npm - @wildo-ai/saas-models - Versions diffs - 1.1.7 → 1.1.9 - Mend

@wildo-ai/saas-models 1.1.7 → 1.1.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (882) hide show

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,sGAAsG;IACtG,8FAA8F;IAC9F,aAAa,EAAE,mCAAmC,CAAC,WAAW,CAAC;CAChE,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,+GAA+G;oBAC/G,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;qBAC5T,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;wBAC/N,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;wBACtI,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC1J,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;qBAC5T,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;wBAC/N,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;wBACtI,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC1J,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qHAAqH;oBACrH,yGAAyG;oBACzG,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBAClL,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBAClL,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,mCAAmC;iBACvD;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,2FAA2F;oBAC3F,iBAAiB,EAAE,mCAAmC;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,iHAAiH;oBACjH,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;oBACtD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization API Keys Shared Resource Configuration\n \n Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n /\n\nimport { z } from 'zod';\nimport {\n ApiKeyOrganizationSchema,\n ApiKeyStatus,\n ApiKeyUsageStatisticsResponseSchema,\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n status: z.enum(ApiKeyStatus),\n name: z.string(),\n organizationId: z.string(),\n // \"Has an expiry\", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database\n // as a field no row has, and matched nothing (#1806); the presence filter carries its target.\n hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n ...ORG_API_KEYS_FILTER_FIELDS,\n lastUsedAt: z.date(), // Admin can filter by last usage\n expiresAt: z.date(), // Admin can filter by expiration\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n ROTATE = 'rotate', // Generate new key and invalidate old one\n REGENERATE = 'regenerate', // Generate new key without invalidating old one\n DEACTIVATE = 'deactivate', // Deactivate key\n REACTIVATE = 'reactivate', // Reactivate key\n EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.COUNT;\n\n/\nOrganization API Keys Resource Configuration Factory\n/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof OrgApiKeys_Operations,\n OrgApiKeysCoreOperations,\n typeof ApiKeyOrganizationSchema\n>({\n mainSchema: ApiKeyOrganizationSchema,\n resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Organization API keys are a core system resource\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.COUNT,\n ],\n\n customOperation: OrgApiKeys_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n // Feature usage accounting counts org API keys through the repository\n // layer. This operation does not need public HTTP exposure.\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // requestDto auto-derived from decorators\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\")\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (it exists\n // nowhere else after this response — only its SHA-256 hash is persisted).\n // Security decision: an app-super-admin creating a key for another org\n // DOES receive the plaintext so they can relay it to the org. Mirror of\n // the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\")\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.ROTATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.\")\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n oldKeyId: z.string().describe(\"The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id.\"),\n oldKeyInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Request AND response both MIRROR the org-admin\n // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n // operations across tenants\"):\n // - requestDto: an app-super-admin can choose the same future\n // `oldKeyInvalidationDate` window as an org admin. Without it the admin\n // variant would build no request DTO and the impl could only default the\n // invalidation to now — silently denying the future-window capability the\n // default variant exposes.\n // - customResponseDto: without it the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (plus the\n // rotated-out key's id + invalidation date). Security decision: an\n // app-super-admin rotating another org's key DOES receive the plaintext\n // so they can relay it to the org.\n // Keep both in sync with the default variant above.\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.\")\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n oldKeyId: z.string().describe(\"The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id.\"),\n oldKeyInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REGENERATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // REGENERATE reissues the secret and nothing else — it takes no caller input\n // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n // auto-derived UPDATE contract would apply: the reissue prefix returns\n // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n // runs in the CREATE handler only) on a resource with no core UPDATE.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey`. Security\n // decision: an app-super-admin regenerating another org's key DOES\n // receive the plaintext so they can relay it to the org. Mirror of the\n // default variant's `customResponseDto` above — keep in sync.\n // `requestDto` mirrors the default variant too: no caller input, so the\n // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.DEACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n // selects the core path that persists; it must NOT also hand the caller UPDATE's\n // request contract. Omitting `requestDto` here would auto-derive the resource's\n // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n // implementation; see `api-keys.custom-impl.backend.service.ts`.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.ACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n // precondition is enforced solely by the prefix implementation's 409 guard.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n // Org admins only. NOT opened to MANAGE_API_KEYS (#1631): re-enabling a key the organization deactivated would let a\n // firm undo the organization's own decision about a credential, as member reactivate would for a person.\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.INACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n /\n ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n * the sweep is the only caller.\n \n Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n * hazard DEACTIVATE documents at length — with no route there is no request contract to\n * auto-derive and no `PUT .../expire` that could carry `status: active`.\n \n It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n * direct write would be a second authority over the field and would skip the ACTIVE-only\n * precondition, which lives in the paired prefix implementation\n * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n * `enabledCondition` cannot be.\n */\n [OrgApiKeys_Operations.EXPIRE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n // and the paired prefix implementation forces the status transition itself, so there is no field\n // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n requestDto: z.object({}),\n }\n ],\n // No notification: expiry is the scheduled consequence of a date the administrator set, not\n // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n // feature and is not this one.\n },\n\n [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.LOW,\n // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe(\"The key's new expiry time. Only a key that already has an expiry can be extended.\")\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Request parity with the org-admin default (spec: \"admin variants mirror\n // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n // no default, so without this requestDto the admin variant builds no request\n // DTO and an app-super-admin literally cannot pass the new expiry — the\n // operation is unusable for admins.\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe(\"The key's new expiry time. Only a key that already has an expiry can be extended.\")\n }),\n // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n // backend guard, and the app-super-admin cross-tenant surface is not\n // state-gated the way the in-tenant org-admin surface is.\n }\n ]\n },\n\n [OrgApiKeys_Operations.USAGE_STATS]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n customResponseDto: ApiKeyUsageStatisticsResponseSchema,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` (the resource object); because the stats shape is DISJOINT\n // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n // serializer would reject the impl's output → latent 500. Stats are not a\n // secret — the app-super-admin gets the same oversight view as the org.\n // The same schema object as the default variant — one definition, nothing to keep in sync.\n customResponseDto: ApiKeyUsageStatisticsResponseSchema,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n // `keyPrefix` is the key's visible identifier (#1952); `keyId` is a field of the usage statistics, not of a key.\n searchableFields: ['name', 'description', 'keyPrefix'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,sGAAsG;IACtG,8FAA8F;IAC9F,aAAa,EAAE,mCAAmC,CAAC,WAAW,CAAC;CAChE,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,+GAA+G;oBAC/G,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;qBAC5T,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;wBAC/N,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;wBACtI,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC1J,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oLAAoL,CAAC;qBAC5T,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;wBAC/N,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;wBACtI,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC1J,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBAChO,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qHAAqH;oBACrH,yGAAyG;oBACzG,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC,EAAE,wEAAwE;oBACzJ,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBAClL,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC,CAAC,QAAQ,CAAC,mFAAmF,CAAC;qBAClL,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,mCAAmC;iBACvD;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,2FAA2F;oBAC3F,iBAAiB,EAAE,mCAAmC;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,iHAAiH;oBACjH,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC;oBACtD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization API Keys Shared Resource Configuration\n \n Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n /\n\nimport { z } from 'zod';\nimport {\n ApiKeyOrganizationSchema,\n ApiKeyStatus,\n ApiKeyUsageStatisticsResponseSchema,\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n status: z.enum(ApiKeyStatus),\n name: z.string(),\n organizationId: z.string(),\n // \"Has an expiry\", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database\n // as a field no row has, and matched nothing (#1806); the presence filter carries its target.\n hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n ...ORG_API_KEYS_FILTER_FIELDS,\n lastUsedAt: z.date(), // Admin can filter by last usage\n expiresAt: z.date(), // Admin can filter by expiration\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n ROTATE = 'rotate', // Generate new key and invalidate old one\n REGENERATE = 'regenerate', // Generate new key without invalidating old one\n DEACTIVATE = 'deactivate', // Deactivate key\n REACTIVATE = 'reactivate', // Reactivate key\n EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.COUNT;\n\n/\nOrganization API Keys Resource Configuration Factory\n/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof OrgApiKeys_Operations,\n OrgApiKeysCoreOperations,\n typeof ApiKeyOrganizationSchema\n>({\n mainSchema: ApiKeyOrganizationSchema,\n resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Organization API keys are a core system resource\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.COUNT,\n ],\n\n customOperation: OrgApiKeys_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n // Feature usage accounting counts org API keys through the repository\n // layer. This operation does not need public HTTP exposure.\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // requestDto auto-derived from decorators\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\")\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (it exists\n // nowhere else after this response — only its SHA-256 hash is persisted).\n // Security decision: an app-super-admin creating a key for another org\n // DOES receive the plaintext so they can relay it to the org. Mirror of\n // the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\")\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.ROTATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: Replaces the secret. Only the SHA-256 hash is persisted, so the previous key is unrecoverable.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.\")\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n oldKeyId: z.string().describe(\"The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id.\"),\n oldKeyInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Request AND response both MIRROR the org-admin\n // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n // operations across tenants\"):\n // - requestDto: an app-super-admin can choose the same future\n // `oldKeyInvalidationDate` window as an org admin. Without it the admin\n // variant would build no request DTO and the impl could only default the\n // invalidation to now — silently denying the future-window capability the\n // default variant exposes.\n // - customResponseDto: without it the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (plus the\n // rotated-out key's id + invalidation date). Security decision: an\n // app-super-admin rotating another org's key DOES receive the plaintext\n // so they can relay it to the org.\n // Keep both in sync with the default variant above.\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so integrations can switch over.\")\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n oldKeyId: z.string().describe(\"The id of the rotated key. Rotation reissues the secret on the same key, so this is the key's own id.\"),\n oldKeyInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REGENERATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // REGENERATE reissues the secret and nothing else — it takes no caller input\n // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n // auto-derived UPDATE contract would apply: the reissue prefix returns\n // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n // runs in the CREATE handler only) on a resource with no core UPDATE.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey`. Security\n // decision: an app-super-admin regenerating another org's key DOES\n // receive the plaintext so they can relay it to the org. Mirror of the\n // default variant's `customResponseDto` above — keep in sync.\n // `requestDto` mirrors the default variant too: no caller input, so the\n // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral().describe(\"The full key value, returned only in this response: only its hash is stored, so it cannot be read again. Send it as the raw `Authorization` header value, with no scheme.\"),\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.DEACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n // selects the core path that persists; it must NOT also hand the caller UPDATE's\n // request contract. Omitting `requestDto` here would auto-derive the resource's\n // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n // implementation; see `api-keys.custom-impl.backend.service.ts`.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.ACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n // precondition is enforced solely by the prefix implementation's 409 guard.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n // Org admins only. NOT opened to MANAGE_API_KEYS (#1631): re-enabling a key the organization deactivated would let a\n // firm undo the organization's own decision about a credential, as member reactivate would for a person.\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.INACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n /\n ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n * the sweep is the only caller.\n \n Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n * hazard DEACTIVATE documents at length — with no route there is no request contract to\n * auto-derive and no `PUT .../expire` that could carry `status: active`.\n \n It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n * direct write would be a second authority over the field and would skip the ACTIVE-only\n * precondition, which lives in the paired prefix implementation\n * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n * `enabledCondition` cannot be.\n */\n [OrgApiKeys_Operations.EXPIRE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n // and the paired prefix implementation forces the status transition itself, so there is no field\n // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n requestDto: z.object({}),\n }\n ],\n // No notification: expiry is the scheduled consequence of a date the administrator set, not\n // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n // feature and is not this one.\n },\n\n [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS], // Org admins, or a firm's expert the owner lent MANAGE_API_KEYS (#1631)\n riskLevel: ResourceOperationRiskLevel.LOW,\n // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe(\"The key's new expiry time. Only a key that already has an expiry can be extended.\")\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n auditableEvent: { auditBelowRiskFloor: true },\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Request parity with the org-admin default (spec: \"admin variants mirror\n // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n // no default, so without this requestDto the admin variant builds no request\n // DTO and an app-super-admin literally cannot pass the new expiry — the\n // operation is unusable for admins.\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future').describe(\"The key's new expiry time. Only a key that already has an expiry can be extended.\")\n }),\n // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n // backend guard, and the app-super-admin cross-tenant surface is not\n // state-gated the way the in-tenant org-admin surface is.\n }\n ]\n },\n\n [OrgApiKeys_Operations.USAGE_STATS]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n customResponseDto: ApiKeyUsageStatisticsResponseSchema,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` (the resource object); because the stats shape is DISJOINT\n // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n // serializer would reject the impl's output → latent 500. Stats are not a\n // secret — the app-super-admin gets the same oversight view as the org.\n // The same schema object as the default variant — one definition, nothing to keep in sync.\n customResponseDto: ApiKeyUsageStatisticsResponseSchema,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n // `keyPrefix` is the key's visible identifier (#1952); `keyId` is a field of the usage statistics, not of a key.\n searchableFields: ['name', 'description', 'keyPrefix'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ],\n },\n },\n});\n"]}

package/dist/esm/security/api-keys/api-keys.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-keys.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,oBAAY,WAAW;IACrB,YAAY,iBAAkB;IAC9B,WAAW,gBAAkB;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAGnF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC,iBAAgC,CAAC;AAErF,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,EAAE,4BAG5C,CAAC;AAEH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAQD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;iBAqD3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;iBAgBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;iBAgBlC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;iBAQ9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}
1	+ {"version":3,"file":"api-keys.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,oBAAY,WAAW;IACrB,YAAY,iBAAkB;IAC9B,WAAW,gBAAkB;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAGnF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC,iBAAgC,CAAC;AAErF,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,EAAE,4BAG5C,CAAC;AAEH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAQD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;iBAqD3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;iBAgBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;iBAgBlC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;iBAQ9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/esm/security/api-keys/api-keys.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-keys.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAC,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,kCAAkC;AAClC,gBAAgB;AAChB,kCAAkC;AAIlC,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,qCAAqB,CAAA;IACrB,mCAAmB,CAAA;AACrB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4CAA8B,CAAA;IAC9B,0CAA6B,CAAA;AAC/B,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA0C,MAAM,CAAC,MAAM,CAAC;IACrG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS;IACrC,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,SAAS;CACrC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,eAAe,CAAC,aAAa,CAAC;AAErF,+GAA+G;AAC/G,MAAM,CAAC,MAAM,+BAA+B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACzF,mBAAmB,EAAE,uCAAuC;IAC5D,eAAe,EAAE,kCAAkC;CACpD,CAAC,CAAC;AAOH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAQ,MAAM,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAGD,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC1G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;SAC7H,QAAQ,CAAC,4TAA4T,CAAC;IACzU,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,4DAA4D;IAC5D,oFAAoF;IACpF,+EAA+E;IAC/E,kFAAkF;IAClF,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,iFAAiF;IACjF,0DAA0D;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,mFAAmF;IACnF,iFAAiF;IACjF,iBAAiB;IACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACvF,QAAQ,CAAC,0LAA0L,CAAC;IACvM,8EAA8E;IAC9E,iFAAiF;IACjF,mFAAmF;IACnF,mFAAmF;IACnF,8CAA8C;IAC9C,2BAA2B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACrF,QAAQ,CAAC,0IAA0I,CAAC;CACxJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,kHAAkH,CAAC;IACvK,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACzI,QAAQ,CAAC,0JAA0J,CAAC;IACvK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,uHAAuH,CAAC;IAC3K,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAClG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACzI,QAAQ,CAAC,0JAA0J,CAAC;IACvK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAClH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IACzI,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4HAA4H,CAAC;IAChL,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;IAC9H,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yLAAyL,CAAC;IAC3O,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,mJAAmJ,CAAC;CACpM,CAAC,CAAC","sourcesContent":["/*\n API Key Shared Schemas\n \n Frontend/backend shared API key schemas and DTOs only.\n * Backend-specific logic stays in saas-backend-lib.\n /\n\nimport { z } from 'zod';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiRequest_RateLimitSchema} from '../../requests/rate-limits.shared.schemas';\nimport { WildoHeaderKeys } from '../../requests/header-keys.shared';\n\n// ===============================\n// API KEY ENUMS\n// ===============================\n\n\n\nexport enum ApiKeyStatus {\n ACTIVE = 'active',\n INACTIVE = 'inactive',\n EXPIRED = 'expired'\n}\n\nexport enum ApiKeyScope {\n ORGANIZATION = 'organization',\n APPLICATION = 'application',\n}\n\n/\n Public API-key presentation is one cross-layer contract.\n \n A key's scope decides the prefix that identifies it to request authentication;\n * the request itself carries the complete opaque key in the `Authorization`\n * field without an authentication scheme. That scheme-less presentation is an\n * application protocol contract, not OAuth bearer-token syntax. Keeping it at the shared\n * model boundary makes minting, request routing and consumer documentation\n * derive from one source instead of re-typing `sk_org_` / `sk_app_` in each.\n /\nexport const API_KEY_CREDENTIAL_PREFIX_BY_SCOPE: Readonly<Record<ApiKeyScope, string>> = Object.freeze({\n [ApiKeyScope.ORGANIZATION]: 'sk_org_',\n [ApiKeyScope.APPLICATION]: 'sk_app_',\n});\n\n/\n API keys reuse the request-authentication field name as their transport.\n \n This aliases the protocol-wide header vocabulary rather than re-declaring a\n * second literal. The raw value intentionally has no `Bearer` scheme, so callers\n * must follow this application's exact wire contract rather than infer OAuth syntax.\n * It belongs beside the prefix map because both values describe the one public\n * presentation contract of an API-key credential.\n /\nexport const API_KEY_CREDENTIAL_AUTHORIZATION_HEADER = WildoHeaderKeys.AUTHORIZATION;\n\n/* Complete public transport/prefix presentation used by request authentication and consumer documentation. /\nexport const API_KEY_CREDENTIAL_PRESENTATION: ApiKeyCredentialPresentation = Object.freeze({\n authorizationHeader: API_KEY_CREDENTIAL_AUTHORIZATION_HEADER,\n prefixesByScope: API_KEY_CREDENTIAL_PREFIX_BY_SCOPE,\n});\n\nexport interface ApiKeyCredentialPresentation {\n readonly authorizationHeader: string;\n readonly prefixesByScope: Readonly<Record<ApiKeyScope, string>>;\n}\n\nexport function apiKeyScopeForCredential(value: string): ApiKeyScope \| null {\n return (Object.values(ApiKeyScope) as ApiKeyScope[]).find((scope) => value.startsWith(API_KEY_CREDENTIAL_PREFIX_BY_SCOPE[scope])) ?? null;\n}\n\nexport function isApiKeyCredential(value: string): boolean {\n return apiKeyScopeForCredential(value) !== null;\n}\n\n\n// ===============================\n// CORE API KEY SCHEMAS\n// ===============================\n\n// Base schema for extension (needs to be z.object for extend to work)\nexport const ApiKeySchemaBase = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n description: z.string().max(500).optional(),\n scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n // `.isAuditEvidence()` on both: a machine credential's roles ARE its authority, and its status\n // decides whether that authority is live. This resource exposes no core UPDATE and gates roles\n // only at minting, so the before/after values are the only way to reconstruct what a key could\n // do at a point in time. Closed vocabulary — no personal data reaches the audit ledger.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n status: z.enum(ApiKeyStatus).default(ApiKeyStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n /\n The capability grant this key was minted or reissued under (#1631), when a service firm's expert did it through a\n * lent `MANAGE_API_KEYS`. Such a key's `expiresAt` is capped at the grant's end, and it is deactivated when the grant\n * is revoked or its relationship ends — a secret handed to the firm under a lending ends with the lending. Absent for\n * a key the organization's own administrators handled. Server-written only.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a credential obtained through delegated administration cannot outlive the delegation.\n /\n lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()\n .describe('The capability grant a service firm\\'s expert minted or reissued this key under, through administration the organization lent the firm. Such a key expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a key the organization\\'s own administrators handled.'),\n lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // ── Rotation grace window ─────────────────────────────────────────────────\n // When a key is ROTATED or REGENERATEd, the PRIOR secret is retained here so it\n // keeps authenticating during an overlap window — callers can migrate to the new\n // secret without a hard cutover. The bearer-token auth path\n // (`execution-context-creator.backend.service.ts`) resolves a presented key against\n // the current `hashedKey` OR this `previousHashedKey` while the window is open\n // (`previousKeyInvalidationDate` is null or in the future) AND the key is ACTIVE.\n // All three are server-managed by the rotate/regenerate impls only — never\n // client-settable (`.excludeFromCreate().excludeFromUpdate()`).\n //\n // `previousHashedKey` — `sha256` of the prior secret; the auth path looks a\n // presented key up against it, so it is `.isDBIndexed()`. Backend-only (a secret\n // hash, never surfaced). Absent until the first rotation.\n previousHashedKey: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 chars of the prior secret — retained for support/audit display while the\n // previous secret is still valid (not a secret, so surfaced). Overwritten on the\n // next rotation.\n previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate()\n .describe('The first eight characters of the previous secret, which still authenticates until `previousKeyInvalidationDate`, or, when that is empty, until the key is rotated or regenerated again.'),\n // When the previous secret stops authenticating. `null`/absent = no scheduled\n // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n // rotation). A future date (ROTATE `oldKeyInvalidationDate`) = honored until then,\n // then rejected. `now`/past (ROTATE default) = immediate hard cutover. Surfaced so\n // operators can see when the old secret dies.\n previousKeyInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate()\n .describe('When the previous secret stops authenticating. Empty after a regenerate: the previous secret then keeps working until the next rotation.')\n});\n\nexport type ApiKeyBase = z.infer<typeof ApiKeySchemaBase>;\n\nexport const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({\n scope: z.literal(ApiKeyScope.ORGANIZATION).describe(\"Always `organization`: the key authenticates on behalf of one organization, and its value starts with `sk_org_`.\"),\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n // Backend-only field - stored in DB but never sent to frontend (security)\n // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n // on every authenticated request). Without an index this is an O(n)\n // collection scan per request. Compound unique guarantees only one\n // active row per hash — cryptographically near-impossible by accident,\n // but a uniqueness contract avoids two rows being returned to the\n // resolver on a hash-collision and prevents shadow-key duplicates\n // during rotation.\n hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate()\n .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),\n keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyOrganization = z.infer<typeof ApiKeyOrganizationSchema>;\n\nexport const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({\n scope: z.literal(ApiKeyScope.APPLICATION).describe(\"Always `application`: the key authenticates on behalf of the application itself, and its value starts with `sk_app_`.\"),\n applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n // Backend-only field - stored in DB but never sent to frontend (security)\n // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n // on every authenticated request). Without an index this is an O(n)\n // collection scan per request. Compound unique guarantees only one\n // active row per hash — cryptographically near-impossible by accident,\n // but a uniqueness contract avoids two rows being returned to the\n // resolver on a hash-collision and prevents shadow-key duplicates\n // during rotation.\n hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate()\n .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),\n keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyApplication = z.infer<typeof ApiKeyApplicationSchema>;\n\n/\n API Key Context for middleware and validation\n /\nexport const ApiKeyOrganizationContextSchema = ApiKeyOrganizationSchema.extend({\n rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyOrganizationContext = z.infer<typeof ApiKeyOrganizationContextSchema>;\n\nexport const ApiKeyApplicationContextSchema = ApiKeyApplicationSchema.extend({\n rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyApplicationContext = z.infer<typeof ApiKeyApplicationContextSchema>;\n\n/\n The response of an API key's `usage_stats` operation — one definition for the organization key's two\n * variants and the application key's one, which used to be three hand-kept copies (#1797).\n \n The counts come from the usage recorder, which counts every request a key authenticates, in\n * per-minute and per-hour buckets. They are a rolling measurement over the last week, not a ledger.\n * Two fields the operation used to publish are gone rather than reported as zero, because nothing can\n * answer them truthfully: a LIFETIME request total needs a durable counter on the key, and a rate-limit\n * count needs a limiter that knows the key — every limiter in front of a REST request runs before the\n * key is resolved and counts by source address.\n */\nexport const ApiKeyUsageStatisticsResponseSchema = z.object({\n keyId: z.string().describe('The id of the API key these statistics are for.'),\n requestsLastHour: z.number().int().min(0).describe('Requests authenticated with this key in the last 60 minutes.'),\n requestsLastDay: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 23 hours before it.'),\n requestsLastWeek: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 167 hours before it. Counts older than that are not kept.'),\n lastUsedAt: z.date().optional().describe('When the key was last accepted, to the minute. Absent when it has never been used.'),\n mostUsedEndpoint: z.string().optional().describe('The route this key reached most often over the last week, as its method and path template (for example `GET /organizations/:organizationId/todos`). Absent when no request was counted.'),\n errorRate: z.number().min(0).max(100).describe('The percentage of the last week\\'s requests that answered with a status of 400 or above, or were closed before an answer. 0 when there were none.'),\n});\nexport type ApiKeyUsageStatisticsResponse = z.infer<typeof ApiKeyUsageStatisticsResponseSchema>;\n"]}
1	+ {"version":3,"file":"api-keys.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAC,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,kCAAkC;AAClC,gBAAgB;AAChB,kCAAkC;AAIlC,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,qCAAqB,CAAA;IACrB,mCAAmB,CAAA;AACrB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4CAA8B,CAAA;IAC9B,0CAA6B,CAAA;AAC/B,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA0C,MAAM,CAAC,MAAM,CAAC;IACrG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS;IACrC,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,SAAS;CACrC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,eAAe,CAAC,aAAa,CAAC;AAErF,+GAA+G;AAC/G,MAAM,CAAC,MAAM,+BAA+B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACzF,mBAAmB,EAAE,uCAAuC;IAC5D,eAAe,EAAE,kCAAkC;CACpD,CAAC,CAAC;AAOH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAQ,MAAM,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAGD,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC1G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;SAC7H,QAAQ,CAAC,4TAA4T,CAAC;IACzU,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,4DAA4D;IAC5D,oFAAoF;IACpF,+EAA+E;IAC/E,kFAAkF;IAClF,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,iFAAiF;IACjF,0DAA0D;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,mFAAmF;IACnF,iFAAiF;IACjF,iBAAiB;IACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACvF,QAAQ,CAAC,0LAA0L,CAAC;IACvM,8EAA8E;IAC9E,iFAAiF;IACjF,mFAAmF;IACnF,mFAAmF;IACnF,8CAA8C;IAC9C,2BAA2B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACrF,QAAQ,CAAC,0IAA0I,CAAC;CACxJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,kHAAkH,CAAC;IACvK,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACzI,QAAQ,CAAC,0JAA0J,CAAC;IACvK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,uHAAuH,CAAC;IAC3K,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAClG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACzI,QAAQ,CAAC,0JAA0J,CAAC;IACvK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAClH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IACzI,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4HAA4H,CAAC;IAChL,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;IAC9H,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yLAAyL,CAAC;IAC3O,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,mJAAmJ,CAAC;CACpM,CAAC,CAAC","sourcesContent":["/*\n API Key Shared Schemas\n \n Frontend/backend shared API key schemas and DTOs only.\n * Backend-specific logic stays in saas-backend-lib.\n /\n\nimport { z } from 'zod';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiRequest_RateLimitSchema} from '../../requests/rate-limits.shared.schemas';\nimport { WildoHeaderKeys } from '../../requests/header-keys.shared';\n\n// ===============================\n// API KEY ENUMS\n// ===============================\n\n\n\nexport enum ApiKeyStatus {\n ACTIVE = 'active',\n INACTIVE = 'inactive',\n EXPIRED = 'expired'\n}\n\nexport enum ApiKeyScope {\n ORGANIZATION = 'organization',\n APPLICATION = 'application',\n}\n\n/\n Public API-key presentation is one cross-layer contract.\n \n A key's scope decides the prefix that identifies it to request authentication;\n * the request itself carries the complete opaque key in the `Authorization`\n * field without an authentication scheme. That scheme-less presentation is an\n * application protocol contract, not OAuth bearer-token syntax. Keeping it at the shared\n * model boundary makes minting, request routing and consumer documentation\n * derive from one source instead of re-typing `sk_org_` / `sk_app_` in each.\n /\nexport const API_KEY_CREDENTIAL_PREFIX_BY_SCOPE: Readonly<Record<ApiKeyScope, string>> = Object.freeze({\n [ApiKeyScope.ORGANIZATION]: 'sk_org_',\n [ApiKeyScope.APPLICATION]: 'sk_app_',\n});\n\n/\n API keys reuse the request-authentication field name as their transport.\n \n This aliases the protocol-wide header vocabulary rather than re-declaring a\n * second literal. The raw value intentionally has no `Bearer` scheme, so callers\n * must follow this application's exact wire contract rather than infer OAuth syntax.\n * It belongs beside the prefix map because both values describe the one public\n * presentation contract of an API-key credential.\n /\nexport const API_KEY_CREDENTIAL_AUTHORIZATION_HEADER = WildoHeaderKeys.AUTHORIZATION;\n\n/* Complete public transport/prefix presentation used by request authentication and consumer documentation. /\nexport const API_KEY_CREDENTIAL_PRESENTATION: ApiKeyCredentialPresentation = Object.freeze({\n authorizationHeader: API_KEY_CREDENTIAL_AUTHORIZATION_HEADER,\n prefixesByScope: API_KEY_CREDENTIAL_PREFIX_BY_SCOPE,\n});\n\nexport interface ApiKeyCredentialPresentation {\n readonly authorizationHeader: string;\n readonly prefixesByScope: Readonly<Record<ApiKeyScope, string>>;\n}\n\nexport function apiKeyScopeForCredential(value: string): ApiKeyScope \| null {\n return (Object.values(ApiKeyScope) as ApiKeyScope[]).find((scope) => value.startsWith(API_KEY_CREDENTIAL_PREFIX_BY_SCOPE[scope])) ?? null;\n}\n\nexport function isApiKeyCredential(value: string): boolean {\n return apiKeyScopeForCredential(value) !== null;\n}\n\n\n// ===============================\n// CORE API KEY SCHEMAS\n// ===============================\n\n// Base schema for extension (needs to be z.object for extend to work)\nexport const ApiKeySchemaBase = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n description: z.string().max(500).optional(),\n scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n // `.isAuditEvidence()` on both: a machine credential's roles ARE its authority, and its status\n // decides whether that authority is live. This resource exposes no core UPDATE and gates roles\n // only at minting, so the before/after values are the only way to reconstruct what a key could\n // do at a point in time. Closed vocabulary — no personal data reaches the audit ledger.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n status: z.enum(ApiKeyStatus).default(ApiKeyStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n /\n The capability grant this key was minted or reissued under (#1631), when a service firm's expert did it through a\n * lent `MANAGE_API_KEYS`. Such a key's `expiresAt` is capped at the grant's end, and it is deactivated when the grant\n * is revoked or its relationship ends — a secret handed to the firm under a lending ends with the lending. Absent for\n * a key the organization's own administrators handled. Server-written only.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a credential obtained through delegated administration cannot outlive the delegation.\n /\n lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()\n .describe('The capability grant a service firm\\'s expert minted or reissued this key under, through administration the organization lent the firm. Such a key expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a key the organization\\'s own administrators handled.'),\n lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // ── Rotation grace window ─────────────────────────────────────────────────\n // When a key is ROTATED or REGENERATEd, the PRIOR secret is retained here so it\n // keeps authenticating during an overlap window — callers can migrate to the new\n // secret without a hard cutover. The bearer-token auth path\n // (`execution-context-creator.backend.service.ts`) resolves a presented key against\n // the current `hashedKey` OR this `previousHashedKey` while the window is open\n // (`previousKeyInvalidationDate` is null or in the future) AND the key is ACTIVE.\n // All three are server-managed by the rotate/regenerate impls only — never\n // client-settable (`.excludeFromCreate().excludeFromUpdate()`).\n //\n // `previousHashedKey` — `sha256` of the prior secret; the auth path looks a\n // presented key up against it, so it is `.isDBIndexed()`. Backend-only (a secret\n // hash, never surfaced). Absent until the first rotation.\n previousHashedKey: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 chars of the prior secret — retained for support/audit display while the\n // previous secret is still valid (not a secret, so surfaced). Overwritten on the\n // next rotation.\n previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate()\n .describe('The first eight characters of the previous secret, which still authenticates until `previousKeyInvalidationDate`, or, when that is empty, until the key is rotated or regenerated again.'),\n // When the previous secret stops authenticating. `null`/absent = no scheduled\n // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n // rotation). A future date (ROTATE `oldKeyInvalidationDate`) = honored until then,\n // then rejected. `now`/past (ROTATE default) = immediate hard cutover. Surfaced so\n // operators can see when the old secret dies.\n previousKeyInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate()\n .describe('When the previous secret stops authenticating. Empty after a regenerate: the previous secret then keeps working until the next rotation.')\n});\n\nexport type ApiKeyBase = z.infer<typeof ApiKeySchemaBase>;\n\nexport const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({\n scope: z.literal(ApiKeyScope.ORGANIZATION).describe(\"Always `organization`: the key authenticates on behalf of one organization, and its value starts with `sk_org_`.\"),\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n // Backend-only field - stored in DB but never sent to frontend (security)\n // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n // on every authenticated request). Without an index this is an O(n)\n // collection scan per request. Compound unique guarantees only one\n // active row per hash — cryptographically near-impossible by accident,\n // but a uniqueness contract avoids two rows being returned to the\n // resolver on a hash-collision and prevents shadow-key duplicates\n // during rotation.\n hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate()\n .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),\n keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyOrganization = z.infer<typeof ApiKeyOrganizationSchema>;\n\nexport const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({\n scope: z.literal(ApiKeyScope.APPLICATION).describe(\"Always `application`: the key authenticates on behalf of the application itself, and its value starts with `sk_app_`.\"),\n applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n // Backend-only field - stored in DB but never sent to frontend (security)\n // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n // on every authenticated request). Without an index this is an O(n)\n // collection scan per request. Compound unique guarantees only one\n // active row per hash — cryptographically near-impossible by accident,\n // but a uniqueness contract avoids two rows being returned to the\n // resolver on a hash-collision and prevents shadow-key duplicates\n // during rotation.\n hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate()\n .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),\n keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyApplication = z.infer<typeof ApiKeyApplicationSchema>;\n\n/\n API Key Context for middleware and validation\n /\nexport const ApiKeyOrganizationContextSchema = ApiKeyOrganizationSchema.extend({\n rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyOrganizationContext = z.infer<typeof ApiKeyOrganizationContextSchema>;\n\nexport const ApiKeyApplicationContextSchema = ApiKeyApplicationSchema.extend({\n rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyApplicationContext = z.infer<typeof ApiKeyApplicationContextSchema>;\n\n/\n The response of an API key's `usage_stats` operation — one definition for the organization key's two\n * variants and the application key's one, which used to be three hand-kept copies (#1797).\n \n The counts come from the usage recorder, which counts every request a key authenticates, in\n * per-minute and per-hour buckets. They are a rolling measurement over the last week, not a ledger.\n * Two fields the operation used to publish are gone rather than reported as zero, because nothing can\n * answer them truthfully: a LIFETIME request total needs a durable counter on the key, and a rate-limit\n * count needs a limiter that knows the key — every limiter in front of a REST request runs before the\n * key is resolved and counts by source address.\n */\nexport const ApiKeyUsageStatisticsResponseSchema = z.object({\n keyId: z.string().describe('The id of the API key these statistics are for.'),\n requestsLastHour: z.number().int().min(0).describe('Requests authenticated with this key in the last 60 minutes.'),\n requestsLastDay: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 23 hours before it.'),\n requestsLastWeek: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 167 hours before it. Counts older than that are not kept.'),\n lastUsedAt: z.date().optional().describe('When the key was last accepted, to the minute. Absent when it has never been used.'),\n mostUsedEndpoint: z.string().optional().describe('The route this key reached most often over the last week, as its method and path template (for example `GET /organizations/:organizationId/todos`). Absent when no request was counted.'),\n errorRate: z.number().min(0).max(100).describe('The percentage of the last week\\'s requests that answered with a status of 400 or above, or were closed before an answer. 0 when there were none.'),\n});\nexport type ApiKeyUsageStatisticsResponse = z.infer<typeof ApiKeyUsageStatisticsResponseSchema>;\n"]}

package/dist/esm/security/authentications/anonymous-session/anonymous-session.shared.contract.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"anonymous-session.shared.contract.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/anonymous-session/anonymous-session.shared.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oCAAoC;;;CAGvC,CAAC;AAEX,MAAM,MAAM,+BAA+B,GACzC,OAAO,oCAAoC,CAAC,MAAM,OAAO,oCAAoC,CAAC,CAAC;AAOjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,OAAO,8BAA8B,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAOrF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B;;;CAG/B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAG,KAAc,CAAC;AAOlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzD,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;CAC9B,CAIC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,sCAAsC;IAChD,IAAI,SAAiB;IACrB,YAAY,iBAAiB;IAC7B,MAAM,WAAiB;IACvB,WAAW,gBAAiB;IAC5B,OAAO,YAAiB;CACzB;AAED,eAAO,MAAM,wCAAwC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,sCAAsC,CAC9D,CAAC;AAEjD,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC"}
1	+ {"version":3,"file":"anonymous-session.shared.contract.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/anonymous-session/anonymous-session.shared.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oCAAoC;;;CAGvC,CAAC;AAEX,MAAM,MAAM,+BAA+B,GACzC,OAAO,oCAAoC,CAAC,MAAM,OAAO,oCAAoC,CAAC,CAAC;AAOjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,OAAO,8BAA8B,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAOrF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B;;;CAG/B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAG,KAAc,CAAC;AAOlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzD,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;CAC9B,CAIC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,sCAAsC;IAChD,IAAI,SAAiB;IACrB,YAAY,iBAAiB;IAC7B,MAAM,WAAiB;IACvB,WAAW,gBAAiB;IAC5B,OAAO,YAAiB;CACzB;AAED,eAAO,MAAM,wCAAwC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,sCAAsC,CAC9D,CAAC;AAEjD,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC"}

package/dist/esm/security/authentications/anonymous-session/anonymous-session.shared.contract.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"anonymous-session.shared.contract.js","sourceRoot":"","sources":["../../../../../src/security/authentications/anonymous-session/anonymous-session.shared.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAGvE,kEAAkE;AAClE,oBAAoB;AACpB,kEAAkE;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,iBAAiB,EAAQ,iBAAiB;IAC1C,uBAAuB,EAAE,uBAAuB;CACxC,CAAC;AAMX,kEAAkE;AAClE,2DAA2D;AAC3D,kEAAkE;AAElE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,IAAI,EAAK,eAAe,CAAC,sBAAsB;IAC/C,OAAO,EAAE,eAAe,CAAC,iBAAiB;IAC1C,KAAK,EAAI,eAAe,CAAC,uBAAuB;CACxC,CAAC;AAMX,kEAAkE;AAClE,qBAAqB;AACrB,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,SAAS,EAAM,OAAO;IACtB,aAAa,EAAE,KAAK;CACZ,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAc,CAAC;AAGlE,kEAAkE;AAClE,qBAAqB;AACrB,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAIxC,CAAC,CAAC,MAAM,CAAC;IACZ,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,GAAG,EAAc,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,GAAG,EAAc,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAChD,CAAC,CAAC;AAKH,kEAAkE;AAClE,uCAAuC;AACvC,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,sCAMX;AAND,WAAY,sCAAsC;IAChD,uDAAqB,CAAA;IACrB,uEAA6B,CAAA;IAC7B,2DAAuB,CAAA;IACvB,qEAA4B,CAAA;IAC5B,6DAAwB,CAAA;AAC1B,CAAC,EANW,sCAAsC,KAAtC,sCAAsC,QAMjD;AAED,MAAM,CAAC,MAAM,wCAAwC,GACnD,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC","sourcesContent":["/*\n Anonymous Session — Shared Contract (W7.3a)\n \n Single source of truth for the constants/keys/format/state-machine\n * shape that any consumer of the anonymous-session feature MUST agree\n * on, regardless of runtime (browser, Astro static page, Node service).\n \n Consumers today:\n * - `engine/saas-frontend-lib`'s `AnonymousSessionContext.tsx` and\n * `local-storage.frontend.schemas.ts` (SaaS app, React, full HTTP\n * client integration)\n * - `engine/saas-backend-lib`'s\n * `security/authentications/services/anonymous-session.backend.service.ts`\n * (JWT signing/verification, transposition, cleanup)\n * - `engine/saas-website` (planned) — light, independent\n * `WebsiteAnonymousSessionContext` for the marketing/landing site\n * that intentionally does NOT depend on `saas-frontend-lib` to keep\n * the static-built bundle small (per `saas-website-slice.md` D16\n * Q17=B)\n \n Why the contract lives here (in `saas-models`) and not in\n * `saas-frontend-lib`:\n \n The marketing-website implementation must NOT import\n * `saas-frontend-lib` (it would pull in the full SaaS-app shell, MUI,\n * react-router, etc. — orders of magnitude larger than a marketing\n * site needs). At the same time, the marketing site MUST be\n * bit-compatible with the SaaS-app implementation so a user who\n * starts a session on `example.com` and continues on\n * `app.example.com` keeps the same `anonymousUserId`. The only safe\n * way to enforce that is to extract the concrete keys/headers/JWT\n * format/state-machine vocabulary into a React-free, runtime-free\n * module that all three consumers import from. Drift is then a\n * compile/test failure, not a silent runtime divergence.\n \n A cross-package conformance test\n * (`__tests__/anonymous-session.contract.conformance.test.ts`)\n * asserts that `saas-frontend-lib`'s public surface and\n * `saas-backend-lib`'s service implementation reference the canonical\n * values from this file.\n /\n\nimport { z } from 'zod';\nimport { WildoHeaderKeys } from '../../../requests/header-keys.shared';\n\n\n// ═══════════════════════════════════════════════════════════════\n// localStorage keys\n// ═══════════════════════════════════════════════════════════════\n\n/\n The exact `localStorage.getItem`/`setItem` keys used to persist the\n * anonymous session across page reloads and tabs.\n \n MUST stay in sync with\n * `engine/saas-frontend-lib/src/core/commons/local-storage.frontend.schemas.ts`\n * (`LOCAL_STORAGE_KEYS.ANONYMOUS_USER_ID` /\n * `LOCAL_STORAGE_KEYS.ANONYMOUS_SESSION_TOKEN`) — that enum re-exports\n * from this contract, so a single edit here propagates everywhere.\n \n Cross-tab sync via the `storage` event keys off these strings\n * literally — changing them is a breaking change for any user with an\n * existing localStorage entry.\n /\nexport const ANONYMOUS_SESSION_LOCAL_STORAGE_KEYS = {\n ANONYMOUS_USER_ID: 'anonymousUserId',\n ANONYMOUS_SESSION_TOKEN: 'anonymousSessionToken',\n} as const;\n\nexport type AnonymousSessionLocalStorageKey =\n typeof ANONYMOUS_SESSION_LOCAL_STORAGE_KEYS[keyof typeof ANONYMOUS_SESSION_LOCAL_STORAGE_KEYS];\n\n\n// ═══════════════════════════════════════════════════════════════\n// HTTP headers (re-exports for one-stop import ergonomics)\n// ═══════════════════════════════════════════════════════════════\n\n/\n The canonical HTTP header names used by the anonymous-session\n * protocol.\n \n These values are NOT redefined here — they are re-exported aliases\n * from `WildoHeaderKeys` (the single source of truth for all\n * platform header names, in `requests/header-keys.shared.ts`). The\n * alias exists purely so anonymous-session consumers have a single\n * import for everything they need.\n \n - `INIT`: client → server, on the FIRST request that creates the\n * AnonymousUser record. Carries the freshly-generated UUID. Server\n * responds with `TOKEN` (the signed JWT).\n * - `SESSION`: client → server, on every SUBSEQUENT request once the\n * JWT is held. Carries the JWT in the body of the header value.\n * - `TOKEN`: server → client, in the response that completes\n * initialization. Carries the freshly-signed JWT.\n /\nexport const ANONYMOUS_SESSION_HTTP_HEADERS = {\n INIT: WildoHeaderKeys.ANONYMOUS_SESSION_INIT,\n SESSION: WildoHeaderKeys.ANONYMOUS_SESSION,\n TOKEN: WildoHeaderKeys.ANONYMOUS_SESSION_TOKEN,\n} as const;\n\nexport type AnonymousSessionHttpHeader =\n typeof ANONYMOUS_SESSION_HTTP_HEADERS[keyof typeof ANONYMOUS_SESSION_HTTP_HEADERS];\n\n\n// ═══════════════════════════════════════════════════════════════\n// JWT signing format\n// ═══════════════════════════════════════════════════════════════\n\n/\n The cryptographic format for the anonymous-session JWT.\n \n Concrete values (algorithm, expiry) are pinned here so the backend\n * and any client that wants to parse the JWT (for diagnostic\n * purposes, e.g. expiry-aware UI) agree on the bit-level shape.\n \n - `algorithm`: HMAC-SHA256 — symmetric, signed with\n * `configService.secrets.security.session.secret`. Symmetric is\n * acceptable because verification only happens server-side\n * (clients treat the JWT as opaque); switching to RS256 would\n * require shipping a public key to the marketing site for nothing.\n * - `expirySeconds`: 24 hours — long enough to cover a typical\n * marketing → app conversion funnel that may span multiple\n * sessions, short enough to bound exposure if a token leaks. The\n * `cleanupExpiredSessions` batch uses a 48h `sessionTtlMs` to\n * leave a comfortable buffer between JWT expiry and DB cleanup.\n \n The string `'24h'` is the legacy expiry encoding (jsonwebtoken\n * accepts both `'24h'` and `expirySeconds`). The contract exposes\n * `expirySeconds` as the canonical numeric form; consumers using the\n * `jsonwebtoken` library can convert via\n * `${ANONYMOUS_SESSION_JWT_FORMAT.expirySeconds}s`.\n /\nexport const ANONYMOUS_SESSION_JWT_FORMAT = {\n algorithm: 'HS256',\n expirySeconds: 86400,\n} as const;\n\n/\n Convenience: jsonwebtoken's expiresIn-friendly string form.\n * Equivalent to `${expirySeconds}s` but pre-computed.\n /\nexport const ANONYMOUS_SESSION_JWT_EXPIRY_STRING = '24h' as const;\n\n\n// ═══════════════════════════════════════════════════════════════\n// JWT payload schema\n// ═══════════════════════════════════════════════════════════════\n\n/\n The exact shape of the JWT payload signed/verified for an\n * anonymous session.\n \n Both the backend (`signSessionToken` / `verifySessionToken`) and\n * any future client-side parser (e.g. for diagnostic UI showing\n * \"session expires in N hours\") must produce/consume payloads\n * matching this schema.\n \n - `anonymousUserId`: the client-generated session UUID — the\n * AnonymousUser's `uuidRef` (its relational identity), NOT the\n * server-minted MongoDB `_id`. The backend resolves ownership by\n * matching this against child `anonymousUserId` FKs (which carry the\n * same `uuidRef`) and the parent row's `uuidRef` during transposition.\n * Kept named `anonymousUserId` for wire/localStorage stability.\n * - `iat`/`exp`: standard JWT claims (seconds since epoch). Set by\n * `jsonwebtoken.sign()` automatically based on\n * `ANONYMOUS_SESSION_JWT_FORMAT.expirySeconds`.\n /\nexport const AnonymousSessionJwtPayloadSchema: z.ZodObject<{\n anonymousUserId: z.ZodString;\n iat: z.ZodNumber;\n exp: z.ZodNumber;\n}> = z.object({\n anonymousUserId: z.string().min(1),\n iat: z.number().int().nonnegative(),\n exp: z.number().int().nonnegative(),\n});\n\nexport type AnonymousSessionJwtPayload = z.infer<typeof AnonymousSessionJwtPayloadSchema>;\n\n\n// ═══════════════════════════════════════════════════════════════\n// Client-side state machine vocabulary\n// ═══════════════════════════════════════════════════════════════\n\n/\n The five client-side states an anonymous session passes through.\n \n This enum is the SHARED vocabulary between\n * `saas-frontend-lib`'s React `AnonymousSessionContext` and\n * `saas-website`'s lighter `WebsiteAnonymousSessionContext` — both\n * implement reducers over the same five states so debugging tooling\n * and conformance tests can reason about either one identically.\n \n State transitions (enforced by each implementation's reducer):\n \n IDLE → INITIALIZING : `initAnonymousSession()` is called; UUID\n * generated; first API call in flight with\n * `x-anonymous-session-init` header.\n * INITIALIZING → ACTIVE : server responds with\n * `x-anonymous-session-token`; JWT stored.\n * ACTIVE → ACTIVE : token rotation (new JWT received on a\n * subsequent response).\n * ACTIVE → TRANSPOSING : user starts to log in / register —\n * subsequent anonymous-session API calls are\n * blocked until backend transposition\n * finishes.\n * TRANSPOSING → CLEARED : backend transposition complete; auth\n * session takes over; localStorage entries\n * removed.\n * * → CLEARED : explicit logout/clear (rare on marketing\n * site; common on app side).\n \n Each implementation's reducer is responsible for rejecting illegal\n * transitions silently (return current state) — the conformance test\n * verifies both reducers agree on the legal-transition matrix.\n */\nexport enum AnonymousSessionStateMachineStatesEnum {\n IDLE = 'IDLE',\n INITIALIZING = 'INITIALIZING',\n ACTIVE = 'ACTIVE',\n TRANSPOSING = 'TRANSPOSING',\n CLEARED = 'CLEARED',\n}\n\nexport const AnonymousSessionStateMachineStatesSchema: z.ZodEnum<typeof AnonymousSessionStateMachineStatesEnum> =\n z.enum(AnonymousSessionStateMachineStatesEnum);\n\nexport type AnonymousSessionStateMachineState = z.infer<typeof AnonymousSessionStateMachineStatesSchema>;\n"]}
1	+ {"version":3,"file":"anonymous-session.shared.contract.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/anonymous-session/anonymous-session.shared.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAGvE,kEAAkE;AAClE,oBAAoB;AACpB,kEAAkE;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,iBAAiB,EAAQ,iBAAiB;IAC1C,uBAAuB,EAAE,uBAAuB;CACxC,CAAC;AAMX,kEAAkE;AAClE,2DAA2D;AAC3D,kEAAkE;AAElE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,IAAI,EAAK,eAAe,CAAC,sBAAsB;IAC/C,OAAO,EAAE,eAAe,CAAC,iBAAiB;IAC1C,KAAK,EAAI,eAAe,CAAC,uBAAuB;CACxC,CAAC;AAMX,kEAAkE;AAClE,qBAAqB;AACrB,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,SAAS,EAAM,OAAO;IACtB,aAAa,EAAE,KAAK;CACZ,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAc,CAAC;AAGlE,kEAAkE;AAClE,qBAAqB;AACrB,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAIxC,CAAC,CAAC,MAAM,CAAC;IACZ,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,GAAG,EAAc,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,GAAG,EAAc,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAChD,CAAC,CAAC;AAKH,kEAAkE;AAClE,uCAAuC;AACvC,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAN,IAAY,sCAMX;AAND,WAAY,sCAAsC;IAChD,uDAAqB,CAAA;IACrB,uEAA6B,CAAA;IAC7B,2DAAuB,CAAA;IACvB,qEAA4B,CAAA;IAC5B,6DAAwB,CAAA;AAC1B,CAAC,EANW,sCAAsC,KAAtC,sCAAsC,QAMjD;AAED,MAAM,CAAC,MAAM,wCAAwC,GACnD,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC","sourcesContent":["/*\n Anonymous Session — Shared Contract (W7.3a)\n \n Single source of truth for the constants/keys/format/state-machine\n * shape that any consumer of the anonymous-session feature MUST agree\n * on, regardless of runtime (browser, Astro static page, Node service).\n \n Consumers today:\n * - `engine/saas-frontend-lib`'s `AnonymousSessionContext.tsx` and\n * `local-storage.frontend.schemas.ts` (SaaS app, React, full HTTP\n * client integration)\n * - `engine/saas-backend-lib`'s\n * `security/authentications/services/anonymous-session.backend.service.ts`\n * (JWT signing/verification, transposition, cleanup)\n * - `engine/saas-website` (planned) — light, independent\n * `WebsiteAnonymousSessionContext` for the marketing/landing site\n * that intentionally does NOT depend on `saas-frontend-lib` to keep\n * the static-built bundle small (per `saas-website-slice.md` D16\n * Q17=B)\n \n Why the contract lives here (in `saas-models`) and not in\n * `saas-frontend-lib`:\n \n The marketing-website implementation must NOT import\n * `saas-frontend-lib` (it would pull in the full SaaS-app shell, MUI,\n * react-router, etc. — orders of magnitude larger than a marketing\n * site needs). At the same time, the marketing site MUST be\n * bit-compatible with the SaaS-app implementation so a user who\n * starts a session on `example.com` and continues on\n * `app.example.com` keeps the same `anonymousUserId`. The only safe\n * way to enforce that is to extract the concrete keys/headers/JWT\n * format/state-machine vocabulary into a React-free, runtime-free\n * module that all three consumers import from. Drift is then a\n * compile/test failure, not a silent runtime divergence.\n \n A cross-package conformance test\n * (`__tests__/anonymous-session.contract.conformance.test.ts`)\n * asserts that `saas-frontend-lib`'s public surface and\n * `saas-backend-lib`'s service implementation reference the canonical\n * values from this file.\n /\n\nimport { z } from 'zod';\nimport { WildoHeaderKeys } from '../../../requests/header-keys.shared';\n\n\n// ═══════════════════════════════════════════════════════════════\n// localStorage keys\n// ═══════════════════════════════════════════════════════════════\n\n/\n The exact `localStorage.getItem`/`setItem` keys used to persist the\n * anonymous session across page reloads and tabs.\n \n MUST stay in sync with\n * `engine/saas-frontend-lib/src/core/commons/local-storage.frontend.schemas.ts`\n * (`LOCAL_STORAGE_KEYS.ANONYMOUS_USER_ID` /\n * `LOCAL_STORAGE_KEYS.ANONYMOUS_SESSION_TOKEN`) — that enum re-exports\n * from this contract, so a single edit here propagates everywhere.\n \n Cross-tab sync via the `storage` event keys off these strings\n * literally — changing them is a breaking change for any user with an\n * existing localStorage entry.\n /\nexport const ANONYMOUS_SESSION_LOCAL_STORAGE_KEYS = {\n ANONYMOUS_USER_ID: 'anonymousUserId',\n ANONYMOUS_SESSION_TOKEN: 'anonymousSessionToken',\n} as const;\n\nexport type AnonymousSessionLocalStorageKey =\n typeof ANONYMOUS_SESSION_LOCAL_STORAGE_KEYS[keyof typeof ANONYMOUS_SESSION_LOCAL_STORAGE_KEYS];\n\n\n// ═══════════════════════════════════════════════════════════════\n// HTTP headers (re-exports for one-stop import ergonomics)\n// ═══════════════════════════════════════════════════════════════\n\n/\n The canonical HTTP header names used by the anonymous-session\n * protocol.\n \n These values are NOT redefined here — they are re-exported aliases\n * from `WildoHeaderKeys` (the single source of truth for all\n * platform header names, in `requests/header-keys.shared.ts`). The\n * alias exists purely so anonymous-session consumers have a single\n * import for everything they need.\n \n - `INIT`: client → server, on the FIRST request that creates the\n * AnonymousUser record. Carries the freshly-generated UUID. Server\n * responds with `TOKEN` (the signed JWT).\n * - `SESSION`: client → server, on every SUBSEQUENT request once the\n * JWT is held. Carries the JWT in the body of the header value.\n * - `TOKEN`: server → client, in the response that completes\n * initialization. Carries the freshly-signed JWT.\n /\nexport const ANONYMOUS_SESSION_HTTP_HEADERS = {\n INIT: WildoHeaderKeys.ANONYMOUS_SESSION_INIT,\n SESSION: WildoHeaderKeys.ANONYMOUS_SESSION,\n TOKEN: WildoHeaderKeys.ANONYMOUS_SESSION_TOKEN,\n} as const;\n\nexport type AnonymousSessionHttpHeader =\n typeof ANONYMOUS_SESSION_HTTP_HEADERS[keyof typeof ANONYMOUS_SESSION_HTTP_HEADERS];\n\n\n// ═══════════════════════════════════════════════════════════════\n// JWT signing format\n// ═══════════════════════════════════════════════════════════════\n\n/\n The cryptographic format for the anonymous-session JWT.\n \n Concrete values (algorithm, expiry) are pinned here so the backend\n * and any client that wants to parse the JWT (for diagnostic\n * purposes, e.g. expiry-aware UI) agree on the bit-level shape.\n \n - `algorithm`: HMAC-SHA256 — symmetric, signed with\n * `configService.secrets.security.session.secret`. Symmetric is\n * acceptable because verification only happens server-side\n * (clients treat the JWT as opaque); switching to RS256 would\n * require shipping a public key to the marketing site for nothing.\n * - `expirySeconds`: 24 hours — long enough to cover a typical\n * marketing → app conversion funnel that may span multiple\n * sessions, short enough to bound exposure if a token leaks. The\n * `cleanupExpiredSessions` batch uses a 48h `sessionTtlMs` to\n * leave a comfortable buffer between JWT expiry and DB cleanup.\n \n The string `'24h'` is the legacy expiry encoding (jsonwebtoken\n * accepts both `'24h'` and `expirySeconds`). The contract exposes\n * `expirySeconds` as the canonical numeric form; consumers using the\n * `jsonwebtoken` library can convert via\n * `${ANONYMOUS_SESSION_JWT_FORMAT.expirySeconds}s`.\n /\nexport const ANONYMOUS_SESSION_JWT_FORMAT = {\n algorithm: 'HS256',\n expirySeconds: 86400,\n} as const;\n\n/\n Convenience: jsonwebtoken's expiresIn-friendly string form.\n * Equivalent to `${expirySeconds}s` but pre-computed.\n /\nexport const ANONYMOUS_SESSION_JWT_EXPIRY_STRING = '24h' as const;\n\n\n// ═══════════════════════════════════════════════════════════════\n// JWT payload schema\n// ═══════════════════════════════════════════════════════════════\n\n/\n The exact shape of the JWT payload signed/verified for an\n * anonymous session.\n \n Both the backend (`signSessionToken` / `verifySessionToken`) and\n * any future client-side parser (e.g. for diagnostic UI showing\n * \"session expires in N hours\") must produce/consume payloads\n * matching this schema.\n \n - `anonymousUserId`: the client-generated session UUID — the\n * AnonymousUser's `uuidRef` (its relational identity), NOT the\n * server-minted MongoDB `_id`. The backend resolves ownership by\n * matching this against child `anonymousUserId` FKs (which carry the\n * same `uuidRef`) and the parent row's `uuidRef` during transposition.\n * Kept named `anonymousUserId` for wire/localStorage stability.\n * - `iat`/`exp`: standard JWT claims (seconds since epoch). Set by\n * `jsonwebtoken.sign()` automatically based on\n * `ANONYMOUS_SESSION_JWT_FORMAT.expirySeconds`.\n /\nexport const AnonymousSessionJwtPayloadSchema: z.ZodObject<{\n anonymousUserId: z.ZodString;\n iat: z.ZodNumber;\n exp: z.ZodNumber;\n}> = z.object({\n anonymousUserId: z.string().min(1),\n iat: z.number().int().nonnegative(),\n exp: z.number().int().nonnegative(),\n});\n\nexport type AnonymousSessionJwtPayload = z.infer<typeof AnonymousSessionJwtPayloadSchema>;\n\n\n// ═══════════════════════════════════════════════════════════════\n// Client-side state machine vocabulary\n// ═══════════════════════════════════════════════════════════════\n\n/\n The five client-side states an anonymous session passes through.\n \n This enum is the SHARED vocabulary between\n * `saas-frontend-lib`'s React `AnonymousSessionContext` and\n * `saas-website`'s lighter `WebsiteAnonymousSessionContext` — both\n * implement reducers over the same five states so debugging tooling\n * and conformance tests can reason about either one identically.\n \n State transitions (enforced by each implementation's reducer):\n \n IDLE → INITIALIZING : `initAnonymousSession()` is called; UUID\n * generated; first API call in flight with\n * `x-anonymous-session-init` header.\n * INITIALIZING → ACTIVE : server responds with\n * `x-anonymous-session-token`; JWT stored.\n * ACTIVE → ACTIVE : token rotation (new JWT received on a\n * subsequent response).\n * ACTIVE → TRANSPOSING : user starts to log in / register —\n * subsequent anonymous-session API calls are\n * blocked until backend transposition\n * finishes.\n * TRANSPOSING → CLEARED : backend transposition complete; auth\n * session takes over; localStorage entries\n * removed.\n * * → CLEARED : explicit logout/clear (rare on marketing\n * site; common on app side).\n \n Each implementation's reducer is responsible for rejecting illegal\n * transitions silently (return current state) — the conformance test\n * verifies both reducers agree on the legal-transition matrix.\n */\nexport enum AnonymousSessionStateMachineStatesEnum {\n IDLE = 'IDLE',\n INITIALIZING = 'INITIALIZING',\n ACTIVE = 'ACTIVE',\n TRANSPOSING = 'TRANSPOSING',\n CLEARED = 'CLEARED',\n}\n\nexport const AnonymousSessionStateMachineStatesSchema: z.ZodEnum<typeof AnonymousSessionStateMachineStatesEnum> =\n z.enum(AnonymousSessionStateMachineStatesEnum);\n\nexport type AnonymousSessionStateMachineState = z.infer<typeof AnonymousSessionStateMachineStatesSchema>;\n"]}

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAIlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;iBAWrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsDvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,oBAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,YAAY,iBAAiB;IAC7B,wFAAwF;IACxF,aAAa,kBAAkB;CAChC;AAED,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,0GAA0G;IACzJ,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,oKAAoK;IAGnN,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgJtC,CAAC;AAWH;;;GAGG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iDAAiD;;;kBAG5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}
1	+ {"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAIlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;iBAWrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsDvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,oBAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,YAAY,iBAAiB;IAC7B,wFAAwF;IACxF,aAAa,kBAAkB;CAChC;AAED,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,0GAA0G;IACzJ,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,oKAAoK;IAGnN,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgJtC,CAAC;AAWH;;;GAGG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iDAAiD;;;kBAG5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}