past it only where the\n * question is explicitly unit-aware.\n */\nexport function selectOrganizationWideRoles(initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined): string[] {\n  return (initiatorRoles ?? []).filter(isOrganizationWideRoleInfo).flatMap((roleInfo) => roleInfo.roles);\n}\n\n/**\n * The unit-scoped grants a principal holds, as `(organizationUnitId, roles)` pairs.\n *\n * The complement of {@link selectOrganizationWideRoles} — the input to unit narrowing in\n * `buildContextualFilter` and to inheritance traversal.\n */\nexport function selectUnitScopedRoleGrants(\n  initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined,\n): { organizationUnitId: string; roles: string[] }[] {\n  return (initiatorRoles ?? [])\n    .filter((roleInfo): roleInfo is ExecutionContext_RoleInfo & { organizationUnitId: string } => roleInfo.organizationUnitId !== undefined)\n    .map((roleInfo) => ({ organizationUnitId: roleInfo.organizationUnitId, roles: roleInfo.roles }));\n}\n\n\n/**\n * Tracks the relationship path used to access a resource.\n * Captures FK relationship fields for authorization and filtering.\n *\n * Example: When accessing /assigned-to-users/{userId}/todos:\n * - resourceType: \"USERS\"\n * - relationshipField: \"assignedToUserId\" (the FK field on TODOS)\n * - resourceId: the userId value from the URL\n *\n * For standard parent relationships (no FK field):\n * - resourceType: \"ORGANIZATIONS\"\n * - relationshipField: undefined (uses default field identifier)\n * - resourceId: the organizationId value\n */\nexport const ExecutionContext_RelationshipContextSchema = z.object({\n  /** The parent/related resource type (e.g., \"USERS\", \"ORGANIZATIONS\") */\n  resourceType: z.string(),\n  /**\n   * The FK field name if via FK relationship (e.g., 'assignedToUserId').\n   * undefined for standard parent relationships.\n   */\n  relationshipField: z.string().optional(),\n  /** The ID value from the URL for this relationship */\n  resourceId: z.string(),\n  /**\n   * Scope-via-junction tag (scope-required reference search). When set (e.g. on\n   * the `organizationId` param of `/organizations/{id}/users/search`), the\n   * backend scopes this (target) resource's SEARCH/LIST through the named\n   * junction rather than via a column it owns, and authorizes by the anchor\n   * scope's membership. Propagated from the URL param. Absent on normal params.\n   */\n  scopeViaJunction: z.string().optional(),\n});\n\nexport type ExecutionContext_RelationshipContext = z.infer<typeof ExecutionContext_RelationshipContextSchema>;\n"]}
+{"version":3,"file":"execution-context.shared.schemas.js","sourceRoot":"","sources":["../../../../src/runtime/execution-context.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAExG;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,8BA2CX;AA3CD,WAAY,8BAA8B;IACtC;;;;;;;OAOG;IACH,+EAA6C,CAAA;IAC7C;;;;;OAKG;IACH,6EAA2C,CAAA;IAC3C,+DAA6B,CAAA;IAC7B,uEAAqC,CAAA;IACrC,+FAA6D,CAAA;IAC7D,uEAAqC,CAAA;IACrC;;;;OAIG;IACH,uEAAqC,CAAA;IACrC,yEAAuC,CAAA;IACvC;;;;;;;;;;;;;OAaG;IACH,uEAAqC,CAAA;AACzC,CAAC,EA3CW,8BAA8B,KAA9B,8BAA8B,QA2CzC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iBASX;AATD,WAAY,iBAAiB;IACzB,oFAAoF;IACpF,wCAAmB,CAAA;IACnB;;;;OAIG;IACH,kDAA6B,CAAA;AACjC,CAAC,EATW,iBAAiB,KAAjB,iBAAiB,QAS5B;AAED,MAAM,CAAN,IAAY,uCAKX;AALD,WAAY,uCAAuC;IAC/C,wEAA6B,CAAA;IAC7B,gFAAqC,CAAA;IACrC,gFAAqC,CAAA;IACrC,kFAAuC,CAAA;AAC3C,CAAC,EALW,uCAAuC,KAAvC,uCAAuC,QAKlD;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,wCAAyB,CAAA;IACzB,kCAAmB,CAAA;AACrB,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAEC;;GAEG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,+FAA+F,CAAC;IAC/I,sFAAsF;IACtF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;CAC7E,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAC1G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAClF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACzF;;;;OAIG;IACH,iBAAiB,EAAE,wCAAwC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qFAAqF,CAAC;IACtK,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IAC/I;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IAC3H,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;IACjH;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAC5G,8GAA8G;IAC9G,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC3G;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sIAAsI,CAAC;IAC1L;;;;;;;;;;OAUG;IACH,aAAa,EAAE,CAAC;SACb,YAAY,CAAC;QACZ,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QAChG,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,+CAA+C,CAAC;KACpG,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CAAC,+IAA+I,CAAC;CAC7J,CAAC,CAAC;AAML;;GAEG;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,kDAAkD;IAC9E,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;;;;;;OASG;IACH,gCAAgC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvD,iGAAiG;IACjG,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAIL;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAmC;IAC5E,OAAO,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,cAAgE;IAC1G,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAgE,EAChE,cAAkC;IAElC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChD,QAAQ,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa;WAChE,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,cAAgE;IAEhE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,QAAQ,EAA0E,EAAE,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC;SACvI,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAGD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,sDAAsD;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { ResourcePrimaryScope } from \"../resources/resources.shared.schemas\";\nimport { InboundChannelKind, InboundSenderAssurance } from \"../inbound/inbound-channels.shared.schemas\";\n\n/**\n * Execution type enum defining how the execution context was initiated.\n *\n * Design rule: an execution type is a PRINCIPAL CATEGORY, never an auth method. A\n * human authenticates via many methods (password, SSO, SAML, WebAuthn, OAuth-social,\n * OIDC authorization-code) but is always one `USER_REQUEST`. Machines follow the same\n * discipline: an organization/application MACHINE principal is authenticated by EITHER\n * a static API key OR an OAuth 2.0 client-credentials flow — the credential type is\n * recorded on `initiatorIds.machineCredential`, it is NOT its own execution type.\n */\nexport enum ExecutionContext_ExecutionType {\n    /**\n     * An organization-scoped MACHINE principal (non-human). Authenticated by EITHER a\n     * static organization API key (`sk_org_…`) OR an OAuth 2.0 client-credentials flow\n     * for an organization OAuth client (`oc_org_…`, direct secret or exchanged token).\n     * Carries `organizationId` + roles; never a `userId`, so `authorizeUserSelf` and\n     * user-FK paths fail closed for it by design. The specific credential is recorded on\n     * `initiatorIds.machineCredential` for audit.\n     */\n    ORGANIZATION_MACHINE = 'organization_machine',\n    /**\n     * An application-scoped MACHINE principal — the APPLICATION-scope peer of\n     * `ORGANIZATION_MACHINE`. Authenticated by an app API key (`sk_app_…`) OR an OAuth\n     * client-credentials flow for an application OAuth client (`oc_app_…`). Carries\n     * `applicationId` + roles; never a `userId`.\n     */\n    APPLICATION_MACHINE = 'application_machine',\n    USER_REQUEST = 'user_request',\n    CONSUMABLE_TOKEN = 'consumable_token',\n    INTERNALLY_INITIATED_REQUEST = 'internally_initiated_request',\n    PUBLIC_EXECUTION = 'public_execution',\n    /**\n     * Execution triggered by an external webhook callback (e.g., Stripe, Google).\n     * Carries resolved scope identifiers (organizationId, userId, etc.) but no authentication credentials.\n     * Created by WebhookHandlerBackendService after signature verification + scope resolution.\n     */\n    WEBHOOK_CALLBACK = 'webhook_callback',\n    ANONYMOUS_SESSION = 'anonymous_session',\n    /**\n     * An application-declared inbound HANDLER running one verified, durably stored delivery (#1596).\n     *\n     * Unlike `WEBHOOK_CALLBACK`, this is an AUTHORIZED principal: it carries the handler's declared\n     * `actingRoles` as its roles, is pinned to the one scope the delivery resolved to, and goes through\n     * role authorization, organization-unit narrowing, scope-root confinement and cross-tenant read\n     * observation exactly like a user. `WEBHOOK_CALLBACK` skips all four because signature verification\n     * is its whole trust story; application code must never inherit that, or a handler would be\n     * role-free and cross-tenant.\n     *\n     * `initiatorIds` is REQUIRED and names the delivery (`inboundDeliveryId`) and the handler\n     * (`inboundHandlerRef`); it never carries a user or a machine credential — nobody authenticated, a\n     * sender's signature was verified.\n     */\n    INBOUND_DELIVERY = 'inbound_delivery',\n}\n\n/**\n * How a MACHINE principal ({@link ExecutionContext_ExecutionType.ORGANIZATION_MACHINE} /\n * {@link ExecutionContext_ExecutionType.APPLICATION_MACHINE}) authenticated. This is\n * credential PROVENANCE (for audit), NOT a principal distinction — both methods resolve\n * to the same per-scope machine principal.\n */\nexport enum MachineAuthMethod {\n    /** A static, long-lived API key (`sk_org_…` / `sk_app_…`) presented per-request. */\n    API_KEY = 'api_key',\n    /**\n     * A registered OAuth 2.0 client (`oc_org_…` / `oc_app_…`) acting as itself\n     * (client-credentials), presented either as a direct secret or an exchanged\n     * audience-bound bearer token.\n     */\n    OAUTH_CLIENT = 'oauth_client',\n}\n\nexport enum ExecutionContext_ExecutionType_Frontend {\n    USER_REQUEST = 'user_request',\n    CONSUMABLE_TOKEN = 'consumable_token',\n    PUBLIC_EXECUTION = 'public_execution',\n    ANONYMOUS_SESSION = 'anonymous_session',\n}\n\n/**\n * W7.3b: Session type — shared across JWT claims, backend EC, and frontend AuthState.\n */\nexport enum SessionType {\n  PERSISTENT = 'PERSISTENT',\n  ONE_OFF = 'ONE_OFF',\n}\n\n  /**\n   * Initiator IDs structure for non-internal and non-public executions\n   */\n  /**\n   * Credential provenance for a MACHINE principal — WHICH credential authenticated and\n   * of WHAT type. Replaces the former `organizationApiKeyId` / `applicationApiKeyId` /\n   * `m2mClientId` triple: those forked one concept (\"which machine credential\") into\n   * three auth-method-specific fields. The principal's SCOPE lives on `organizationId` /\n   * `applicationId` (as for any principal); this records only the credential, for audit\n   * and attribution (e.g. a File's `uploadedBy`). Only populated for\n   * `ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`.\n   */\n  export const ExecutionContext_MachineCredentialSchema = z.object({\n    /** Whether authentication used a static API key or an OAuth client. */\n    authMethod: z.enum(MachineAuthMethod).describe(\"The kind of machine credential: `api_key` for an API key, `oauth_client` for an OAuth client.\"),\n    /** The authenticating credential's `_id` (the ApiKey row, or the OAuthClient row). */\n    credentialId: z.string().describe(\"The id of that API key or OAuth client.\"),\n  });\n\n  export type ExecutionContext_MachineCredential = z.infer<typeof ExecutionContext_MachineCredentialSchema>;\n\n  export const ExecutionContext_InitiatorIdsSchema = z.object({\n    organizationId: z.string().optional().describe(\"The organization the request ran in, when it ran in one.\"),\n    userId: z.string().optional().describe(\"The signed-in user who made the request.\"),\n    applicationId: z.string().optional().describe(\"The application the request was made to.\"),\n    /**\n     * Credential provenance for a machine principal (see\n     * {@link ExecutionContext_MachineCredentialSchema}). Absent for human / anonymous /\n     * webhook / internal principals.\n     */\n    machineCredential: ExecutionContext_MachineCredentialSchema.optional().describe(\"The API key or OAuth client that authenticated the request, when a machine made it.\"),\n    consumableTokenId: z.string().optional().describe(\"The one-time token the request was authorized by, such as an invitation or a sign-in link.\"),\n    /**\n     * Provider reference that triggered the webhook (e.g., 'stripe', 'google').\n     * Only populated for WEBHOOK_CALLBACK execution type.\n     */\n    webhookProviderId: z.string().optional().describe(\"The provider whose webhook call started the request, such as `stripe`.\"),\n    anonymousUserId: z.string().optional().describe(\"The anonymous visitor who made the request, before signing in.\"),\n    /**\n     * The stored inbound delivery this execution runs (its `_id`). Only populated for\n     * `INBOUND_DELIVERY`, where it is required — it is what the audit trail names as the source of\n     * every write the handler makes.\n     */\n    inboundDeliveryId: z.string().optional().describe(\"The stored inbound delivery the request was processing.\"),\n    /** The declared handler running the delivery. Only populated for `INBOUND_DELIVERY`, where it is required. */\n    inboundHandlerRef: z.string().optional().describe(\"The handler that was processing that inbound delivery.\"),\n    /**\n     * The person a USER-scope inbound delivery belongs to (#1629) — its SCOPE, never its identity.\n     *\n     * Deliberately not `userId`: `userId` means somebody authenticated as that person, which no inbound\n     * delivery ever did (a sender's signature was verified). Keeping the two apart is what lets the\n     * constructor keep refusing an authenticated identity on `INBOUND_DELIVERY` while personal-scope\n     * resources are still confined to one person: the ownership check reads this field for an inbound\n     * principal, and the repository's scope filter reads the same id from the context map.\n     *\n     * Only populated for a USER-scope `INBOUND_DELIVERY`.\n     */\n    inboundScopeUserId: z.string().optional().describe(\"The person a user-scoped inbound delivery belongs to. It scopes the records the delivery may reach; nobody signed in as that person.\"),\n    /**\n     * Who sent the message an `INBOUND_DELIVERY` runs, as IDENTIFICATION only (#1630, I8): the channel and\n     * how well the sender is known. It never grants anything — no authorization decision reads it, and the\n     * roles stay the handler's declared `actingRoles`.\n     *\n     * The address is deliberately NOT carried. A context is serialized into job payloads and trace\n     * attributes, where an address would outlive its erasure; the address lives on the conversation\n     * message, which the erasure writer can reach.\n     *\n     * Only populated for `INBOUND_DELIVERY`.\n     */\n    inboundSender: z\n      .strictObject({\n        channel: z.enum(InboundChannelKind).describe(\"The channel the inbound message arrived through.\"),\n        assurance: z.enum(InboundSenderAssurance).describe(\"How well the sender is known on that channel.\"),\n      })\n      .optional()\n      .describe(\"Who sent the inbound message the request was processing, as identification only: it grants nothing, and the sender's address is not included.\"),\n  });\n\n  export type ExecutionContext_InitiatorIds = z.infer<typeof ExecutionContext_InitiatorIdsSchema>;\n\n\n\n/**\n * Role information with related scope and resource context\n */\n\n\nexport const ExecutionContext_RoleInfoSchema = z.object({\n    roles: z.array(z.string()), // Will be validated against Roles type at runtime\n    relatedPrimaryScope: z.enum(ResourcePrimaryScope),\n    relatedResourceId: z.string().optional(),\n    /**\n     * Present ⇒ these roles are held ONLY inside one organization unit, not across the organization.\n     *\n     * Organization units are a NARROWING dimension within `ResourcePrimaryScope.ORGANIZATIONS`, not a\n     * primary scope of their own (plan decision D-C1): a unit is owned BY an organization, so it is\n     * not an ownership root, and adding a fifth scope would fracture the tenant boundary every\n     * exhaustive switch currently relies on.\n     *\n     * ⚠️ **A unit-scoped entry must NEVER be read as organization-wide authority.** Absolutely every\n     * consumer that unions `initiatorRoles` has to partition on this field first — otherwise\n     * \"ORG_MANAGER of Sales\" silently becomes \"ORG_MANAGER of the whole tenant\", which is a\n     * privilege escalation, not a convenience. Use {@link isOrganizationWideRoleInfo} /\n     * {@link selectOrganizationWideRoles} rather than testing this property by hand, so the rule has\n     * exactly one definition.\n     */\n    organizationUnitId: z.string().optional(),\n    /**\n     * Present ⇒ this entry was conferred by a live service-provider relationship (#1597): the caller is\n     * a firm's expert (or an admitted firm machine client) acting inside a CLIENT organization.\n     *\n     * ⚠️ AUDIT ATTRIBUTION ONLY. No authority decision may read it — the entry's authority is fully\n     * expressed by `roles`, `relatedResourceId` and `organizationUnitId`, exactly like any other entry.\n     * It exists so an audit row written by a provider principal can name the relationship and the firm,\n     * which is what lets the client read \"who from which firm did this, under which relationship\" from\n     * its own trail. A system context derived from a request must not inherit it.\n     */\n    viaServiceProviderRelationshipId: z.string().optional(),\n    /** The firm behind {@link viaServiceProviderRelationshipId}. Audit attribution only, like it. */\n    viaProviderOrganizationId: z.string().optional(),\n  });\n\nexport type ExecutionContext_RoleInfo = z.infer<typeof ExecutionContext_RoleInfoSchema>;\n\n/**\n * Does this entry confer authority across the WHOLE owning scope?\n *\n * `false` for a unit-scoped grant, which is only meaningful for resources that opted into unit\n * narrowing (D-C3) and must be ignored entirely by anything asking an organization-wide question.\n *\n * This is the single definition of that rule. Consumers call it instead of writing\n * `!roleInfo.organizationUnitId` inline, so a future narrowing dimension extends one function rather\n * than needing every call site to be rediscovered — the class of miss that made the per-unit `role`\n * field inert-but-dangerous in the first place.\n */\nexport function isOrganizationWideRoleInfo(roleInfo: ExecutionContext_RoleInfo): boolean {\n  return roleInfo.organizationUnitId === undefined;\n}\n\n/**\n * The roles a principal holds across the whole scope, with every narrowed grant removed.\n *\n * The safe default for any \"does this caller hold role X?\" question. Reach past it only where the\n * question is explicitly unit-aware.\n */\nexport function selectOrganizationWideRoles(initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined): string[] {\n  return (initiatorRoles ?? []).filter(isOrganizationWideRoleInfo).flatMap((roleInfo) => roleInfo.roles);\n}\n\n/**\n * The role entries that may speak for a request acting inside ONE organization.\n *\n * Every entry that is not ORGANIZATIONS-scoped (the APPLICATION role set, chiefly) is kept: those\n * roles are not held \"in\" a tenant, and they resolve against their own role table. An\n * ORGANIZATIONS-scoped entry is kept only when it names `organizationId` — organization-wide and\n * unit-scoped entries alike, so a caller partitions on {@link isOrganizationWideRoleInfo} AFTER this.\n *\n * ## Why this exists — measured 2026-09-25\n *\n * The per-instance role gate, the unit-narrowing decision and the role ceiling each unioned\n * organization-wide entries across EVERY organization the caller belongs to, and answered the tenant\n * question separately (\"does the caller hold ANY org-wide entry for this row's organization?\"). The\n * two answers composed into \"ORG_ADMIN somewhere + ORG_GUEST here = ORG_ADMIN here\": an ORG_ADMIN of\n * tenant A who was a guest of tenant B passed every ORG_ADMIN per-instance verb on B's rows, and could\n * grant ORG_ADMIN in B through the role ceiling. A role is a fact about a membership, so it is only\n * ever evaluated inside the organization that membership belongs to.\n *\n * An absent `organizationId` keeps no ORGANIZATIONS entry at all — fail closed: a request that names\n * no tenant has no tenant role to speak for it.\n */\nexport function selectRoleInfosActingInOrganization(\n  initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined,\n  organizationId: string | undefined,\n): ExecutionContext_RoleInfo[] {\n  return (initiatorRoles ?? []).filter((roleInfo) =>\n    roleInfo.relatedPrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS\n    || (Boolean(organizationId) && String(roleInfo.relatedResourceId ?? '') === organizationId));\n}\n\n/**\n * The unit-scoped grants a principal holds, as `(organizationUnitId, roles)` pairs.\n *\n * The complement of {@link selectOrganizationWideRoles} — the input to unit narrowing in\n * `buildContextualFilter` and to inheritance traversal.\n */\nexport function selectUnitScopedRoleGrants(\n  initiatorRoles: readonly ExecutionContext_RoleInfo[] | undefined,\n): { organizationUnitId: string; roles: string[] }[] {\n  return (initiatorRoles ?? [])\n    .filter((roleInfo): roleInfo is ExecutionContext_RoleInfo & { organizationUnitId: string } => roleInfo.organizationUnitId !== undefined)\n    .map((roleInfo) => ({ organizationUnitId: roleInfo.organizationUnitId, roles: roleInfo.roles }));\n}\n\n\n/**\n * Tracks the relationship path used to access a resource.\n * Captures FK relationship fields for authorization and filtering.\n *\n * Example: When accessing /assigned-to-users/{userId}/todos:\n * - resourceType: \"USERS\"\n * - relationshipField: \"assignedToUserId\" (the FK field on TODOS)\n * - resourceId: the userId value from the URL\n *\n * For standard parent relationships (no FK field):\n * - resourceType: \"ORGANIZATIONS\"\n * - relationshipField: undefined (uses default field identifier)\n * - resourceId: the organizationId value\n */\nexport const ExecutionContext_RelationshipContextSchema = z.object({\n  /** The parent/related resource type (e.g., \"USERS\", \"ORGANIZATIONS\") */\n  resourceType: z.string(),\n  /**\n   * The FK field name if via FK relationship (e.g., 'assignedToUserId').\n   * undefined for standard parent relationships.\n   */\n  relationshipField: z.string().optional(),\n  /** The ID value from the URL for this relationship */\n  resourceId: z.string(),\n  /**\n   * Scope-via-junction tag (scope-required reference search). When set (e.g. on\n   * the `organizationId` param of `/organizations/{id}/users/search`), the\n   * backend scopes this (target) resource's SEARCH/LIST through the named\n   * junction rather than via a column it owns, and authorizes by the anchor\n   * scope's membership. Propagated from the URL param. Absent on normal params.\n   */\n  scopeViaJunction: z.string().optional(),\n});\n\nexport type ExecutionContext_RelationshipContext = z.infer<typeof ExecutionContext_RelationshipContextSchema>;\n"]}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts

@@ -26,6 +26,7 @@ export declare const appApiKeysResourceConfiguration_InitializationFactory: (res
     roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAyTlH,CAAC"}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EAEb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoF,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAOlK,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAkBxE,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;kBA0UlH,CAAC"}

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js

@@ -5,19 +5,22 @@
  * Handles creation, management, rotation, and monitoring of API keys within applications.
  */
 import { z } from 'zod';
-import { ApiKeyApplicationSchema, ApiKeyStatus } from './api-keys.shared.schemas.js';
+import { ApiKeyApplicationSchema, ApiKeyStatus, ApiKeyUsageStatisticsResponseSchema, } from './api-keys.shared.schemas.js';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel } from '../../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../../resources/resources.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas.js';
 import { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas.js';
 // Sort and filter fields for application API keys
 // App Admin gets enhanced filter fields with additional capabilities
 const APP_API_KEYS_ADMIN_FILTER_FIELDS = {
     status: z.enum(ApiKeyStatus),
-    hasExpiration: z.boolean(),
+    // "Has an expiry", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database
+    // as a field no row has, and matched nothing (#1806); the presence filter carries its target.
+    hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),
     lastUsedAt: z.date(), // Admin can filter by last usage
     expiresAt: z.date(), // Admin can filter by expiration
 };
@@ -101,7 +104,7 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     // requestDto auto-derived from decorators
                     customResponseDto: ApiKeyApplicationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral()
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.")
                     }),
                 }
             ],
@@ -134,6 +137,9 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's
                     // invalidation at the requested boundary (default: now) and returns the replacement in
                     // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still
@@ -150,12 +156,12 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     requiresStepUpAuthentication: true,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
-                        oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                        oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe("When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.")
                     }),
                     customResponseDto: ApiKeyApplicationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral(),
-                        oldKeyId: z.string(),
-                        oldKeyInvalidationDate: z.date()
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme."),
+                        oldKeyId: z.string().describe("The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id."),
+                        oldKeyInvalidationDate: z.date().describe("When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.")
                     }),
                 }
             ],
@@ -192,7 +198,7 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     // runs in the CREATE handler only) on a resource with no core UPDATE.
                     requestDto: z.object({}),
                     customResponseDto: ApiKeyApplicationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral(),
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme."),
                     }),
                 }
             ],
@@ -210,6 +216,12 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE
                     // selects the core path that persists; it must NOT also hand the caller UPDATE's
@@ -239,6 +251,12 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // No input: `status` is forced to ACTIVE by the paired prefix implementation.
                     // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.
@@ -279,6 +297,12 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
                     // and the paired prefix implementation forces the status transition itself, so there is no field
@@ -299,9 +323,15 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.LOW,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
-                        newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')
+                        newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe("The key's new expiry time. Only a key that already has an expiry can be extended.")
                     }),
                     enabledCondition: ({ currentObject }) => {
                         return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;
@@ -317,17 +347,7 @@ export const appApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     resourceOperationLike: CoreResourceOperation.READ,
-                    customResponseDto: z.object({
-                        keyId: z.string(),
-                        totalRequests: z.number().min(0),
-                        requestsLastHour: z.number().min(0),
-                        requestsLastDay: z.number().min(0),
-                        requestsLastWeek: z.number().min(0),
-                        lastUsedAt: z.date().optional(),
-                        mostUsedEndpoint: z.string().optional(),
-                        errorRate: z.number().min(0).max(100), // Percentage
-                        rateLimitHits: z.number().min(0)
-                    }),
+                    customResponseDto: ApiKeyUsageStatisticsResponseSchema,
                 }
             ]
         }

package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,YAAY,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,kDAAkD;AAElD,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAEhH,kDAAkD;AAClD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAE1E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,8EAA8E;QAC9E,gFAAgF;QAChF,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,iEAAiE;QACjE,8EAA8E;QAC9E,yEAAyE;QACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application API Keys Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within applications.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyApplicationSchema,\n  ApiKeyStatus\n} from './api-keys.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application API keys\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_API_KEYS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  hasExpiration: z.boolean(),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_API_KEYS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application API keys\nexport enum AppApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype AppApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication API Keys Resource Configuration Factory\n*/\nexport const appApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppApiKeys_Operations,\n  AppApiKeysCoreOperations,\n  typeof ApiKeyApplicationSchema\n>({\n  mainSchema: ApiKeyApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so key rows are physically removed when their owning\n    // application is deleted. Without it the cascade throws ErrorType.CONFIGURATION\n    // on any application that still has API-key rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so API-key rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has key rows. Super-admin/HIGH: the app API-key admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [AppApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller.\n     *\n     * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n     * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n     * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n     * hazard DEACTIVATE documents at length — with no route there is no request contract to\n     * auto-derive and no `PUT .../expire` that could carry `status: active`.\n     *\n     * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n     * direct write would be a second authority over the field and would skip the ACTIVE-only\n     * precondition, which lives in the paired prefix implementation\n     * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n     * `enabledCondition` cannot be.\n     */\n    [AppApiKeys_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n      // No notification: expiry is the scheduled consequence of a date the administrator set, not\n      // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n      // feature and is not this one.\n    },\n\n    [AppApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        }\n      ]\n    }\n  },\n});\n"]}
+{"version":3,"file":"api-keys-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,kDAAkD;AAElD,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,sGAAsG;IACtG,8FAA8F;IAC9F,aAAa,EAAE,mCAAmC,CAAC,WAAW,CAAC;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAEhH,kDAAkD;AAClD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,kDAAkD;IAE1E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,8EAA8E;QAC9E,gFAAgF;QAChF,kDAAkD;QAClD,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,iEAAiE;QACjE,8EAA8E;QAC9E,yEAAyE;QACzE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,+GAA+G;oBAC/G,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;qBAC5T,CAAC;oBACF,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;wBAC/N,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;wBACtI,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC1J,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBAClL,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,mCAAmC;iBACvD;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application API Keys Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within applications.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyApplicationSchema,\n  ApiKeyStatus,\n  ApiKeyUsageStatisticsResponseSchema,\n} from './api-keys.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application API keys\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_API_KEYS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  // \"Has an expiry\", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database\n  // as a field no row has, and matched nothing (#1806); the presence filter carries its target.\n  hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_API_KEYS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application API keys\nexport enum AppApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype AppApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication API Keys Resource Configuration Factory\n*/\nexport const appApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppApiKeys_Operations,\n  AppApiKeysCoreOperations,\n  typeof ApiKeyApplicationSchema\n>({\n  mainSchema: ApiKeyApplicationSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so key rows are physically removed when their owning\n    // application is deleted. Without it the cascade throws ErrorType.CONFIGURATION\n    // on any application that still has API-key rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\")\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so API-key rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has key rows. Super-admin/HIGH: the app API-key admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    [AppApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.\")\n          }),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n            oldKeyId: z.string().describe(\"The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id.\"),\n            oldKeyInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyApplicationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller.\n     *\n     * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n     * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n     * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n     * hazard DEACTIVATE documents at length — with no route there is no request contract to\n     * auto-derive and no `PUT .../expire` that could carry `status: active`.\n     *\n     * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n     * direct write would be a second authority over the field and would skip the ACTIVE-only\n     * precondition, which lives in the paired prefix implementation\n     * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n     * `enabledCondition` cannot be.\n     */\n    [AppApiKeys_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n      // No notification: expiry is the scheduled consequence of a date the administrator set, not\n      // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n      // feature and is not this one.\n    },\n\n    [AppApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe(\"The key's new expiry time. Only a key that already has an expiry can be extended.\")\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        }\n      ]\n    },\n\n    [AppApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: ApiKeyUsageStatisticsResponseSchema,\n        }\n      ]\n    }\n  },\n});\n"]}

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.d.ts

@@ -26,6 +26,7 @@ export declare const orgApiKeysResourceConfiguration_InitializationFactory: (res
     roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoD,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kBAohBlH,CAAC"}
+{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,YAAY,EAEb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoF,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAOlK,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA4BxF,oBAAY,qBAAqB;IAC/B,MAAM,WAAW,CAAE,0CAA0C;IAC7D,UAAU,eAAe,CAAE,gDAAgD;IAC3E,UAAU,eAAe,CAAE,iBAAiB;IAC5C,UAAU,eAAe,CAAE,iBAAiB;IAC5C,aAAa,kBAAkB,CAAE,yBAAyB;IAC1D,MAAM,WAAW,CAAE,6FAA6F;IAChH,WAAW,gBAAgB;CAC5B;AAED,KAAK,wBAAwB,GACzB,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,qDAAqD,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;kBAiiBlH,CAAC"}