@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js

@@ -5,13 +5,14 @@
  * Handles creation, management, rotation, and monitoring of API keys within organizations.
  */
 import { z } from 'zod';
-import { ApiKeyOrganizationSchema, ApiKeyStatus } from './api-keys.shared.schemas.js';
+import { ApiKeyOrganizationSchema, ApiKeyStatus, ApiKeyUsageStatisticsResponseSchema, } from './api-keys.shared.schemas.js';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../../resources/resources.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas.js';
 // Sort and filter fields for organization API keys
 const ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'];
@@ -20,7 +21,9 @@ const ORG_API_KEYS_FILTER_FIELDS = {
     status: z.enum(ApiKeyStatus),
     name: z.string(),
     organizationId: z.string(),
-    hasExpiration: z.boolean(),
+    // "Has an expiry", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database
+    // as a field no row has, and matched nothing (#1806); the presence filter carries its target.
+    hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),
 };
 // App Admin gets enhanced filter fields with additional capabilities
 const ORG_API_KEYS_ADMIN_FILTER_FIELDS = {
@@ -79,7 +82,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 },
                 {
@@ -113,11 +116,11 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     // requestDto auto-derived from decorators
                     customResponseDto: ApiKeyOrganizationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral()
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.")
                     }),
                 },
                 {
@@ -134,7 +137,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     // DOES receive the plaintext so they can relay it to the org. Mirror of
                     // the default variant's `customResponseDto` above — keep in sync.
                     customResponseDto: ApiKeyOrganizationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral()
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.")
                     }),
                 }
             ],
@@ -154,7 +157,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete keys
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     haveBulkOperation: true,
                 },
@@ -183,7 +186,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.
                     // This is what admits it to the danger zone; risk alone no longer does.
@@ -204,12 +207,12 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     requiresStepUpAuthentication: true,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
-                        oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                        oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe("When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.")
                     }),
                     customResponseDto: ApiKeyOrganizationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral(),
-                        oldKeyId: z.string(),
-                        oldKeyInvalidationDate: z.date()
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme."),
+                        oldKeyId: z.string().describe("The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id."),
+                        oldKeyInvalidationDate: z.date().describe("When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.")
                     }),
                 },
                 {
@@ -249,12 +252,12 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     //    so they can relay it to the org.
                     // Keep both in sync with the default variant above.
                     requestDto: z.object({
-                        oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                        oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe("When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.")
                     }),
                     customResponseDto: ApiKeyOrganizationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral(),
-                        oldKeyId: z.string(),
-                        oldKeyInvalidationDate: z.date()
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme."),
+                        oldKeyId: z.string().describe("The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id."),
+                        oldKeyInvalidationDate: z.date().describe("When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.")
                     }),
                 }
             ],
@@ -274,7 +277,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate keys
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its
@@ -295,7 +298,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     // runs in the CREATE handler only) on a resource with no core UPDATE.
                     requestDto: z.object({}),
                     customResponseDto: ApiKeyOrganizationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral(),
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme."),
                     }),
                 },
                 {
@@ -324,7 +327,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     // cross-tenant variant cannot rewrite `roles` through "regenerate" either.
                     requestDto: z.object({}),
                     customResponseDto: ApiKeyOrganizationSchema.extend({
-                        plainKey: z.string().min(1).isEphemeral(),
+                        plainKey: z.string().min(1).isEphemeral().describe("The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme."),
                     }),
                 }
             ],
@@ -340,8 +343,14 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate keys
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE
                     // selects the core path that persists; it must NOT also hand the caller UPDATE's
@@ -362,6 +371,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     variantKey: "admin",
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // Per-variant DTOs are NOT inherited from the default variant — each variant builds
                     // its own, so this cross-tenant variant needs its own narrowing or it re-derives the
@@ -382,8 +392,16 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate keys
+                    // Org admins only. NOT opened to MANAGE_API_KEYS (#1631): re-enabling a key the organization deactivated would let a
+                    // firm undo the organization's own decision about a credential, as member reactivate would for a person.
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // No input: `status` is forced to ACTIVE by the paired prefix implementation.
                     // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.
@@ -398,6 +416,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     variantKey: "admin",
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.
                     requestDto: z.object({}),
@@ -434,6 +453,12 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
                     // and the paired prefix implementation forces the status transition itself, so there is no field
@@ -452,11 +477,17 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can extend expiry
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)
                     riskLevel: ResourceOperationRiskLevel.LOW,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
-                        newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')
+                        newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe("The key's new expiry time. Only a key that already has an expiry can be extended.")
                     }),
                     enabledCondition: ({ currentObject }) => {
                         return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;
@@ -468,6 +499,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     variantKey: "admin",
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys
                     riskLevel: ResourceOperationRiskLevel.LOW,
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // Request parity with the org-admin default (spec: "admin variants mirror
                     // org-admin operations across tenants"). `newExpiresAt` is REQUIRED and has
@@ -475,7 +507,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     // DTO and an app-super-admin literally cannot pass the new expiry — the
                     // operation is unusable for admins.
                     requestDto: z.object({
-                        newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')
+                        newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe("The key's new expiry time. Only a key that already has an expiry can be extended.")
                     }),
                     // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /
                     // REACTIVATE admin variants: it is a frontend action-affordance gate, not a
@@ -492,17 +524,7 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     resourceOperationLike: CoreResourceOperation.READ,
-                    customResponseDto: z.object({
-                        keyId: z.string(),
-                        totalRequests: z.number().min(0),
-                        requestsLastHour: z.number().min(0),
-                        requestsLastDay: z.number().min(0),
-                        requestsLastWeek: z.number().min(0),
-                        lastUsedAt: z.date().optional(),
-                        mostUsedEndpoint: z.string().optional(),
-                        errorRate: z.number().min(0).max(100), // Percentage
-                        rateLimitHits: z.number().min(0)
-                    }),
+                    customResponseDto: ApiKeyUsageStatisticsResponseSchema,
                 },
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
@@ -517,18 +539,8 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the
                     // serializer would reject the impl's output → latent 500. Stats are not a
                     // secret — the app-super-admin gets the same oversight view as the org.
-                    // Mirror of the default variant's `customResponseDto` above — keep in sync.
-                    customResponseDto: z.object({
-                        keyId: z.string(),
-                        totalRequests: z.number().min(0),
-                        requestsLastHour: z.number().min(0),
-                        requestsLastDay: z.number().min(0),
-                        requestsLastWeek: z.number().min(0),
-                        lastUsedAt: z.date().optional(),
-                        mostUsedEndpoint: z.string().optional(),
-                        errorRate: z.number().min(0).max(100), // Percentage
-                        rateLimitHits: z.number().min(0)
-                    }),
+                    // The same schema object as the default variant — one definition, nothing to keep in sync.
+                    customResponseDto: ApiKeyUsageStatisticsResponseSchema,
                 }
             ]
         },
@@ -553,7 +565,8 @@ export const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesR
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     isSearchable: true,
-                    searchableFields: ['name', 'description', 'keyId'],
+                    // `keyPrefix` is the key's visible identifier (#1952); `keyId` is a field of the usage statistics, not of a key.
+                    searchableFields: ['name', 'description', 'keyPrefix'],
                     searchableOptions: { caseSensitive: false, fullMatchOnly: false },
                     filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,
                     sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,+GAA+G;oBAC/G,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,oCAAoC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,4EAA4E;oBAC5E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;oBAClD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization API Keys Shared Resource Configuration\n *\n * Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyOrganizationSchema,\n  ApiKeyStatus\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  name: z.string(),\n  organizationId: z.string(),\n  hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n  ...ORG_API_KEYS_FILTER_FIELDS,\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.COUNT;\n\n/*\nOrganization API Keys Resource Configuration Factory\n*/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrgApiKeys_Operations,\n  OrgApiKeysCoreOperations,\n  typeof ApiKeyOrganizationSchema\n>({\n  mainSchema: ApiKeyOrganizationSchema,\n  resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Organization API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.DELETE,\n    CoreResourceOperation.COUNT,\n  ],\n\n  customOperation: OrgApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.COUNT]: {\n      variants: [\n        {\n          // Feature usage accounting counts org API keys through the repository\n          // layer. This operation does not need public HTTP exposure.\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainKey` (it exists\n          // nowhere else after this response — only its SHA-256 hash is persisted).\n          // Security decision: an app-super-admin creating a key for another org\n          // DOES receive the plaintext so they can relay it to the org. Mirror of\n          // the default variant's `customResponseDto` above — keep in sync.\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Request AND response both MIRROR the org-admin\n          // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n          // operations across tenants\"):\n          //  - requestDto: an app-super-admin can choose the same future\n          //    `oldKeyInvalidationDate` window as an org admin. Without it the admin\n          //    variant would build no request DTO and the impl could only default the\n          //    invalidation to now — silently denying the future-window capability the\n          //    default variant exposes.\n          //  - customResponseDto: without it the admin response falls back to\n          //    `mainSchema` and silently strips the one-time `plainKey` (plus the\n          //    rotated-out key's id + invalidation date). Security decision: an\n          //    app-super-admin rotating another org's key DOES receive the plaintext\n          //    so they can relay it to the org.\n          // Keep both in sync with the default variant above.\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n            oldKeyId: z.string(),\n            oldKeyInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainKey`. Security\n          // decision: an app-super-admin regenerating another org's key DOES\n          // receive the plaintext so they can relay it to the org. Mirror of the\n          // default variant's `customResponseDto` above — keep in sync.\n          // `requestDto` mirrors the default variant too: no caller input, so the\n          // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n          // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n          // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n          // precondition is enforced solely by the prefix implementation's 409 guard.\n          requestDto: z.object({}),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n          requestDto: z.object({}),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller.\n     *\n     * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n     * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n     * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n     * hazard DEACTIVATE documents at length — with no route there is no request contract to\n     * auto-derive and no `PUT .../expire` that could carry `status: active`.\n     *\n     * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n     * direct write would be a second authority over the field and would skip the ACTIVE-only\n     * precondition, which lives in the paired prefix implementation\n     * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n     * `enabledCondition` cannot be.\n     */\n    [OrgApiKeys_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n      // No notification: expiry is the scheduled consequence of a date the administrator set, not\n      // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n      // feature and is not this one.\n    },\n\n    [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can extend expiry\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Request parity with the org-admin default (spec: \"admin variants mirror\n          // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n          // no default, so without this requestDto the admin variant builds no request\n          // DTO and an app-super-admin literally cannot pass the new expiry — the\n          // operation is unusable for admins.\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n          }),\n          // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n          // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n          // backend guard, and the app-super-admin cross-tenant surface is not\n          // state-gated the way the in-tenant org-admin surface is.\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` (the resource object); because the stats shape is DISJOINT\n          // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n          // serializer would reject the impl's output → latent 500. Stats are not a\n          // secret — the app-super-admin gets the same oversight view as the org.\n          // Mirror of the default variant's `customResponseDto` above — keep in sync.\n          customResponseDto: z.object({\n            keyId: z.string(),\n            totalRequests: z.number().min(0),\n            requestsLastHour: z.number().min(0),\n            requestsLastDay: z.number().min(0),\n            requestsLastWeek: z.number().min(0),\n            lastUsedAt: z.date().optional(),\n            mostUsedEndpoint: z.string().optional(),\n            errorRate: z.number().min(0).max(100), // Percentage\n            rateLimitHits: z.number().min(0)\n          }),\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_API_KEYS_FILTER_FIELDS,\n          sortFields: ORG_API_KEYS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description', 'keyId'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,sGAAsG;IACtG,8FAA8F;IAC9F,aAAa,EAAE,mCAAmC,CAAC,WAAW,CAAC;CAChE,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,+GAA+G;oBAC/G,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;qBAC5T,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;wBAC/N,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;wBACtI,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC1J,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;qBAC5T,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;wBAC/N,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;wBACtI,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC1J,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qHAAqH;oBACrH,yGAAyG;oBACzG,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBAClL,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBAClL,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,mCAAmC;iBACvD;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,2FAA2F;oBAC3F,iBAAiB,EAAE,mCAAmC;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,iHAAiH;oBACjH,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;oBACtD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization API Keys Shared Resource Configuration\n *\n * Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n */\n\nimport { z } from 'zod';\nimport {\n  ApiKeyOrganizationSchema,\n  ApiKeyStatus,\n  ApiKeyUsageStatisticsResponseSchema,\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n  status: z.enum(ApiKeyStatus),\n  name: z.string(),\n  organizationId: z.string(),\n  // \"Has an expiry\", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database\n  // as a field no row has, and matched nothing (#1806); the presence filter carries its target.\n  hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n  ...ORG_API_KEYS_FILTER_FIELDS,\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n  ROTATE = 'rotate', // Generate new key and invalidate old one\n  REGENERATE = 'regenerate', // Generate new key without invalidating old one\n  DEACTIVATE = 'deactivate', // Deactivate key\n  REACTIVATE = 'reactivate', // Reactivate key\n  EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n  USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.COUNT;\n\n/*\nOrganization API Keys Resource Configuration Factory\n*/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrgApiKeys_Operations,\n  OrgApiKeysCoreOperations,\n  typeof ApiKeyOrganizationSchema\n>({\n  mainSchema: ApiKeyOrganizationSchema,\n  resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Organization API keys are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.DELETE,\n    CoreResourceOperation.COUNT,\n  ],\n\n  customOperation: OrgApiKeys_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.COUNT]: {\n      variants: [\n        {\n          // Feature usage accounting counts org API keys through the repository\n          // layer. This operation does not need public HTTP exposure.\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\")\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainKey` (it exists\n          // nowhere else after this response — only its SHA-256 hash is persisted).\n          // Security decision: an app-super-admin creating a key for another org\n          // DOES receive the plaintext so they can relay it to the org. Mirror of\n          // the default variant's `customResponseDto` above — keep in sync.\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\")\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.\")\n          }),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n            oldKeyId: z.string().describe(\"The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id.\"),\n            oldKeyInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n          // invalidation at the requested boundary (default: now) and returns the replacement in\n          // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n          // using the prior value break and it cannot be restored. An unauthorized rotate is not\n          // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n          // A live session alone is deliberately not sufficient for that.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Request AND response both MIRROR the org-admin\n          // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n          // operations across tenants\"):\n          //  - requestDto: an app-super-admin can choose the same future\n          //    `oldKeyInvalidationDate` window as an org admin. Without it the admin\n          //    variant would build no request DTO and the impl could only default the\n          //    invalidation to now — silently denying the future-window capability the\n          //    default variant exposes.\n          //  - customResponseDto: without it the admin response falls back to\n          //    `mainSchema` and silently strips the one-time `plainKey` (plus the\n          //    rotated-out key's id + invalidation date). Security decision: an\n          //    app-super-admin rotating another org's key DOES receive the plaintext\n          //    so they can relay it to the org.\n          // Keep both in sync with the default variant above.\n          requestDto: z.object({\n            oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.\")\n          }),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n            oldKeyId: z.string().describe(\"The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id.\"),\n            oldKeyInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n          // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n          // runs in the CREATE handler only) on a resource with no core UPDATE.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainKey`. Security\n          // decision: an app-super-admin regenerating another org's key DOES\n          // receive the plaintext so they can relay it to the org. Mirror of the\n          // default variant's `customResponseDto` above — keep in sync.\n          // `requestDto` mirrors the default variant too: no caller input, so the\n          // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n          requestDto: z.object({}),\n          customResponseDto: ApiKeyOrganizationSchema.extend({\n            plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n          // selects the core path that persists; it must NOT also hand the caller UPDATE's\n          // request contract. Omitting `requestDto` here would auto-derive the resource's\n          // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n          // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n          // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n          // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n          // implementation; see `api-keys.custom-impl.backend.service.ts`.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.ACTIVE;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n          // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n          // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n          // precondition is enforced solely by the prefix implementation's 409 guard.\n          requestDto: z.object({}),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          // Org admins only. NOT opened to MANAGE_API_KEYS (#1631): re-enabling a key the organization deactivated would let a\n          // firm undo the organization's own decision about a credential, as member reactivate would for a person.\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n          // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === ApiKeyStatus.INACTIVE;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n          requestDto: z.object({}),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller.\n     *\n     * Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n     * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n     * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n     * hazard DEACTIVATE documents at length — with no route there is no request contract to\n     * auto-derive and no `PUT .../expire` that could carry `status: active`.\n     *\n     * It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n     * direct write would be a second authority over the field and would skip the ACTIVE-only\n     * precondition, which lives in the paired prefix implementation\n     * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n     * `enabledCondition` cannot be.\n     */\n    [OrgApiKeys_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n      // No notification: expiry is the scheduled consequence of a date the administrator set, not\n      // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n      // feature and is not this one.\n    },\n\n    [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe(\"The key's new expiry time. Only a key that already has an expiry can be extended.\")\n          }),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Request parity with the org-admin default (spec: \"admin variants mirror\n          // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n          // no default, so without this requestDto the admin variant builds no request\n          // DTO and an app-super-admin literally cannot pass the new expiry — the\n          // operation is unusable for admins.\n          requestDto: z.object({\n            newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe(\"The key's new expiry time. Only a key that already has an expiry can be extended.\")\n          }),\n          // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n          // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n          // backend guard, and the app-super-admin cross-tenant surface is not\n          // state-gated the way the in-tenant org-admin surface is.\n        }\n      ]\n    },\n\n    [OrgApiKeys_Operations.USAGE_STATS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          customResponseDto: ApiKeyUsageStatisticsResponseSchema,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.READ,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` (the resource object); because the stats shape is DISJOINT\n          // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n          // serializer would reject the impl's output → latent 500. Stats are not a\n          // secret — the app-super-admin gets the same oversight view as the org.\n          // The same schema object as the default variant — one definition, nothing to keep in sync.\n          customResponseDto: ApiKeyUsageStatisticsResponseSchema,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_API_KEYS_FILTER_FIELDS,\n          sortFields: ORG_API_KEYS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // `keyPrefix` is the key's visible identifier (#1952); `keyId` is a field of the usage statistics, not of a key.\n          searchableFields: ['name', 'description', 'keyPrefix'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n          sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/security/api-keys/api-keys.shared.schemas.d.ts

@@ -51,6 +51,7 @@ export declare const ApiKeySchemaBase: z.ZodObject<{
     roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
@@ -66,6 +67,7 @@ export declare const ApiKeyOrganizationSchema: z.ZodObject<{
     roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
@@ -85,6 +87,7 @@ export declare const ApiKeyApplicationSchema: z.ZodObject<{
     roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
@@ -107,6 +110,7 @@ export declare const ApiKeyOrganizationContextSchema: z.ZodObject<{
     roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
@@ -137,6 +141,7 @@ export declare const ApiKeyApplicationContextSchema: z.ZodObject<{
     roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>;
     status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ApiKeyStatus>>>>>;
     expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
@@ -160,4 +165,25 @@ export declare const ApiKeyApplicationContextSchema: z.ZodObject<{
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type ApiKeyApplicationContext = z.infer<typeof ApiKeyApplicationContextSchema>;
+/**
+ * The response of an API key's `usage_stats` operation — one definition for the organization key's two
+ * variants and the application key's one, which used to be three hand-kept copies (#1797).
+ *
+ * The counts come from the usage recorder, which counts every request a key authenticates, in
+ * per-minute and per-hour buckets. They are a rolling measurement over the last week, not a ledger.
+ * Two fields the operation used to publish are gone rather than reported as zero, because nothing can
+ * answer them truthfully: a LIFETIME request total needs a durable counter on the key, and a rate-limit
+ * count needs a limiter that knows the key — every limiter in front of a REST request runs before the
+ * key is resolved and counts by source address.
+ */
+export declare const ApiKeyUsageStatisticsResponseSchema: z.ZodObject<{
+    keyId: z.ZodString;
+    requestsLastHour: z.ZodNumber;
+    requestsLastDay: z.ZodNumber;
+    requestsLastWeek: z.ZodNumber;
+    lastUsedAt: z.ZodOptional<z.ZodDate>;
+    mostUsedEndpoint: z.ZodOptional<z.ZodString>;
+    errorRate: z.ZodNumber;
+}, z.core.$strip>;
+export type ApiKeyUsageStatisticsResponse = z.infer<typeof ApiKeyUsageStatisticsResponseSchema>;
 //# sourceMappingURL=api-keys.shared.schemas.d.ts.map

package/dist/esm/security/api-keys/api-keys.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,oBAAY,WAAW;IACrB,YAAY,iBAAkB;IAC9B,WAAW,gBAAkB;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAGnF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC,iBAAgC,CAAC;AAErF,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,EAAE,4BAG5C,CAAC;AAEH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAQD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAyC3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;iBAenC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;iBAelC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"api-keys.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,oBAAY,WAAW;IACrB,YAAY,iBAAkB;IAC9B,WAAW,gBAAkB;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAGnF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC,iBAAgC,CAAC;AAErF,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,EAAE,4BAG5C,CAAC;AAEH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAQD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;iBAqD3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;iBAgBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;iBAgBlC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;iBAQ9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}