alepha 0.22.0 → 0.24.0

package/dist/api/keys/index.js

@@ -1,4 +1,4 @@
-import { $inject, $module, Alepha, t } from "alepha";
+import { $inject, $module, Alepha, z } from "alepha";
 import { $secure } from "alepha/security";
 import { $action, ForbiddenError, okSchema } from "alepha/server";
 import { $entity, $repository, db, pageQuerySchema, sql } from "alepha/orm";
@@ -7,48 +7,48 @@ import { $cache } from "alepha/cache";
 import { DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
 //#region ../../src/api/keys/schemas/adminApiKeyQuerySchema.ts
-const adminApiKeyQuerySchema = t.extend(pageQuerySchema, {
-	userId: t.optional(t.uuid()),
-	includeRevoked: t.optional(t.boolean())
+const adminApiKeyQuerySchema = pageQuerySchema.extend({
+	userId: z.uuid().optional(),
+	includeRevoked: z.boolean().optional()
 });
 //#endregion
 //#region ../../src/api/keys/schemas/adminApiKeyResourceSchema.ts
-const adminApiKeyResourceSchema = t.object({
-	id: t.uuid(),
-	userId: t.uuid(),
-	name: t.string(),
-	description: t.optional(t.string()),
-	tokenPrefix: t.string(),
-	tokenSuffix: t.string(),
-	roles: t.array(t.string()),
-	createdAt: t.datetime(),
-	lastUsedAt: t.optional(t.datetime()),
-	lastUsedIp: t.optional(t.string()),
-	expiresAt: t.optional(t.datetime()),
-	revokedAt: t.optional(t.datetime()),
-	usageCount: t.integer()
+const adminApiKeyResourceSchema = z.object({
+	id: z.uuid(),
+	userId: z.uuid(),
+	name: z.string(),
+	description: z.string().optional(),
+	tokenPrefix: z.string(),
+	tokenSuffix: z.string(),
+	roles: z.array(z.string()),
+	createdAt: z.datetime(),
+	lastUsedAt: z.datetime().optional(),
+	lastUsedIp: z.string().optional(),
+	expiresAt: z.datetime().optional(),
+	revokedAt: z.datetime().optional(),
+	usageCount: z.integer()
 });
 //#endregion
 //#region ../../src/api/keys/entities/apiKeyEntity.ts
 const apiKeyEntity = $entity({
 	name: "api_keys",
-	schema: t.object({
-		id: db.primaryKey(t.uuid()),
+	schema: z.object({
+		id: db.primaryKey(z.uuid()),
 		createdAt: db.createdAt(),
 		updatedAt: db.updatedAt(),
 		organizationId: db.organization(),
-		userId: t.uuid(),
-		name: t.text({ maxLength: 100 }),
-		description: t.optional(t.text({ maxLength: 500 })),
-		tokenHash: t.string({ maxLength: 256 }),
-		tokenPrefix: t.string({ maxLength: 10 }),
-		tokenSuffix: t.string({ maxLength: 8 }),
-		roles: db.default(t.array(t.string()), []),
-		lastUsedAt: t.optional(t.datetime()),
-		lastUsedIp: t.optional(t.string({ maxLength: 45 })),
-		usageCount: db.default(t.integer(), 0),
-		expiresAt: t.optional(t.datetime()),
-		revokedAt: t.optional(t.datetime())
+		userId: z.uuid(),
+		name: z.text({ maxLength: 100 }),
+		description: z.text({ maxLength: 500 }).optional(),
+		tokenHash: z.string().max(256),
+		tokenPrefix: z.string().max(10),
+		tokenSuffix: z.string().max(8),
+		roles: db.default(z.array(z.string()), []),
+		lastUsedAt: z.datetime().optional(),
+		lastUsedIp: z.string().max(45).optional(),
+		usageCount: db.default(z.integer(), 0),
+		expiresAt: z.datetime().optional(),
+		revokedAt: z.datetime().optional()
 	}),
 	indexes: [{
 		columns: ["userId", "name"],
@@ -277,7 +277,7 @@ var AdminApiKeyController = class {
 		description: "Find API keys with pagination and filtering",
 		schema: {
 			query: adminApiKeyQuerySchema,
-			response: t.page(adminApiKeyResourceSchema)
+			response: z.page(adminApiKeyResourceSchema)
 		},
 		handler: ({ query }) => {
 			const { userId, includeRevoked, ...pagination } = query;
@@ -297,7 +297,7 @@ var AdminApiKeyController = class {
 		use: [$secure({ permissions: ["admin:api-key:read"] })],
 		description: "Get an API key by ID",
 		schema: {
-			params: t.object({ id: t.uuid() }),
+			params: z.object({ id: z.uuid() }),
 			response: adminApiKeyResourceSchema
 		},
 		handler: ({ params }) => this.apiKeyService.getById(params.id)
@@ -312,7 +312,7 @@ var AdminApiKeyController = class {
 		use: [$secure({ permissions: ["admin:api-key:delete"] })],
 		description: "Revoke an API key",
 		schema: {
-			params: t.object({ id: t.uuid() }),
+			params: z.object({ id: z.uuid() }),
 			response: okSchema
 		},
 		handler: async ({ params }) => {
@@ -333,11 +333,8 @@ var AdminApiKeyController = class {
 		use: [$secure({ permissions: ["admin:api-key:delete"] })],
 		description: "Revoke many API keys",
 		schema: {
-			body: t.object({ ids: t.array(t.uuid(), {
-				minItems: 1,
-				maxItems: 1e3
-			}) }),
-			response: t.object({ revoked: t.array(t.uuid()) })
+			body: z.object({ ids: z.array(z.uuid()).min(1).max(1e3) }),
+			response: z.object({ revoked: z.array(z.uuid()) })
 		},
 		handler: async ({ body }) => {
 			return { revoked: await this.apiKeyService.revokeManyByAdmin(body.ids) };
@@ -346,46 +343,46 @@ var AdminApiKeyController = class {
 };
 //#endregion
 //#region ../../src/api/keys/schemas/createApiKeyBodySchema.ts
-const createApiKeyBodySchema = t.object({
-	name: t.text({
+const createApiKeyBodySchema = z.object({
+	name: z.text({
 		minLength: 1,
 		maxLength: 100
 	}),
-	description: t.optional(t.text({ maxLength: 500 })),
-	expiresAt: t.optional(t.datetime())
+	description: z.text({ maxLength: 500 }).optional(),
+	expiresAt: z.datetime().optional()
 });
 //#endregion
 //#region ../../src/api/keys/schemas/createApiKeyResponseSchema.ts
-const createApiKeyResponseSchema = t.object({
-	id: t.uuid(),
-	name: t.string(),
-	token: t.string(),
-	tokenSuffix: t.string(),
-	roles: t.array(t.string()),
-	createdAt: t.datetime(),
-	expiresAt: t.optional(t.datetime())
+const createApiKeyResponseSchema = z.object({
+	id: z.uuid(),
+	name: z.string(),
+	token: z.string(),
+	tokenSuffix: z.string(),
+	roles: z.array(z.string()),
+	createdAt: z.datetime(),
+	expiresAt: z.datetime().optional()
 });
 //#endregion
 //#region ../../src/api/keys/schemas/listApiKeyResponseSchema.ts
-const listApiKeyItemSchema = t.object({
-	id: t.uuid(),
-	name: t.string(),
-	tokenPrefix: t.string(),
-	tokenSuffix: t.string(),
-	roles: t.array(t.string()),
-	createdAt: t.datetime(),
-	lastUsedAt: t.optional(t.datetime()),
-	lastUsedIp: t.optional(t.string()),
-	expiresAt: t.optional(t.datetime()),
-	usageCount: t.integer()
+const listApiKeyItemSchema = z.object({
+	id: z.uuid(),
+	name: z.string(),
+	tokenPrefix: z.string(),
+	tokenSuffix: z.string(),
+	roles: z.array(z.string()),
+	createdAt: z.datetime(),
+	lastUsedAt: z.datetime().optional(),
+	lastUsedIp: z.string().optional(),
+	expiresAt: z.datetime().optional(),
+	usageCount: z.integer()
 });
-const listApiKeyResponseSchema = t.array(listApiKeyItemSchema);
+const listApiKeyResponseSchema = z.array(listApiKeyItemSchema);
 //#endregion
 //#region ../../src/api/keys/schemas/revokeApiKeyParamsSchema.ts
-const revokeApiKeyParamsSchema = t.object({ id: t.uuid() });
+const revokeApiKeyParamsSchema = z.object({ id: z.uuid() });
 //#endregion
 //#region ../../src/api/keys/schemas/revokeApiKeyResponseSchema.ts
-const revokeApiKeyResponseSchema = t.object({ ok: t.boolean() });
+const revokeApiKeyResponseSchema = z.object({ ok: z.boolean() });
 //#endregion
 //#region ../../src/api/keys/controllers/ApiKeyController.ts
 /**

package/dist/api/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/api/keys/schemas/adminApiKeyQuerySchema.ts","../../../src/api/keys/schemas/adminApiKeyResourceSchema.ts","../../../src/api/keys/entities/apiKeyEntity.ts","../../../src/api/keys/services/ApiKeyService.ts","../../../src/api/keys/controllers/AdminApiKeyController.ts","../../../src/api/keys/schemas/createApiKeyBodySchema.ts","../../../src/api/keys/schemas/createApiKeyResponseSchema.ts","../../../src/api/keys/schemas/listApiKeyResponseSchema.ts","../../../src/api/keys/schemas/revokeApiKeyParamsSchema.ts","../../../src/api/keys/schemas/revokeApiKeyResponseSchema.ts","../../../src/api/keys/controllers/ApiKeyController.ts","../../../src/api/keys/index.ts"],"sourcesContent":["import { t } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const adminApiKeyQuerySchema = t.extend(pageQuerySchema, {\n  userId: t.optional(t.uuid()),\n  includeRevoked: t.optional(t.boolean()),\n});\n","import { type Static, t } from \"alepha\";\n\nexport const adminApiKeyResourceSchema = t.object({\n  id: t.uuid(),\n  userId: t.uuid(),\n  name: t.string(),\n  description: t.optional(t.string()),\n  tokenPrefix: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  lastUsedAt: t.optional(t.datetime()),\n  lastUsedIp: t.optional(t.string()),\n  expiresAt: t.optional(t.datetime()),\n  revokedAt: t.optional(t.datetime()),\n  usageCount: t.integer(),\n});\n\nexport type AdminApiKeyResource = Static<typeof adminApiKeyResourceSchema>;\n","import { type Static, t } from \"alepha\";\nimport { $entity, db } from \"alepha/orm\";\n\nexport const apiKeyEntity = $entity({\n  name: \"api_keys\",\n  schema: t.object({\n    id: db.primaryKey(t.uuid()),\n    createdAt: db.createdAt(),\n    updatedAt: db.updatedAt(),\n    organizationId: db.organization(),\n\n    // Owner\n    userId: t.uuid(),\n\n    // Key metadata\n    name: t.text({ maxLength: 100 }),\n    description: t.optional(t.text({ maxLength: 500 })),\n\n    // Token (hashed) - internal, not user input\n    tokenHash: t.string({ maxLength: 256 }),\n    tokenPrefix: t.string({ maxLength: 10 }),\n    tokenSuffix: t.string({ maxLength: 8 }),\n\n    // Roles (snapshot from user at creation)\n    roles: db.default(t.array(t.string()), []),\n\n    // Tracking\n    lastUsedAt: t.optional(t.datetime()),\n    lastUsedIp: t.optional(t.string({ maxLength: 45 })),\n    usageCount: db.default(t.integer(), 0),\n\n    // Lifecycle\n    expiresAt: t.optional(t.datetime()),\n    revokedAt: t.optional(t.datetime()),\n  }),\n  indexes: [\n    { columns: [\"userId\", \"name\"], unique: true },\n    { columns: [\"tokenHash\"], unique: true },\n  ],\n});\n\nexport type ApiKeyEntity = Static<typeof apiKeyEntity.schema>;\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { $inject, Alepha } from \"alepha\";\nimport { $cache } from \"alepha/cache\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport { $repository, sql } from \"alepha/orm\";\nimport type { IssuerResolver, UserInfo } from \"alepha/security\";\nimport { ForbiddenError, type ServerRequest } from \"alepha/server\";\nimport { type ApiKeyEntity, apiKeyEntity } from \"../entities/apiKeyEntity.ts\";\n\nexport class ApiKeyService {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly log = $logger();\n  protected readonly repo = $repository(apiKeyEntity);\n\n  /**\n   * Cache validated API keys for 15 minutes.\n   *\n   * Pinned to per-isolate memory:\n   * - The cache replaces a single indexed SELECT on `api_keys`. Routing it\n   *   through a distributed K/V (KV/Redis) buys little — the SELECT is\n   *   already cheap — and pinning to DB would actively trade one SQL read\n   *   for another.\n   * - Cold-start gives a fresh DB read on every new isolate, which is\n   *   *better* for revocation visibility than a distributed cache that\n   *   keeps serving stale entries until its own TTL.\n   * - Avoids provisioning KV/Redis just for this one cache. Users who need\n   *   cross-isolate sharing for high-throughput API auth can override\n   *   globally via `alepha.with({ provide: CacheProvider, use: ... })`.\n   */\n  protected readonly validationCache = $cache<ApiKeyEntity | null, [string]>({\n    provider: \"memory\",\n    name: \"api:keys:validation\",\n    ttl: [15, \"minutes\"],\n  });\n\n  // -------------------------------------------------------------------------\n  // Resolver\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create an issuer resolver for API key authentication.\n   * Lower priority means it runs before JWT resolver.\n   *\n   * @param options.priority - Priority of this resolver (default: 50, JWT is 100)\n   * @param options.prefix - API key prefix to match in Bearer header (default: \"ak\")\n   */\n  public createResolver(\n    options: { priority?: number; prefix?: string } = {},\n  ): IssuerResolver {\n    const { priority = 50, prefix = \"ak\" } = options;\n    const prefixPattern = `${prefix}_`;\n\n    return {\n      priority,\n      onRequest: async (req: ServerRequest) => {\n        // Try query param first\n        const url = typeof req.url === \"string\" ? new URL(req.url) : req.url;\n        let token = url.searchParams.get(\"api_key\");\n\n        // Try Bearer header - only if token starts with expected prefix\n        if (!token) {\n          const auth = req.headers.authorization;\n          if (auth?.startsWith(\"Bearer \")) {\n            const bearerToken = auth.slice(7);\n            if (bearerToken.startsWith(prefixPattern)) {\n              token = bearerToken;\n            }\n          }\n        }\n\n        if (!token) {\n          return null;\n        }\n\n        return this.validate(token);\n      },\n    };\n  }\n\n  // -------------------------------------------------------------------------\n  // CRUD\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create a new API key for a user.\n   * Returns both the API key entity and the plain token (which is only available once).\n   */\n  public async create(options: {\n    userId: string;\n    name: string;\n    roles: string[];\n    description?: string;\n    expiresAt?: Date;\n    prefix?: string;\n  }): Promise<{ apiKey: ApiKeyEntity; token: string }> {\n    const prefix = options.prefix ?? \"ak\";\n    const random = randomBytes(24).toString(\"base64url\");\n    const token = `${prefix}_${random}`;\n    const hash = this.hashToken(token);\n    const suffix = token.slice(-8);\n\n    const apiKey = await this.repo.create({\n      userId: options.userId,\n      name: options.name,\n      description: options.description,\n      tokenHash: hash,\n      tokenPrefix: prefix,\n      tokenSuffix: suffix,\n      roles: options.roles,\n      expiresAt: options.expiresAt?.toISOString(),\n    });\n\n    this.log.info(\"API key created\", {\n      apiKeyId: apiKey.id,\n      userId: options.userId,\n      name: options.name,\n    });\n\n    return { apiKey, token };\n  }\n\n  /**\n   * List all non-revoked API keys for a user.\n   */\n  public async list(userId: string): Promise<ApiKeyEntity[]> {\n    return this.repo.findMany({\n      where: {\n        userId: { eq: userId },\n        revokedAt: { isNull: true },\n      },\n      orderBy: { column: \"createdAt\", direction: \"desc\" },\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Admin Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Find all API keys with optional filtering (admin only).\n   */\n  public async findAll(query: {\n    userId?: string;\n    includeRevoked?: boolean;\n    page?: number;\n    size?: number;\n    sort?: string;\n  }) {\n    query.sort ??= \"-createdAt\";\n\n    const where = this.repo.createQueryWhere();\n\n    if (query.userId) {\n      where.userId = { eq: query.userId };\n    }\n\n    if (!query.includeRevoked) {\n      where.revokedAt = { isNull: true };\n    }\n\n    return this.repo.paginate(query, { where }, { count: true });\n  }\n\n  /**\n   * Get an API key by ID (admin only).\n   */\n  public async getById(id: string): Promise<ApiKeyEntity> {\n    return await this.repo.getById(id);\n  }\n\n  /**\n   * Revoke any API key (admin only).\n   */\n  public async revokeByAdmin(id: string): Promise<void> {\n    const apiKey = await this.repo.getById(id);\n\n    if (apiKey.revokedAt) {\n      return; // Already revoked\n    }\n\n    // Invalidate cache\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked by admin\", {\n      apiKeyId: id,\n      userId: apiKey.userId,\n    });\n  }\n\n  /**\n   * Revoke many API keys in one repository call (admin only). Already-revoked\n   * keys are silently skipped. Returns the ids that were actually revoked.\n   */\n  public async revokeManyByAdmin(ids: string[]): Promise<string[]> {\n    if (ids.length === 0) return [];\n\n    const keys = await this.repo.findMany({\n      where: { id: { inArray: ids } },\n      columns: [\"id\", \"tokenHash\", \"revokedAt\"],\n    });\n    const toRevoke = keys.filter((k) => !k.revokedAt);\n    if (toRevoke.length === 0) return [];\n\n    await Promise.all(\n      toRevoke.map((k) => this.validationCache.invalidate(k.tokenHash)),\n    );\n\n    await this.repo.updateMany(\n      { id: { inArray: toRevoke.map((k) => k.id) } },\n      {\n        revokedAt: this.dateTimeProvider.now().toISOString(),\n      },\n    );\n\n    this.log.info(\"API keys revoked by admin\", { count: toRevoke.length });\n    return toRevoke.map((k) => k.id);\n  }\n\n  // -------------------------------------------------------------------------\n  // User Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public async revoke(id: string, userId: string): Promise<void> {\n    const apiKey = await this.repo.getById(id);\n\n    if (apiKey.userId !== userId) {\n      throw new ForbiddenError(\"Not your API key\");\n    }\n\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked\", {\n      apiKeyId: id,\n      userId,\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Validation\n  // -------------------------------------------------------------------------\n\n  /**\n   * Validate an API key token and return user info if valid.\n   */\n  public async validate(token: string): Promise<UserInfo | null> {\n    // Quick check for API key format\n    if (!token.includes(\"_\")) {\n      return null;\n    }\n\n    const hash = this.hashToken(token);\n\n    // Try cache first\n    let apiKey = await this.validationCache.get(hash);\n\n    // If not in cache, look up in database\n    if (apiKey === undefined) {\n      apiKey =\n        (await this.repo.findOne({\n          where: { tokenHash: { eq: hash } },\n        })) ?? null;\n\n      // Store in cache (even if null, to prevent repeated lookups)\n      await this.validationCache.set(hash, apiKey);\n    }\n\n    if (!apiKey) {\n      return null;\n    }\n\n    // Check revocation\n    if (apiKey.revokedAt) {\n      return null;\n    }\n\n    // Check expiration\n    if (\n      apiKey.expiresAt &&\n      this.dateTimeProvider.now().isAfter(apiKey.expiresAt)\n    ) {\n      return null;\n    }\n\n    // Update usage stats (fire and forget)\n    this.updateUsage(apiKey.id).catch((error) => {\n      this.log.warn(\"Failed to update API key usage\", { error });\n    });\n\n    return {\n      id: apiKey.userId,\n      roles: apiKey.roles,\n    };\n  }\n\n  /**\n   * Update usage statistics for an API key.\n   */\n  protected async updateUsage(id: string): Promise<void> {\n    const request = this.alepha.store.get(\"alepha.http.request\");\n\n    await this.repo.updateById(id, {\n      lastUsedAt: this.dateTimeProvider.now().toISOString(),\n      lastUsedIp: request?.ip,\n      usageCount: sql`${this.repo.table.usageCount} + 1`,\n    });\n  }\n\n  /**\n   * Hash a token using SHA-256.\n   */\n  protected hashToken(token: string): string {\n    return createHash(\"sha256\").update(token).digest(\"hex\");\n  }\n}\n","import { $inject, t } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action, okSchema } from \"alepha/server\";\nimport { adminApiKeyQuerySchema } from \"../schemas/adminApiKeyQuerySchema.ts\";\nimport { adminApiKeyResourceSchema } from \"../schemas/adminApiKeyResourceSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for admin API key management.\n * Admins can list, view, and revoke any API key.\n */\nexport class AdminApiKeyController {\n  protected readonly url = \"/admin/api-keys\";\n  protected readonly group = \"admin:api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Find all API keys with optional filtering.\n   */\n  public readonly findApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:read\"] })],\n    description: \"Find API keys with pagination and filtering\",\n    schema: {\n      query: adminApiKeyQuerySchema,\n      response: t.page(adminApiKeyResourceSchema),\n    },\n    handler: ({ query }) => {\n      const { userId, includeRevoked, ...pagination } = query;\n      return this.apiKeyService.findAll({\n        userId,\n        includeRevoked,\n        ...pagination,\n      });\n    },\n  });\n\n  /**\n   * Get an API key by ID.\n   */\n  public readonly getApiKey = $action({\n    path: `${this.url}/:id`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:read\"] })],\n    description: \"Get an API key by ID\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: adminApiKeyResourceSchema,\n    },\n    handler: ({ params }) => this.apiKeyService.getById(params.id),\n  });\n\n  /**\n   * Revoke any API key.\n   */\n  public readonly revokeApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:delete\"] })],\n    description: \"Revoke an API key\",\n    schema: {\n      params: t.object({\n        id: t.uuid(),\n      }),\n      response: okSchema,\n    },\n    handler: async ({ params }) => {\n      await this.apiKeyService.revokeByAdmin(params.id);\n      return { ok: true, id: params.id };\n    },\n  });\n\n  /**\n   * Revoke many API keys in one request.\n   */\n  public readonly revokeApiKeys = $action({\n    method: \"POST\",\n    path: `${this.url}/revoke`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:delete\"] })],\n    description: \"Revoke many API keys\",\n    schema: {\n      body: t.object({\n        ids: t.array(t.uuid(), { minItems: 1, maxItems: 1000 }),\n      }),\n      response: t.object({\n        revoked: t.array(t.uuid()),\n      }),\n    },\n    handler: async ({ body }) => {\n      const revoked = await this.apiKeyService.revokeManyByAdmin(body.ids);\n      return { revoked };\n    },\n  });\n}\n","import { t } from \"alepha\";\n\nexport const createApiKeyBodySchema = t.object({\n  name: t.text({ minLength: 1, maxLength: 100 }),\n  description: t.optional(t.text({ maxLength: 500 })),\n  expiresAt: t.optional(t.datetime()),\n});\n","import { t } from \"alepha\";\n\nexport const createApiKeyResponseSchema = t.object({\n  id: t.uuid(),\n  name: t.string(),\n  token: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  expiresAt: t.optional(t.datetime()),\n});\n","import { t } from \"alepha\";\n\nexport const listApiKeyItemSchema = t.object({\n  id: t.uuid(),\n  name: t.string(),\n  tokenPrefix: t.string(),\n  tokenSuffix: t.string(),\n  roles: t.array(t.string()),\n  createdAt: t.datetime(),\n  lastUsedAt: t.optional(t.datetime()),\n  lastUsedIp: t.optional(t.string()),\n  expiresAt: t.optional(t.datetime()),\n  usageCount: t.integer(),\n});\n\nexport const listApiKeyResponseSchema = t.array(listApiKeyItemSchema);\n","import { t } from \"alepha\";\n\nexport const revokeApiKeyParamsSchema = t.object({\n  id: t.uuid(),\n});\n","import { t } from \"alepha\";\n\nexport const revokeApiKeyResponseSchema = t.object({\n  ok: t.boolean(),\n});\n","import { $inject } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action } from \"alepha/server\";\nimport { createApiKeyBodySchema } from \"../schemas/createApiKeyBodySchema.ts\";\nimport { createApiKeyResponseSchema } from \"../schemas/createApiKeyResponseSchema.ts\";\nimport { listApiKeyResponseSchema } from \"../schemas/listApiKeyResponseSchema.ts\";\nimport { revokeApiKeyParamsSchema } from \"../schemas/revokeApiKeyParamsSchema.ts\";\nimport { revokeApiKeyResponseSchema } from \"../schemas/revokeApiKeyResponseSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for user's own API key management.\n * Users can create, list, and revoke their own API keys.\n */\nexport class ApiKeyController {\n  protected readonly url = \"/api-keys\";\n  protected readonly group = \"api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Create a new API key for the authenticated user.\n   * The token is only returned once upon creation.\n   */\n  public readonly createApiKey = $action({\n    method: \"POST\",\n    path: this.url,\n    group: this.group,\n    description: \"Create a new API key\",\n    use: [$secure({ permissions: [\"api-key:create\"] })],\n    schema: {\n      body: createApiKeyBodySchema,\n      response: createApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const { apiKey, token } = await this.apiKeyService.create({\n        userId: request.user.id,\n        name: request.body.name,\n        description: request.body.description,\n        roles: request.user.roles ?? [],\n        expiresAt: request.body.expiresAt\n          ? new Date(request.body.expiresAt)\n          : undefined,\n      });\n\n      return {\n        id: apiKey.id,\n        name: apiKey.name,\n        token,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        expiresAt: apiKey.expiresAt,\n      };\n    },\n  });\n\n  /**\n   * List all active API keys for the authenticated user.\n   * Does not return the actual tokens.\n   */\n  public readonly listApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    description: \"List your API keys\",\n    use: [$secure({ permissions: [\"api-key:read\"] })],\n    schema: {\n      response: listApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const apiKeys = await this.apiKeyService.list(request.user.id);\n\n      return apiKeys.map((apiKey) => ({\n        id: apiKey.id,\n        name: apiKey.name,\n        tokenPrefix: apiKey.tokenPrefix,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        lastUsedAt: apiKey.lastUsedAt,\n        lastUsedIp: apiKey.lastUsedIp,\n        expiresAt: apiKey.expiresAt,\n        usageCount: apiKey.usageCount,\n      }));\n    },\n  });\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public readonly revokeMyApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    description: \"Revoke an API key\",\n    use: [$secure({ permissions: [\"api-key:delete\"] })],\n    schema: {\n      params: revokeApiKeyParamsSchema,\n      response: revokeApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      await this.apiKeyService.revoke(request.params.id, request.user.id);\n      return { ok: true };\n    },\n  });\n}\n","import { $module } from \"alepha\";\nimport { AdminApiKeyController } from \"./controllers/AdminApiKeyController.ts\";\nimport { ApiKeyController } from \"./controllers/ApiKeyController.ts\";\nimport { ApiKeyService } from \"./services/ApiKeyService.ts\";\n\nexport * from \"./controllers/AdminApiKeyController.ts\";\nexport * from \"./controllers/ApiKeyController.ts\";\nexport * from \"./entities/apiKeyEntity.ts\";\nexport * from \"./schemas/adminApiKeyQuerySchema.ts\";\nexport * from \"./schemas/adminApiKeyResourceSchema.ts\";\nexport * from \"./schemas/createApiKeyBodySchema.ts\";\nexport * from \"./schemas/createApiKeyResponseSchema.ts\";\nexport * from \"./schemas/listApiKeyResponseSchema.ts\";\nexport * from \"./schemas/revokeApiKeyParamsSchema.ts\";\nexport * from \"./schemas/revokeApiKeyResponseSchema.ts\";\nexport * from \"./services/ApiKeyService.ts\";\n\n/**\n * API key management module for programmatic access.\n *\n * **Features:**\n * - Create API keys with role snapshots\n * - List and revoke API keys\n * - 15-minute validation caching\n * - Query param (?api_key=) and Bearer header support\n *\n * **Integration:**\n * To enable API key authentication for an issuer, register the resolver:\n *\n * ```ts\n * class MyApp {\n *   apiKeyService = $inject(ApiKeyService);\n *   issuer = $issuer({\n *     secret: env.APP_SECRET,\n *     resolvers: [this.apiKeyService.createResolver()],\n *   });\n * }\n * ```\n *\n * @module alepha.api.keys\n */\nexport const AlephaApiKeys = $module({\n  name: \"alepha.api.keys\",\n  services: [ApiKeyService, ApiKeyController, AdminApiKeyController],\n});\n"],"mappings":";;;;;;;;;AAGA,MAAa,yBAAyB,EAAE,OAAO,iBAAiB;CAC9D,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;CAC3B,gBAAgB,EAAE,SAAS,EAAE,QAAQ,CAAC;AACxC,CAAC;;;ACJD,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,KAAK;CACX,QAAQ,EAAE,KAAK;CACf,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC;CAClC,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;CACzB,WAAW,EAAE,SAAS;CACtB,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC;CACnC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC;CACjC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;CAClC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;CAClC,YAAY,EAAE,QAAQ;AACxB,CAAC;;;ACbD,MAAa,eAAe,QAAQ;CAClC,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,IAAI,GAAG,WAAW,EAAE,KAAK,CAAC;EAC1B,WAAW,GAAG,UAAU;EACxB,WAAW,GAAG,UAAU;EACxB,gBAAgB,GAAG,aAAa;EAGhC,QAAQ,EAAE,KAAK;EAGf,MAAM,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;EAC/B,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC;EAGlD,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,CAAC;EACtC,aAAa,EAAE,OAAO,EAAE,WAAW,GAAG,CAAC;EACvC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;EAGtC,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;EAGzC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC;EACnC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,GAAG,CAAC,CAAC;EAClD,YAAY,GAAG,QAAQ,EAAE,QAAQ,GAAG,CAAC;EAGrC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;EAClC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;CACpC,CAAC;CACD,SAAS,CACP;EAAE,SAAS,CAAC,UAAU,MAAM;EAAG,QAAQ;CAAK,GAC5C;EAAE,SAAS,CAAC,WAAW;EAAG,QAAQ;CAAK,CACzC;AACF,CAAC;;;AC7BD,IAAa,gBAAb,MAA2B;CACzB,SAA4B,QAAQ,MAAM;CAC1C,mBAAsC,QAAQ,gBAAgB;CAC9D,MAAyB,QAAQ;CACjC,OAA0B,YAAY,YAAY;;;;;;;;;;;;;;;;CAiBlD,kBAAqC,OAAsC;EACzE,UAAU;EACV,MAAM;EACN,KAAK,CAAC,IAAI,SAAS;CACrB,CAAC;;;;;;;;CAaD,eACE,UAAkD,CAAC,GACnC;EAChB,MAAM,EAAE,WAAW,IAAI,SAAS,SAAS;EACzC,MAAM,gBAAgB,GAAG,OAAO;EAEhC,OAAO;GACL;GACA,WAAW,OAAO,QAAuB;IAGvC,IAAI,SADQ,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,KACjD,aAAa,IAAI,SAAS;IAG1C,IAAI,CAAC,OAAO;KACV,MAAM,OAAO,IAAI,QAAQ;KACzB,IAAI,MAAM,WAAW,SAAS,GAAG;MAC/B,MAAM,cAAc,KAAK,MAAM,CAAC;MAChC,IAAI,YAAY,WAAW,aAAa,GACtC,QAAQ;KAEZ;IACF;IAEA,IAAI,CAAC,OACH,OAAO;IAGT,OAAO,KAAK,SAAS,KAAK;GAC5B;EACF;CACF;;;;;CAUA,MAAa,OAAO,SAOiC;EACnD,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,GAAG,OAAO,GADT,YAAY,EAAE,EAAE,SAAS,WACR;EAChC,MAAM,OAAO,KAAK,UAAU,KAAK;EACjC,MAAM,SAAS,MAAM,MAAM,EAAE;EAE7B,MAAM,SAAS,MAAM,KAAK,KAAK,OAAO;GACpC,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,aAAa,QAAQ;GACrB,WAAW;GACX,aAAa;GACb,aAAa;GACb,OAAO,QAAQ;GACf,WAAW,QAAQ,WAAW,YAAY;EAC5C,CAAC;EAED,KAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU,OAAO;GACjB,QAAQ,QAAQ;GAChB,MAAM,QAAQ;EAChB,CAAC;EAED,OAAO;GAAE;GAAQ;EAAM;CACzB;;;;CAKA,MAAa,KAAK,QAAyC;EACzD,OAAO,KAAK,KAAK,SAAS;GACxB,OAAO;IACL,QAAQ,EAAE,IAAI,OAAO;IACrB,WAAW,EAAE,QAAQ,KAAK;GAC5B;GACA,SAAS;IAAE,QAAQ;IAAa,WAAW;GAAO;EACpD,CAAC;CACH;;;;CASA,MAAa,QAAQ,OAMlB;EACD,MAAM,SAAS;EAEf,MAAM,QAAQ,KAAK,KAAK,iBAAiB;EAEzC,IAAI,MAAM,QACR,MAAM,SAAS,EAAE,IAAI,MAAM,OAAO;EAGpC,IAAI,CAAC,MAAM,gBACT,MAAM,YAAY,EAAE,QAAQ,KAAK;EAGnC,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE,MAAM,GAAG,EAAE,OAAO,KAAK,CAAC;CAC7D;;;;CAKA,MAAa,QAAQ,IAAmC;EACtD,OAAO,MAAM,KAAK,KAAK,QAAQ,EAAE;CACnC;;;;CAKA,MAAa,cAAc,IAA2B;EACpD,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,EAAE;EAEzC,IAAI,OAAO,WACT;EAIF,MAAM,KAAK,gBAAgB,WAAW,OAAO,SAAS;EAEtD,MAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,IAAI,EAAE,YAAY,EACrD,CAAC;EAED,KAAK,IAAI,KAAK,4BAA4B;GACxC,UAAU;GACV,QAAQ,OAAO;EACjB,CAAC;CACH;;;;;CAMA,MAAa,kBAAkB,KAAkC;EAC/D,IAAI,IAAI,WAAW,GAAG,OAAO,CAAC;EAM9B,MAAM,YAAW,MAJE,KAAK,KAAK,SAAS;GACpC,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE;GAC9B,SAAS;IAAC;IAAM;IAAa;GAAW;EAC1C,CAAC,GACqB,QAAQ,MAAM,CAAC,EAAE,SAAS;EAChD,IAAI,SAAS,WAAW,GAAG,OAAO,CAAC;EAEnC,MAAM,QAAQ,IACZ,SAAS,KAAK,MAAM,KAAK,gBAAgB,WAAW,EAAE,SAAS,CAAC,CAClE;EAEA,MAAM,KAAK,KAAK,WACd,EAAE,IAAI,EAAE,SAAS,SAAS,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,GAC7C,EACE,WAAW,KAAK,iBAAiB,IAAI,EAAE,YAAY,EACrD,CACF;EAEA,KAAK,IAAI,KAAK,6BAA6B,EAAE,OAAO,SAAS,OAAO,CAAC;EACrE,OAAO,SAAS,KAAK,MAAM,EAAE,EAAE;CACjC;;;;CASA,MAAa,OAAO,IAAY,QAA+B;EAC7D,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,EAAE;EAEzC,IAAI,OAAO,WAAW,QACpB,MAAM,IAAI,eAAe,kBAAkB;EAG7C,MAAM,KAAK,gBAAgB,WAAW,OAAO,SAAS;EAEtD,MAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,IAAI,EAAE,YAAY,EACrD,CAAC;EAED,KAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU;GACV;EACF,CAAC;CACH;;;;CASA,MAAa,SAAS,OAAyC;EAE7D,IAAI,CAAC,MAAM,SAAS,GAAG,GACrB,OAAO;EAGT,MAAM,OAAO,KAAK,UAAU,KAAK;EAGjC,IAAI,SAAS,MAAM,KAAK,gBAAgB,IAAI,IAAI;EAGhD,IAAI,WAAW,KAAA,GAAW;GACxB,SACG,MAAM,KAAK,KAAK,QAAQ,EACvB,OAAO,EAAE,WAAW,EAAE,IAAI,KAAK,EAAE,EACnC,CAAC,KAAM;GAGT,MAAM,KAAK,gBAAgB,IAAI,MAAM,MAAM;EAC7C;EAEA,IAAI,CAAC,QACH,OAAO;EAIT,IAAI,OAAO,WACT,OAAO;EAIT,IACE,OAAO,aACP,KAAK,iBAAiB,IAAI,EAAE,QAAQ,OAAO,SAAS,GAEpD,OAAO;EAIT,KAAK,YAAY,OAAO,EAAE,EAAE,OAAO,UAAU;GAC3C,KAAK,IAAI,KAAK,kCAAkC,EAAE,MAAM,CAAC;EAC3D,CAAC;EAED,OAAO;GACL,IAAI,OAAO;GACX,OAAO,OAAO;EAChB;CACF;;;;CAKA,MAAgB,YAAY,IAA2B;EACrD,MAAM,UAAU,KAAK,OAAO,MAAM,IAAI,qBAAqB;EAE3D,MAAM,KAAK,KAAK,WAAW,IAAI;GAC7B,YAAY,KAAK,iBAAiB,IAAI,EAAE,YAAY;GACpD,YAAY,SAAS;GACrB,YAAY,GAAG,GAAG,KAAK,KAAK,MAAM,WAAW;EAC/C,CAAC;CACH;;;;CAKA,UAAoB,OAAuB;EACzC,OAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;CACxD;AACF;;;;;;;AC3TA,IAAa,wBAAb,MAAmC;CACjC,MAAyB;CACzB,QAA2B;CAC3B,gBAAmC,QAAQ,aAAa;;;;CAKxD,cAA8B,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,EAAE,CAAC,CAAC;EACtD,aAAa;EACb,QAAQ;GACN,OAAO;GACP,UAAU,EAAE,KAAK,yBAAyB;EAC5C;EACA,UAAU,EAAE,YAAY;GACtB,MAAM,EAAE,QAAQ,gBAAgB,GAAG,eAAe;GAClD,OAAO,KAAK,cAAc,QAAQ;IAChC;IACA;IACA,GAAG;GACL,CAAC;EACH;CACF,CAAC;;;;CAKD,YAA4B,QAAQ;EAClC,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,EAAE,CAAC,CAAC;EACtD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU;EACZ;EACA,UAAU,EAAE,aAAa,KAAK,cAAc,QAAQ,OAAO,EAAE;CAC/D,CAAC;;;;CAKD,eAA+B,QAAQ;EACrC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,sBAAsB,EAAE,CAAC,CAAC;EACxD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU;EACZ;EACA,SAAS,OAAO,EAAE,aAAa;GAC7B,MAAM,KAAK,cAAc,cAAc,OAAO,EAAE;GAChD,OAAO;IAAE,IAAI;IAAM,IAAI,OAAO;GAAG;EACnC;CACF,CAAC;;;;CAKD,gBAAgC,QAAQ;EACtC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,sBAAsB,EAAE,CAAC,CAAC;EACxD,aAAa;EACb,QAAQ;GACN,MAAM,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG;IAAE,UAAU;IAAG,UAAU;GAAK,CAAC,EACxD,CAAC;GACD,UAAU,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAC3B,CAAC;EACH;EACA,SAAS,OAAO,EAAE,WAAW;GAE3B,OAAO,EAAE,SAAA,MADa,KAAK,cAAc,kBAAkB,KAAK,GAAG,EAClD;EACnB;CACF,CAAC;AACH;;;AChGA,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,EAAE,KAAK;EAAE,WAAW;EAAG,WAAW;CAAI,CAAC;CAC7C,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC;CAClD,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;AACpC,CAAC;;;ACJD,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,KAAK;CACX,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO;CAChB,aAAa,EAAE,OAAO;CACtB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;CACzB,WAAW,EAAE,SAAS;CACtB,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;AACpC,CAAC;;;ACRD,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,KAAK;CACX,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;CACzB,WAAW,EAAE,SAAS;CACtB,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC;CACnC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC;CACjC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;CAClC,YAAY,EAAE,QAAQ;AACxB,CAAC;AAED,MAAa,2BAA2B,EAAE,MAAM,oBAAoB;;;ACbpE,MAAa,2BAA2B,EAAE,OAAO,EAC/C,IAAI,EAAE,KAAK,EACb,CAAC;;;ACFD,MAAa,6BAA6B,EAAE,OAAO,EACjD,IAAI,EAAE,QAAQ,EAChB,CAAC;;;;;;;ACUD,IAAa,mBAAb,MAA8B;CAC5B,MAAyB;CACzB,QAA2B;CAC3B,gBAAmC,QAAQ,aAAa;;;;;CAMxD,eAA+B,QAAQ;EACrC,QAAQ;EACR,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;EAClD,QAAQ;GACN,MAAM;GACN,UAAU;EACZ;EACA,SAAS,OAAO,YAAY;GAC1B,MAAM,EAAE,QAAQ,UAAU,MAAM,KAAK,cAAc,OAAO;IACxD,QAAQ,QAAQ,KAAK;IACrB,MAAM,QAAQ,KAAK;IACnB,aAAa,QAAQ,KAAK;IAC1B,OAAO,QAAQ,KAAK,SAAS,CAAC;IAC9B,WAAW,QAAQ,KAAK,YACpB,IAAI,KAAK,QAAQ,KAAK,SAAS,IAC/B,KAAA;GACN,CAAC;GAED,OAAO;IACL,IAAI,OAAO;IACX,MAAM,OAAO;IACb;IACA,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,OAAO;GACpB;EACF;CACF,CAAC;;;;;CAMD,cAA8B,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;EAChD,QAAQ,EACN,UAAU,yBACZ;EACA,SAAS,OAAO,YAAY;GAG1B,QAAO,MAFe,KAAK,cAAc,KAAK,QAAQ,KAAK,EAAE,GAE9C,KAAK,YAAY;IAC9B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,YAAY,OAAO;IACnB,YAAY,OAAO;IACnB,WAAW,OAAO;IAClB,YAAY,OAAO;GACrB,EAAE;EACJ;CACF,CAAC;;;;CAKD,iBAAiC,QAAQ;EACvC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;EAClD,QAAQ;GACN,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,YAAY;GAC1B,MAAM,KAAK,cAAc,OAAO,QAAQ,OAAO,IAAI,QAAQ,KAAK,EAAE;GAClE,OAAO,EAAE,IAAI,KAAK;EACpB;CACF,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/DA,MAAa,gBAAgB,QAAQ;CACnC,MAAM;CACN,UAAU;EAAC;EAAe;EAAkB;CAAqB;AACnE,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/api/keys/schemas/adminApiKeyQuerySchema.ts","../../../src/api/keys/schemas/adminApiKeyResourceSchema.ts","../../../src/api/keys/entities/apiKeyEntity.ts","../../../src/api/keys/services/ApiKeyService.ts","../../../src/api/keys/controllers/AdminApiKeyController.ts","../../../src/api/keys/schemas/createApiKeyBodySchema.ts","../../../src/api/keys/schemas/createApiKeyResponseSchema.ts","../../../src/api/keys/schemas/listApiKeyResponseSchema.ts","../../../src/api/keys/schemas/revokeApiKeyParamsSchema.ts","../../../src/api/keys/schemas/revokeApiKeyResponseSchema.ts","../../../src/api/keys/controllers/ApiKeyController.ts","../../../src/api/keys/index.ts"],"sourcesContent":["import { z } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const adminApiKeyQuerySchema = pageQuerySchema.extend({\n  userId: z.uuid().optional(),\n  includeRevoked: z.boolean().optional(),\n});\n","import { type Static, z } from \"alepha\";\n\nexport const adminApiKeyResourceSchema = z.object({\n  id: z.uuid(),\n  userId: z.uuid(),\n  name: z.string(),\n  description: z.string().optional(),\n  tokenPrefix: z.string(),\n  tokenSuffix: z.string(),\n  roles: z.array(z.string()),\n  createdAt: z.datetime(),\n  lastUsedAt: z.datetime().optional(),\n  lastUsedIp: z.string().optional(),\n  expiresAt: z.datetime().optional(),\n  revokedAt: z.datetime().optional(),\n  usageCount: z.integer(),\n});\n\nexport type AdminApiKeyResource = Static<typeof adminApiKeyResourceSchema>;\n","import { type Static, z } from \"alepha\";\nimport { $entity, db } from \"alepha/orm\";\n\nexport const apiKeyEntity = $entity({\n  name: \"api_keys\",\n  schema: z.object({\n    id: db.primaryKey(z.uuid()),\n    createdAt: db.createdAt(),\n    updatedAt: db.updatedAt(),\n    organizationId: db.organization(),\n\n    // Owner\n    userId: z.uuid(),\n\n    // Key metadata\n    name: z.text({ maxLength: 100 }),\n    description: z.text({ maxLength: 500 }).optional(),\n\n    // Token (hashed) - internal, not user input\n    tokenHash: z.string().max(256),\n    tokenPrefix: z.string().max(10),\n    tokenSuffix: z.string().max(8),\n\n    // Roles (snapshot from user at creation)\n    roles: db.default(z.array(z.string()), []),\n\n    // Tracking\n    lastUsedAt: z.datetime().optional(),\n    lastUsedIp: z.string().max(45).optional(),\n    usageCount: db.default(z.integer(), 0),\n\n    // Lifecycle\n    expiresAt: z.datetime().optional(),\n    revokedAt: z.datetime().optional(),\n  }),\n  indexes: [\n    { columns: [\"userId\", \"name\"], unique: true },\n    { columns: [\"tokenHash\"], unique: true },\n  ],\n});\n\nexport type ApiKeyEntity = Static<typeof apiKeyEntity.schema>;\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { $inject, Alepha } from \"alepha\";\nimport { $cache } from \"alepha/cache\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport { $repository, sql } from \"alepha/orm\";\nimport type { IssuerResolver, UserInfo } from \"alepha/security\";\nimport { ForbiddenError, type ServerRequest } from \"alepha/server\";\nimport { type ApiKeyEntity, apiKeyEntity } from \"../entities/apiKeyEntity.ts\";\n\nexport class ApiKeyService {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly log = $logger();\n  protected readonly repo = $repository(apiKeyEntity);\n\n  /**\n   * Cache validated API keys for 15 minutes.\n   *\n   * Pinned to per-isolate memory:\n   * - The cache replaces a single indexed SELECT on `api_keys`. Routing it\n   *   through a distributed K/V (KV/Redis) buys little — the SELECT is\n   *   already cheap — and pinning to DB would actively trade one SQL read\n   *   for another.\n   * - Cold-start gives a fresh DB read on every new isolate, which is\n   *   *better* for revocation visibility than a distributed cache that\n   *   keeps serving stale entries until its own TTL.\n   * - Avoids provisioning KV/Redis just for this one cache. Users who need\n   *   cross-isolate sharing for high-throughput API auth can override\n   *   globally via `alepha.with({ provide: CacheProvider, use: ... })`.\n   */\n  protected readonly validationCache = $cache<ApiKeyEntity | null, [string]>({\n    provider: \"memory\",\n    name: \"api:keys:validation\",\n    ttl: [15, \"minutes\"],\n  });\n\n  // -------------------------------------------------------------------------\n  // Resolver\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create an issuer resolver for API key authentication.\n   * Lower priority means it runs before JWT resolver.\n   *\n   * @param options.priority - Priority of this resolver (default: 50, JWT is 100)\n   * @param options.prefix - API key prefix to match in Bearer header (default: \"ak\")\n   */\n  public createResolver(\n    options: { priority?: number; prefix?: string } = {},\n  ): IssuerResolver {\n    const { priority = 50, prefix = \"ak\" } = options;\n    const prefixPattern = `${prefix}_`;\n\n    return {\n      priority,\n      onRequest: async (req: ServerRequest) => {\n        // Try query param first\n        const url = typeof req.url === \"string\" ? new URL(req.url) : req.url;\n        let token = url.searchParams.get(\"api_key\");\n\n        // Try Bearer header - only if token starts with expected prefix\n        if (!token) {\n          const auth = req.headers.authorization;\n          if (auth?.startsWith(\"Bearer \")) {\n            const bearerToken = auth.slice(7);\n            if (bearerToken.startsWith(prefixPattern)) {\n              token = bearerToken;\n            }\n          }\n        }\n\n        if (!token) {\n          return null;\n        }\n\n        return this.validate(token);\n      },\n    };\n  }\n\n  // -------------------------------------------------------------------------\n  // CRUD\n  // -------------------------------------------------------------------------\n\n  /**\n   * Create a new API key for a user.\n   * Returns both the API key entity and the plain token (which is only available once).\n   */\n  public async create(options: {\n    userId: string;\n    name: string;\n    roles: string[];\n    description?: string;\n    expiresAt?: Date;\n    prefix?: string;\n  }): Promise<{ apiKey: ApiKeyEntity; token: string }> {\n    const prefix = options.prefix ?? \"ak\";\n    const random = randomBytes(24).toString(\"base64url\");\n    const token = `${prefix}_${random}`;\n    const hash = this.hashToken(token);\n    const suffix = token.slice(-8);\n\n    const apiKey = await this.repo.create({\n      userId: options.userId,\n      name: options.name,\n      description: options.description,\n      tokenHash: hash,\n      tokenPrefix: prefix,\n      tokenSuffix: suffix,\n      roles: options.roles,\n      expiresAt: options.expiresAt?.toISOString(),\n    });\n\n    this.log.info(\"API key created\", {\n      apiKeyId: apiKey.id,\n      userId: options.userId,\n      name: options.name,\n    });\n\n    return { apiKey, token };\n  }\n\n  /**\n   * List all non-revoked API keys for a user.\n   */\n  public async list(userId: string): Promise<ApiKeyEntity[]> {\n    return this.repo.findMany({\n      where: {\n        userId: { eq: userId },\n        revokedAt: { isNull: true },\n      },\n      orderBy: { column: \"createdAt\", direction: \"desc\" },\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Admin Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Find all API keys with optional filtering (admin only).\n   */\n  public async findAll(query: {\n    userId?: string;\n    includeRevoked?: boolean;\n    page?: number;\n    size?: number;\n    sort?: string;\n  }) {\n    query.sort ??= \"-createdAt\";\n\n    const where = this.repo.createQueryWhere();\n\n    if (query.userId) {\n      where.userId = { eq: query.userId };\n    }\n\n    if (!query.includeRevoked) {\n      where.revokedAt = { isNull: true };\n    }\n\n    return this.repo.paginate(query, { where }, { count: true });\n  }\n\n  /**\n   * Get an API key by ID (admin only).\n   */\n  public async getById(id: string): Promise<ApiKeyEntity> {\n    return await this.repo.getById(id);\n  }\n\n  /**\n   * Revoke any API key (admin only).\n   */\n  public async revokeByAdmin(id: string): Promise<void> {\n    const apiKey = await this.repo.getById(id);\n\n    if (apiKey.revokedAt) {\n      return; // Already revoked\n    }\n\n    // Invalidate cache\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked by admin\", {\n      apiKeyId: id,\n      userId: apiKey.userId,\n    });\n  }\n\n  /**\n   * Revoke many API keys in one repository call (admin only). Already-revoked\n   * keys are silently skipped. Returns the ids that were actually revoked.\n   */\n  public async revokeManyByAdmin(ids: string[]): Promise<string[]> {\n    if (ids.length === 0) return [];\n\n    const keys = await this.repo.findMany({\n      where: { id: { inArray: ids } },\n      columns: [\"id\", \"tokenHash\", \"revokedAt\"],\n    });\n    const toRevoke = keys.filter((k) => !k.revokedAt);\n    if (toRevoke.length === 0) return [];\n\n    await Promise.all(\n      toRevoke.map((k) => this.validationCache.invalidate(k.tokenHash)),\n    );\n\n    await this.repo.updateMany(\n      { id: { inArray: toRevoke.map((k) => k.id) } },\n      {\n        revokedAt: this.dateTimeProvider.now().toISOString(),\n      },\n    );\n\n    this.log.info(\"API keys revoked by admin\", { count: toRevoke.length });\n    return toRevoke.map((k) => k.id);\n  }\n\n  // -------------------------------------------------------------------------\n  // User Operations\n  // -------------------------------------------------------------------------\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public async revoke(id: string, userId: string): Promise<void> {\n    const apiKey = await this.repo.getById(id);\n\n    if (apiKey.userId !== userId) {\n      throw new ForbiddenError(\"Not your API key\");\n    }\n\n    await this.validationCache.invalidate(apiKey.tokenHash);\n\n    await this.repo.updateById(id, {\n      revokedAt: this.dateTimeProvider.now().toISOString(),\n    });\n\n    this.log.info(\"API key revoked\", {\n      apiKeyId: id,\n      userId,\n    });\n  }\n\n  // -------------------------------------------------------------------------\n  // Validation\n  // -------------------------------------------------------------------------\n\n  /**\n   * Validate an API key token and return user info if valid.\n   */\n  public async validate(token: string): Promise<UserInfo | null> {\n    // Quick check for API key format\n    if (!token.includes(\"_\")) {\n      return null;\n    }\n\n    const hash = this.hashToken(token);\n\n    // Try cache first\n    let apiKey = await this.validationCache.get(hash);\n\n    // If not in cache, look up in database\n    if (apiKey === undefined) {\n      apiKey =\n        (await this.repo.findOne({\n          where: { tokenHash: { eq: hash } },\n        })) ?? null;\n\n      // Store in cache (even if null, to prevent repeated lookups)\n      await this.validationCache.set(hash, apiKey);\n    }\n\n    if (!apiKey) {\n      return null;\n    }\n\n    // Check revocation\n    if (apiKey.revokedAt) {\n      return null;\n    }\n\n    // Check expiration\n    if (\n      apiKey.expiresAt &&\n      this.dateTimeProvider.now().isAfter(apiKey.expiresAt)\n    ) {\n      return null;\n    }\n\n    // Update usage stats (fire and forget)\n    this.updateUsage(apiKey.id).catch((error) => {\n      this.log.warn(\"Failed to update API key usage\", { error });\n    });\n\n    return {\n      id: apiKey.userId,\n      roles: apiKey.roles,\n    };\n  }\n\n  /**\n   * Update usage statistics for an API key.\n   */\n  protected async updateUsage(id: string): Promise<void> {\n    const request = this.alepha.store.get(\"alepha.http.request\");\n\n    await this.repo.updateById(id, {\n      lastUsedAt: this.dateTimeProvider.now().toISOString(),\n      lastUsedIp: request?.ip,\n      usageCount: sql`${this.repo.table.usageCount} + 1`,\n    });\n  }\n\n  /**\n   * Hash a token using SHA-256.\n   */\n  protected hashToken(token: string): string {\n    return createHash(\"sha256\").update(token).digest(\"hex\");\n  }\n}\n","import { $inject, z } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action, okSchema } from \"alepha/server\";\nimport { adminApiKeyQuerySchema } from \"../schemas/adminApiKeyQuerySchema.ts\";\nimport { adminApiKeyResourceSchema } from \"../schemas/adminApiKeyResourceSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for admin API key management.\n * Admins can list, view, and revoke any API key.\n */\nexport class AdminApiKeyController {\n  protected readonly url = \"/admin/api-keys\";\n  protected readonly group = \"admin:api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Find all API keys with optional filtering.\n   */\n  public readonly findApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:read\"] })],\n    description: \"Find API keys with pagination and filtering\",\n    schema: {\n      query: adminApiKeyQuerySchema,\n      response: z.page(adminApiKeyResourceSchema),\n    },\n    handler: ({ query }) => {\n      const { userId, includeRevoked, ...pagination } = query;\n      return this.apiKeyService.findAll({\n        userId,\n        includeRevoked,\n        ...pagination,\n      });\n    },\n  });\n\n  /**\n   * Get an API key by ID.\n   */\n  public readonly getApiKey = $action({\n    path: `${this.url}/:id`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:read\"] })],\n    description: \"Get an API key by ID\",\n    schema: {\n      params: z.object({\n        id: z.uuid(),\n      }),\n      response: adminApiKeyResourceSchema,\n    },\n    handler: ({ params }) => this.apiKeyService.getById(params.id),\n  });\n\n  /**\n   * Revoke any API key.\n   */\n  public readonly revokeApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:delete\"] })],\n    description: \"Revoke an API key\",\n    schema: {\n      params: z.object({\n        id: z.uuid(),\n      }),\n      response: okSchema,\n    },\n    handler: async ({ params }) => {\n      await this.apiKeyService.revokeByAdmin(params.id);\n      return { ok: true, id: params.id };\n    },\n  });\n\n  /**\n   * Revoke many API keys in one request.\n   */\n  public readonly revokeApiKeys = $action({\n    method: \"POST\",\n    path: `${this.url}/revoke`,\n    group: this.group,\n    use: [$secure({ permissions: [\"admin:api-key:delete\"] })],\n    description: \"Revoke many API keys\",\n    schema: {\n      body: z.object({\n        ids: z.array(z.uuid()).min(1).max(1000),\n      }),\n      response: z.object({\n        revoked: z.array(z.uuid()),\n      }),\n    },\n    handler: async ({ body }) => {\n      const revoked = await this.apiKeyService.revokeManyByAdmin(body.ids);\n      return { revoked };\n    },\n  });\n}\n","import { z } from \"alepha\";\n\nexport const createApiKeyBodySchema = z.object({\n  name: z.text({ minLength: 1, maxLength: 100 }),\n  description: z.text({ maxLength: 500 }).optional(),\n  expiresAt: z.datetime().optional(),\n});\n","import { z } from \"alepha\";\n\nexport const createApiKeyResponseSchema = z.object({\n  id: z.uuid(),\n  name: z.string(),\n  token: z.string(),\n  tokenSuffix: z.string(),\n  roles: z.array(z.string()),\n  createdAt: z.datetime(),\n  expiresAt: z.datetime().optional(),\n});\n","import { z } from \"alepha\";\n\nexport const listApiKeyItemSchema = z.object({\n  id: z.uuid(),\n  name: z.string(),\n  tokenPrefix: z.string(),\n  tokenSuffix: z.string(),\n  roles: z.array(z.string()),\n  createdAt: z.datetime(),\n  lastUsedAt: z.datetime().optional(),\n  lastUsedIp: z.string().optional(),\n  expiresAt: z.datetime().optional(),\n  usageCount: z.integer(),\n});\n\nexport const listApiKeyResponseSchema = z.array(listApiKeyItemSchema);\n","import { z } from \"alepha\";\n\nexport const revokeApiKeyParamsSchema = z.object({\n  id: z.uuid(),\n});\n","import { z } from \"alepha\";\n\nexport const revokeApiKeyResponseSchema = z.object({\n  ok: z.boolean(),\n});\n","import { $inject } from \"alepha\";\nimport { $secure } from \"alepha/security\";\nimport { $action } from \"alepha/server\";\nimport { createApiKeyBodySchema } from \"../schemas/createApiKeyBodySchema.ts\";\nimport { createApiKeyResponseSchema } from \"../schemas/createApiKeyResponseSchema.ts\";\nimport { listApiKeyResponseSchema } from \"../schemas/listApiKeyResponseSchema.ts\";\nimport { revokeApiKeyParamsSchema } from \"../schemas/revokeApiKeyParamsSchema.ts\";\nimport { revokeApiKeyResponseSchema } from \"../schemas/revokeApiKeyResponseSchema.ts\";\nimport { ApiKeyService } from \"../services/ApiKeyService.ts\";\n\n/**\n * REST API controller for user's own API key management.\n * Users can create, list, and revoke their own API keys.\n */\nexport class ApiKeyController {\n  protected readonly url = \"/api-keys\";\n  protected readonly group = \"api-keys\";\n  protected readonly apiKeyService = $inject(ApiKeyService);\n\n  /**\n   * Create a new API key for the authenticated user.\n   * The token is only returned once upon creation.\n   */\n  public readonly createApiKey = $action({\n    method: \"POST\",\n    path: this.url,\n    group: this.group,\n    description: \"Create a new API key\",\n    use: [$secure({ permissions: [\"api-key:create\"] })],\n    schema: {\n      body: createApiKeyBodySchema,\n      response: createApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const { apiKey, token } = await this.apiKeyService.create({\n        userId: request.user.id,\n        name: request.body.name,\n        description: request.body.description,\n        roles: request.user.roles ?? [],\n        expiresAt: request.body.expiresAt\n          ? new Date(request.body.expiresAt)\n          : undefined,\n      });\n\n      return {\n        id: apiKey.id,\n        name: apiKey.name,\n        token,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        expiresAt: apiKey.expiresAt,\n      };\n    },\n  });\n\n  /**\n   * List all active API keys for the authenticated user.\n   * Does not return the actual tokens.\n   */\n  public readonly listApiKeys = $action({\n    path: this.url,\n    group: this.group,\n    description: \"List your API keys\",\n    use: [$secure({ permissions: [\"api-key:read\"] })],\n    schema: {\n      response: listApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      const apiKeys = await this.apiKeyService.list(request.user.id);\n\n      return apiKeys.map((apiKey) => ({\n        id: apiKey.id,\n        name: apiKey.name,\n        tokenPrefix: apiKey.tokenPrefix,\n        tokenSuffix: apiKey.tokenSuffix,\n        roles: apiKey.roles,\n        createdAt: apiKey.createdAt,\n        lastUsedAt: apiKey.lastUsedAt,\n        lastUsedIp: apiKey.lastUsedIp,\n        expiresAt: apiKey.expiresAt,\n        usageCount: apiKey.usageCount,\n      }));\n    },\n  });\n\n  /**\n   * Revoke an API key. Only the owner can revoke their own keys.\n   */\n  public readonly revokeMyApiKey = $action({\n    method: \"DELETE\",\n    path: `${this.url}/:id`,\n    group: this.group,\n    description: \"Revoke an API key\",\n    use: [$secure({ permissions: [\"api-key:delete\"] })],\n    schema: {\n      params: revokeApiKeyParamsSchema,\n      response: revokeApiKeyResponseSchema,\n    },\n    handler: async (request) => {\n      await this.apiKeyService.revoke(request.params.id, request.user.id);\n      return { ok: true };\n    },\n  });\n}\n","import { $module } from \"alepha\";\nimport { AdminApiKeyController } from \"./controllers/AdminApiKeyController.ts\";\nimport { ApiKeyController } from \"./controllers/ApiKeyController.ts\";\nimport { ApiKeyService } from \"./services/ApiKeyService.ts\";\n\nexport * from \"./controllers/AdminApiKeyController.ts\";\nexport * from \"./controllers/ApiKeyController.ts\";\nexport * from \"./entities/apiKeyEntity.ts\";\nexport * from \"./schemas/adminApiKeyQuerySchema.ts\";\nexport * from \"./schemas/adminApiKeyResourceSchema.ts\";\nexport * from \"./schemas/createApiKeyBodySchema.ts\";\nexport * from \"./schemas/createApiKeyResponseSchema.ts\";\nexport * from \"./schemas/listApiKeyResponseSchema.ts\";\nexport * from \"./schemas/revokeApiKeyParamsSchema.ts\";\nexport * from \"./schemas/revokeApiKeyResponseSchema.ts\";\nexport * from \"./services/ApiKeyService.ts\";\n\n/**\n * API key management module for programmatic access.\n *\n * **Features:**\n * - Create API keys with role snapshots\n * - List and revoke API keys\n * - 15-minute validation caching\n * - Query param (?api_key=) and Bearer header support\n *\n * **Integration:**\n * To enable API key authentication for an issuer, register the resolver:\n *\n * ```ts\n * class MyApp {\n *   apiKeyService = $inject(ApiKeyService);\n *   issuer = $issuer({\n *     secret: env.APP_SECRET,\n *     resolvers: [this.apiKeyService.createResolver()],\n *   });\n * }\n * ```\n *\n * @module alepha.api.keys\n */\nexport const AlephaApiKeys = $module({\n  name: \"alepha.api.keys\",\n  services: [ApiKeyService, ApiKeyController, AdminApiKeyController],\n});\n"],"mappings":";;;;;;;;;AAGA,MAAa,yBAAyB,gBAAgB,OAAO;CAC3D,QAAQ,EAAE,KAAK,CAAC,CAAC,SAAS;CAC1B,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;AACvC,CAAC;;;ACJD,MAAa,4BAA4B,EAAE,OAAO;CAChD,IAAI,EAAE,KAAK;CACX,QAAQ,EAAE,KAAK;CACf,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;CACzB,WAAW,EAAE,SAAS;CACtB,YAAY,EAAE,SAAS,CAAC,CAAC,SAAS;CAClC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,WAAW,EAAE,SAAS,CAAC,CAAC,SAAS;CACjC,WAAW,EAAE,SAAS,CAAC,CAAC,SAAS;CACjC,YAAY,EAAE,QAAQ;AACxB,CAAC;;;ACbD,MAAa,eAAe,QAAQ;CAClC,MAAM;CACN,QAAQ,EAAE,OAAO;EACf,IAAI,GAAG,WAAW,EAAE,KAAK,CAAC;EAC1B,WAAW,GAAG,UAAU;EACxB,WAAW,GAAG,UAAU;EACxB,gBAAgB,GAAG,aAAa;EAGhC,QAAQ,EAAE,KAAK;EAGf,MAAM,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;EAC/B,aAAa,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS;EAGjD,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG;EAC7B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;EAC9B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAG7B,OAAO,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;EAGzC,YAAY,EAAE,SAAS,CAAC,CAAC,SAAS;EAClC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;EACxC,YAAY,GAAG,QAAQ,EAAE,QAAQ,GAAG,CAAC;EAGrC,WAAW,EAAE,SAAS,CAAC,CAAC,SAAS;EACjC,WAAW,EAAE,SAAS,CAAC,CAAC,SAAS;CACnC,CAAC;CACD,SAAS,CACP;EAAE,SAAS,CAAC,UAAU,MAAM;EAAG,QAAQ;CAAK,GAC5C;EAAE,SAAS,CAAC,WAAW;EAAG,QAAQ;CAAK,CACzC;AACF,CAAC;;;AC7BD,IAAa,gBAAb,MAA2B;CACzB,SAA4B,QAAQ,MAAM;CAC1C,mBAAsC,QAAQ,gBAAgB;CAC9D,MAAyB,QAAQ;CACjC,OAA0B,YAAY,YAAY;;;;;;;;;;;;;;;;CAiBlD,kBAAqC,OAAsC;EACzE,UAAU;EACV,MAAM;EACN,KAAK,CAAC,IAAI,SAAS;CACrB,CAAC;;;;;;;;CAaD,eACE,UAAkD,CAAC,GACnC;EAChB,MAAM,EAAE,WAAW,IAAI,SAAS,SAAS;EACzC,MAAM,gBAAgB,GAAG,OAAO;EAEhC,OAAO;GACL;GACA,WAAW,OAAO,QAAuB;IAGvC,IAAI,SADQ,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAA,CACjD,aAAa,IAAI,SAAS;IAG1C,IAAI,CAAC,OAAO;KACV,MAAM,OAAO,IAAI,QAAQ;KACzB,IAAI,MAAM,WAAW,SAAS,GAAG;MAC/B,MAAM,cAAc,KAAK,MAAM,CAAC;MAChC,IAAI,YAAY,WAAW,aAAa,GACtC,QAAQ;KAEZ;IACF;IAEA,IAAI,CAAC,OACH,OAAO;IAGT,OAAO,KAAK,SAAS,KAAK;GAC5B;EACF;CACF;;;;;CAUA,MAAa,OAAO,SAOiC;EACnD,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,GAAG,OAAO,GADT,YAAY,EAAE,CAAC,CAAC,SAAS,WACR;EAChC,MAAM,OAAO,KAAK,UAAU,KAAK;EACjC,MAAM,SAAS,MAAM,MAAM,EAAE;EAE7B,MAAM,SAAS,MAAM,KAAK,KAAK,OAAO;GACpC,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,aAAa,QAAQ;GACrB,WAAW;GACX,aAAa;GACb,aAAa;GACb,OAAO,QAAQ;GACf,WAAW,QAAQ,WAAW,YAAY;EAC5C,CAAC;EAED,KAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU,OAAO;GACjB,QAAQ,QAAQ;GAChB,MAAM,QAAQ;EAChB,CAAC;EAED,OAAO;GAAE;GAAQ;EAAM;CACzB;;;;CAKA,MAAa,KAAK,QAAyC;EACzD,OAAO,KAAK,KAAK,SAAS;GACxB,OAAO;IACL,QAAQ,EAAE,IAAI,OAAO;IACrB,WAAW,EAAE,QAAQ,KAAK;GAC5B;GACA,SAAS;IAAE,QAAQ;IAAa,WAAW;GAAO;EACpD,CAAC;CACH;;;;CASA,MAAa,QAAQ,OAMlB;EACD,MAAM,SAAS;EAEf,MAAM,QAAQ,KAAK,KAAK,iBAAiB;EAEzC,IAAI,MAAM,QACR,MAAM,SAAS,EAAE,IAAI,MAAM,OAAO;EAGpC,IAAI,CAAC,MAAM,gBACT,MAAM,YAAY,EAAE,QAAQ,KAAK;EAGnC,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE,MAAM,GAAG,EAAE,OAAO,KAAK,CAAC;CAC7D;;;;CAKA,MAAa,QAAQ,IAAmC;EACtD,OAAO,MAAM,KAAK,KAAK,QAAQ,EAAE;CACnC;;;;CAKA,MAAa,cAAc,IAA2B;EACpD,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,EAAE;EAEzC,IAAI,OAAO,WACT;EAIF,MAAM,KAAK,gBAAgB,WAAW,OAAO,SAAS;EAEtD,MAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,EACrD,CAAC;EAED,KAAK,IAAI,KAAK,4BAA4B;GACxC,UAAU;GACV,QAAQ,OAAO;EACjB,CAAC;CACH;;;;;CAMA,MAAa,kBAAkB,KAAkC;EAC/D,IAAI,IAAI,WAAW,GAAG,OAAO,CAAC;EAM9B,MAAM,YAAW,MAJE,KAAK,KAAK,SAAS;GACpC,OAAO,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE;GAC9B,SAAS;IAAC;IAAM;IAAa;GAAW;EAC1C,CAAC,EAAA,CACqB,QAAQ,MAAM,CAAC,EAAE,SAAS;EAChD,IAAI,SAAS,WAAW,GAAG,OAAO,CAAC;EAEnC,MAAM,QAAQ,IACZ,SAAS,KAAK,MAAM,KAAK,gBAAgB,WAAW,EAAE,SAAS,CAAC,CAClE;EAEA,MAAM,KAAK,KAAK,WACd,EAAE,IAAI,EAAE,SAAS,SAAS,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,GAC7C,EACE,WAAW,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,EACrD,CACF;EAEA,KAAK,IAAI,KAAK,6BAA6B,EAAE,OAAO,SAAS,OAAO,CAAC;EACrE,OAAO,SAAS,KAAK,MAAM,EAAE,EAAE;CACjC;;;;CASA,MAAa,OAAO,IAAY,QAA+B;EAC7D,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,EAAE;EAEzC,IAAI,OAAO,WAAW,QACpB,MAAM,IAAI,eAAe,kBAAkB;EAG7C,MAAM,KAAK,gBAAgB,WAAW,OAAO,SAAS;EAEtD,MAAM,KAAK,KAAK,WAAW,IAAI,EAC7B,WAAW,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY,EACrD,CAAC;EAED,KAAK,IAAI,KAAK,mBAAmB;GAC/B,UAAU;GACV;EACF,CAAC;CACH;;;;CASA,MAAa,SAAS,OAAyC;EAE7D,IAAI,CAAC,MAAM,SAAS,GAAG,GACrB,OAAO;EAGT,MAAM,OAAO,KAAK,UAAU,KAAK;EAGjC,IAAI,SAAS,MAAM,KAAK,gBAAgB,IAAI,IAAI;EAGhD,IAAI,WAAW,KAAA,GAAW;GACxB,SACG,MAAM,KAAK,KAAK,QAAQ,EACvB,OAAO,EAAE,WAAW,EAAE,IAAI,KAAK,EAAE,EACnC,CAAC,KAAM;GAGT,MAAM,KAAK,gBAAgB,IAAI,MAAM,MAAM;EAC7C;EAEA,IAAI,CAAC,QACH,OAAO;EAIT,IAAI,OAAO,WACT,OAAO;EAIT,IACE,OAAO,aACP,KAAK,iBAAiB,IAAI,CAAC,CAAC,QAAQ,OAAO,SAAS,GAEpD,OAAO;EAIT,KAAK,YAAY,OAAO,EAAE,CAAC,CAAC,OAAO,UAAU;GAC3C,KAAK,IAAI,KAAK,kCAAkC,EAAE,MAAM,CAAC;EAC3D,CAAC;EAED,OAAO;GACL,IAAI,OAAO;GACX,OAAO,OAAO;EAChB;CACF;;;;CAKA,MAAgB,YAAY,IAA2B;EACrD,MAAM,UAAU,KAAK,OAAO,MAAM,IAAI,qBAAqB;EAE3D,MAAM,KAAK,KAAK,WAAW,IAAI;GAC7B,YAAY,KAAK,iBAAiB,IAAI,CAAC,CAAC,YAAY;GACpD,YAAY,SAAS;GACrB,YAAY,GAAG,GAAG,KAAK,KAAK,MAAM,WAAW;EAC/C,CAAC;CACH;;;;CAKA,UAAoB,OAAuB;EACzC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;CACxD;AACF;;;;;;;AC3TA,IAAa,wBAAb,MAAmC;CACjC,MAAyB;CACzB,QAA2B;CAC3B,gBAAmC,QAAQ,aAAa;;;;CAKxD,cAA8B,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,EAAE,CAAC,CAAC;EACtD,aAAa;EACb,QAAQ;GACN,OAAO;GACP,UAAU,EAAE,KAAK,yBAAyB;EAC5C;EACA,UAAU,EAAE,YAAY;GACtB,MAAM,EAAE,QAAQ,gBAAgB,GAAG,eAAe;GAClD,OAAO,KAAK,cAAc,QAAQ;IAChC;IACA;IACA,GAAG;GACL,CAAC;EACH;CACF,CAAC;;;;CAKD,YAA4B,QAAQ;EAClC,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,oBAAoB,EAAE,CAAC,CAAC;EACtD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU;EACZ;EACA,UAAU,EAAE,aAAa,KAAK,cAAc,QAAQ,OAAO,EAAE;CAC/D,CAAC;;;;CAKD,eAA+B,QAAQ;EACrC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,sBAAsB,EAAE,CAAC,CAAC;EACxD,aAAa;EACb,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACb,CAAC;GACD,UAAU;EACZ;EACA,SAAS,OAAO,EAAE,aAAa;GAC7B,MAAM,KAAK,cAAc,cAAc,OAAO,EAAE;GAChD,OAAO;IAAE,IAAI;IAAM,IAAI,OAAO;GAAG;EACnC;CACF,CAAC;;;;CAKD,gBAAgC,QAAQ;EACtC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,sBAAsB,EAAE,CAAC,CAAC;EACxD,aAAa;EACb,QAAQ;GACN,MAAM,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,EACxC,CAAC;GACD,UAAU,EAAE,OAAO,EACjB,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAC3B,CAAC;EACH;EACA,SAAS,OAAO,EAAE,WAAW;GAE3B,OAAO,EAAE,SAAA,MADa,KAAK,cAAc,kBAAkB,KAAK,GAAG,EAClD;EACnB;CACF,CAAC;AACH;;;AChGA,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,EAAE,KAAK;EAAE,WAAW;EAAG,WAAW;CAAI,CAAC;CAC7C,aAAa,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS;CACjD,WAAW,EAAE,SAAS,CAAC,CAAC,SAAS;AACnC,CAAC;;;ACJD,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,KAAK;CACX,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO;CAChB,aAAa,EAAE,OAAO;CACtB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;CACzB,WAAW,EAAE,SAAS;CACtB,WAAW,EAAE,SAAS,CAAC,CAAC,SAAS;AACnC,CAAC;;;ACRD,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,KAAK;CACX,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;CACzB,WAAW,EAAE,SAAS;CACtB,YAAY,EAAE,SAAS,CAAC,CAAC,SAAS;CAClC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,WAAW,EAAE,SAAS,CAAC,CAAC,SAAS;CACjC,YAAY,EAAE,QAAQ;AACxB,CAAC;AAED,MAAa,2BAA2B,EAAE,MAAM,oBAAoB;;;ACbpE,MAAa,2BAA2B,EAAE,OAAO,EAC/C,IAAI,EAAE,KAAK,EACb,CAAC;;;ACFD,MAAa,6BAA6B,EAAE,OAAO,EACjD,IAAI,EAAE,QAAQ,EAChB,CAAC;;;;;;;ACUD,IAAa,mBAAb,MAA8B;CAC5B,MAAyB;CACzB,QAA2B;CAC3B,gBAAmC,QAAQ,aAAa;;;;;CAMxD,eAA+B,QAAQ;EACrC,QAAQ;EACR,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;EAClD,QAAQ;GACN,MAAM;GACN,UAAU;EACZ;EACA,SAAS,OAAO,YAAY;GAC1B,MAAM,EAAE,QAAQ,UAAU,MAAM,KAAK,cAAc,OAAO;IACxD,QAAQ,QAAQ,KAAK;IACrB,MAAM,QAAQ,KAAK;IACnB,aAAa,QAAQ,KAAK;IAC1B,OAAO,QAAQ,KAAK,SAAS,CAAC;IAC9B,WAAW,QAAQ,KAAK,YACpB,IAAI,KAAK,QAAQ,KAAK,SAAS,IAC/B,KAAA;GACN,CAAC;GAED,OAAO;IACL,IAAI,OAAO;IACX,MAAM,OAAO;IACb;IACA,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,WAAW,OAAO;GACpB;EACF;CACF,CAAC;;;;;CAMD,cAA8B,QAAQ;EACpC,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;EAChD,QAAQ,EACN,UAAU,yBACZ;EACA,SAAS,OAAO,YAAY;GAG1B,QAAO,MAFe,KAAK,cAAc,KAAK,QAAQ,KAAK,EAAE,EAAA,CAE9C,KAAK,YAAY;IAC9B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,aAAa,OAAO;IACpB,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,WAAW,OAAO;IAClB,YAAY,OAAO;IACnB,YAAY,OAAO;IACnB,WAAW,OAAO;IAClB,YAAY,OAAO;GACrB,EAAE;EACJ;CACF,CAAC;;;;CAKD,iBAAiC,QAAQ;EACvC,QAAQ;EACR,MAAM,GAAG,KAAK,IAAI;EAClB,OAAO,KAAK;EACZ,aAAa;EACb,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;EAClD,QAAQ;GACN,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,YAAY;GAC1B,MAAM,KAAK,cAAc,OAAO,QAAQ,OAAO,IAAI,QAAQ,KAAK,EAAE;GAClE,OAAO,EAAE,IAAI,KAAK;EACpB;CACF,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/DA,MAAa,gBAAgB,QAAQ;CACnC,MAAM;CACN,UAAU;EAAC;EAAe;EAAkB;CAAqB;AACnE,CAAC"}

package/dist/api/notifications/index.browser.js

@@ -1,60 +1,62 @@
-import { $module, t } from "alepha";
+import { $module, z } from "alepha";
 import { logEntrySchema } from "alepha/logger";
 import { pageQuerySchema } from "alepha/orm";
 //#region ../../src/api/notifications/schemas/notificationContactPreferencesSchema.ts
-const notificationContactPreferencesSchema = t.object({
-	language: t.optional(t.text()),
-	exclude: t.array(t.text())
+const notificationContactPreferencesSchema = z.object({
+	language: z.text().optional(),
+	exclude: z.array(z.text())
 });
 //#endregion
 //#region ../../src/api/notifications/schemas/notificationContactSchema.ts
-const notificationContactSchema = t.object({
-	email: t.optional(t.email()),
-	phoneNumber: t.optional(t.e164()),
-	firstName: t.optional(t.shortText()),
-	lastName: t.optional(t.text({ size: "short" })),
-	language: t.optional(t.bcp47())
+const notificationContactSchema = z.object({
+	email: z.email().optional(),
+	phoneNumber: z.e164().optional(),
+	firstName: z.shortText().optional(),
+	lastName: z.text({ size: "short" }).optional(),
+	language: z.bcp47().optional()
 });
 //#endregion
 //#region ../../src/api/notifications/schemas/notificationResourceSchema.ts
-const notificationResourceSchema = t.object({
-	id: t.uuid(),
-	createdAt: t.datetime(),
-	status: t.text(),
-	template: t.optional(t.text()),
-	type: t.optional(t.text()),
-	contact: t.optional(t.text()),
-	category: t.optional(t.text()),
-	critical: t.optional(t.boolean()),
-	sensitive: t.optional(t.boolean()),
-	startedAt: t.optional(t.datetime()),
-	completedAt: t.optional(t.datetime()),
-	error: t.optional(t.text())
+const notificationResourceSchema = z.object({
+	id: z.uuid(),
+	createdAt: z.datetime(),
+	status: z.text(),
+	template: z.text().optional(),
+	type: z.text().optional(),
+	contact: z.text().optional(),
+	category: z.text().optional(),
+	critical: z.boolean().optional(),
+	sensitive: z.boolean().optional(),
+	startedAt: z.datetime().optional(),
+	completedAt: z.datetime().optional(),
+	error: z.text().optional()
 });
 //#endregion
 //#region ../../src/api/notifications/schemas/notificationDetailResourceSchema.ts
-const notificationDetailResourceSchema = t.extend(notificationResourceSchema, {
-	variables: t.optional(t.record(t.text(), t.any())),
-	rendered: t.optional(t.record(t.text(), t.any())),
-	logs: t.optional(t.array(logEntrySchema))
-}, {
+const notificationDetailResourceSchema = notificationResourceSchema.extend({
+	variables: z.record(z.text(), z.any()).optional(),
+	rendered: z.record(z.text(), z.any()).optional(),
+	logs: z.array(logEntrySchema).optional()
+}).meta({
 	title: "NotificationDetailResource",
 	description: "A notification resource with rendered content and logs."
 });
 //#endregion
 //#region ../../src/api/notifications/schemas/notificationPayloadSchema.ts
-const notificationPayloadSchema = t.object({
-	type: t.enum(["email", "sms"]),
-	template: t.text(),
-	contact: t.text(),
-	variables: t.optional(t.record(t.text(), t.any())),
-	category: t.optional(t.text()),
-	critical: t.optional(t.boolean()),
-	sensitive: t.optional(t.boolean())
+const notificationPayloadSchema = z.object({
+	type: z.enum(["email", "sms"]),
+	template: z.text(),
+	contact: z.text(),
+	variables: z.record(z.text(), z.any()).optional(),
+	category: z.text().optional(),
+	critical: z.boolean().optional(),
+	sensitive: z.boolean().optional(),
+	/** Recipient language (e.g. "fr" or "fr-FR") used to pick `translations`. */
+	lang: z.text().optional()
 });
 //#endregion
 //#region ../../src/api/notifications/schemas/notificationQuerySchema.ts
-const notificationQuerySchema = t.extend(pageQuerySchema, { status: t.optional(t.enum([
+const notificationQuerySchema = pageQuerySchema.extend({ status: z.enum([
 	"pending",
 	"scheduled",
 	"retrying",
@@ -62,7 +64,7 @@ const notificationQuerySchema = t.extend(pageQuerySchema, { status: t.optional(t
 	"completed",
 	"dead",
 	"cancelled"
-])) });
+]).optional() });
 //#endregion
 //#region ../../src/api/notifications/index.browser.ts
 const AlephaApiNotifications = $module({

package/dist/api/notifications/index.browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.js","names":[],"sources":["../../../src/api/notifications/schemas/notificationContactPreferencesSchema.ts","../../../src/api/notifications/schemas/notificationContactSchema.ts","../../../src/api/notifications/schemas/notificationResourceSchema.ts","../../../src/api/notifications/schemas/notificationDetailResourceSchema.ts","../../../src/api/notifications/schemas/notificationPayloadSchema.ts","../../../src/api/notifications/schemas/notificationQuerySchema.ts","../../../src/api/notifications/index.browser.ts"],"sourcesContent":["import { type Static, t } from \"alepha\";\n\nexport const notificationContactPreferencesSchema = t.object({\n  language: t.optional(t.text()),\n  exclude: t.array(t.text()),\n});\n\nexport type NotificationContactPreferences = Static<\n  typeof notificationContactPreferencesSchema\n>;\n","import { type Static, t } from \"alepha\";\n\nexport const notificationContactSchema = t.object({\n  email: t.optional(t.email()),\n  phoneNumber: t.optional(t.e164()),\n  firstName: t.optional(t.shortText()),\n  lastName: t.optional(t.text({ size: \"short\" })),\n  language: t.optional(t.bcp47()),\n});\n\nexport type NotificationContact = Static<typeof notificationContactSchema>;\n","import { type Static, t } from \"alepha\";\n\nexport const notificationResourceSchema = t.object({\n  id: t.uuid(),\n  createdAt: t.datetime(),\n  status: t.text(),\n  template: t.optional(t.text()),\n  type: t.optional(t.text()),\n  contact: t.optional(t.text()),\n  category: t.optional(t.text()),\n  critical: t.optional(t.boolean()),\n  sensitive: t.optional(t.boolean()),\n  startedAt: t.optional(t.datetime()),\n  completedAt: t.optional(t.datetime()),\n  error: t.optional(t.text()),\n});\n\nexport type NotificationResource = Static<typeof notificationResourceSchema>;\n","import { type Static, t } from \"alepha\";\nimport { logEntrySchema } from \"alepha/logger\";\nimport { notificationResourceSchema } from \"./notificationResourceSchema.ts\";\n\nexport const notificationDetailResourceSchema = t.extend(\n  notificationResourceSchema,\n  {\n    variables: t.optional(t.record(t.text(), t.any())),\n    rendered: t.optional(t.record(t.text(), t.any())),\n    logs: t.optional(t.array(logEntrySchema)),\n  },\n  {\n    title: \"NotificationDetailResource\",\n    description: \"A notification resource with rendered content and logs.\",\n  },\n);\n\nexport type NotificationDetailResource = Static<\n  typeof notificationDetailResourceSchema\n>;\n","import { type Static, t } from \"alepha\";\n\nexport const notificationPayloadSchema = t.object({\n  type: t.enum([\"email\", \"sms\"]),\n  template: t.text(),\n  contact: t.text(),\n  variables: t.optional(t.record(t.text(), t.any())),\n  category: t.optional(t.text()),\n  critical: t.optional(t.boolean()),\n  sensitive: t.optional(t.boolean()),\n});\n\nexport type NotificationPayload = Static<typeof notificationPayloadSchema>;\n","import { type Static, t } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const notificationQuerySchema = t.extend(pageQuerySchema, {\n  status: t.optional(\n    t.enum([\n      \"pending\",\n      \"scheduled\",\n      \"retrying\",\n      \"running\",\n      \"completed\",\n      \"dead\",\n      \"cancelled\",\n    ]),\n  ),\n});\n\nexport type NotificationQuery = Static<typeof notificationQuerySchema>;\n","import { $module } from \"alepha\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./schemas/notificationContactPreferencesSchema.ts\";\nexport * from \"./schemas/notificationContactSchema.ts\";\nexport * from \"./schemas/notificationDetailResourceSchema.ts\";\nexport * from \"./schemas/notificationPayloadSchema.ts\";\nexport * from \"./schemas/notificationQuerySchema.ts\";\nexport * from \"./schemas/notificationResourceSchema.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const AlephaApiNotifications = $module({\n  name: \"alepha.api.notifications\",\n  services: [],\n});\n"],"mappings":";;;;AAEA,MAAa,uCAAuC,EAAE,OAAO;CAC3D,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;CAC7B,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC;AAC3B,CAAC;;;ACHD,MAAa,4BAA4B,EAAE,OAAO;CAChD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;CAC3B,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC;CAChC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC;CACnC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC9C,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC;AAChC,CAAC;;;ACND,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,KAAK;CACX,WAAW,EAAE,SAAS;CACtB,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;CAC7B,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;CACzB,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC;CAC5B,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;CAC7B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;CACjC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;CAClC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;CACpC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC;AAC5B,CAAC;;;ACXD,MAAa,mCAAmC,EAAE,OAChD,4BACA;CACE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC;CACjD,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC;CAChD,MAAM,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1C,GACA;CACE,OAAO;CACP,aAAa;AACf,CACF;;;ACbA,MAAa,4BAA4B,EAAE,OAAO;CAChD,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC;CAC7B,UAAU,EAAE,KAAK;CACjB,SAAS,EAAE,KAAK;CAChB,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC;CACjD,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;CAC7B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;AACnC,CAAC;;;ACPD,MAAa,0BAA0B,EAAE,OAAO,iBAAiB,EAC/D,QAAQ,EAAE,SACR,EAAE,KAAK;CACL;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CACH,EACF,CAAC;;;ACFD,MAAa,yBAAyB,QAAQ;CAC5C,MAAM;CACN,UAAU,CAAC;AACb,CAAC"}
+{"version":3,"file":"index.browser.js","names":[],"sources":["../../../src/api/notifications/schemas/notificationContactPreferencesSchema.ts","../../../src/api/notifications/schemas/notificationContactSchema.ts","../../../src/api/notifications/schemas/notificationResourceSchema.ts","../../../src/api/notifications/schemas/notificationDetailResourceSchema.ts","../../../src/api/notifications/schemas/notificationPayloadSchema.ts","../../../src/api/notifications/schemas/notificationQuerySchema.ts","../../../src/api/notifications/index.browser.ts"],"sourcesContent":["import { type Static, z } from \"alepha\";\n\nexport const notificationContactPreferencesSchema = z.object({\n  language: z.text().optional(),\n  exclude: z.array(z.text()),\n});\n\nexport type NotificationContactPreferences = Static<\n  typeof notificationContactPreferencesSchema\n>;\n","import { type Static, z } from \"alepha\";\n\nexport const notificationContactSchema = z.object({\n  email: z.email().optional(),\n  phoneNumber: z.e164().optional(),\n  firstName: z.shortText().optional(),\n  lastName: z.text({ size: \"short\" }).optional(),\n  language: z.bcp47().optional(),\n});\n\nexport type NotificationContact = Static<typeof notificationContactSchema>;\n","import { type Static, z } from \"alepha\";\n\nexport const notificationResourceSchema = z.object({\n  id: z.uuid(),\n  createdAt: z.datetime(),\n  status: z.text(),\n  template: z.text().optional(),\n  type: z.text().optional(),\n  contact: z.text().optional(),\n  category: z.text().optional(),\n  critical: z.boolean().optional(),\n  sensitive: z.boolean().optional(),\n  startedAt: z.datetime().optional(),\n  completedAt: z.datetime().optional(),\n  error: z.text().optional(),\n});\n\nexport type NotificationResource = Static<typeof notificationResourceSchema>;\n","import { type Static, z } from \"alepha\";\nimport { logEntrySchema } from \"alepha/logger\";\nimport { notificationResourceSchema } from \"./notificationResourceSchema.ts\";\n\nexport const notificationDetailResourceSchema = notificationResourceSchema\n  .extend({\n    variables: z.record(z.text(), z.any()).optional(),\n    rendered: z.record(z.text(), z.any()).optional(),\n    logs: z.array(logEntrySchema).optional(),\n  })\n  .meta({\n    title: \"NotificationDetailResource\",\n    description: \"A notification resource with rendered content and logs.\",\n  });\n\nexport type NotificationDetailResource = Static<\n  typeof notificationDetailResourceSchema\n>;\n","import { type Static, z } from \"alepha\";\n\nexport const notificationPayloadSchema = z.object({\n  type: z.enum([\"email\", \"sms\"]),\n  template: z.text(),\n  contact: z.text(),\n  variables: z.record(z.text(), z.any()).optional(),\n  category: z.text().optional(),\n  critical: z.boolean().optional(),\n  sensitive: z.boolean().optional(),\n  /** Recipient language (e.g. \"fr\" or \"fr-FR\") used to pick `translations`. */\n  lang: z.text().optional(),\n});\n\nexport type NotificationPayload = Static<typeof notificationPayloadSchema>;\n","import { type Static, z } from \"alepha\";\nimport { pageQuerySchema } from \"alepha/orm\";\n\nexport const notificationQuerySchema = pageQuerySchema.extend({\n  status: z\n    .enum([\n      \"pending\",\n      \"scheduled\",\n      \"retrying\",\n      \"running\",\n      \"completed\",\n      \"dead\",\n      \"cancelled\",\n    ])\n    .optional(),\n});\n\nexport type NotificationQuery = Static<typeof notificationQuerySchema>;\n","import { $module } from \"alepha\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./schemas/notificationContactPreferencesSchema.ts\";\nexport * from \"./schemas/notificationContactSchema.ts\";\nexport * from \"./schemas/notificationDetailResourceSchema.ts\";\nexport * from \"./schemas/notificationPayloadSchema.ts\";\nexport * from \"./schemas/notificationQuerySchema.ts\";\nexport * from \"./schemas/notificationResourceSchema.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const AlephaApiNotifications = $module({\n  name: \"alepha.api.notifications\",\n  services: [],\n});\n"],"mappings":";;;;AAEA,MAAa,uCAAuC,EAAE,OAAO;CAC3D,UAAU,EAAE,KAAK,CAAC,CAAC,SAAS;CAC5B,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC;AAC3B,CAAC;;;ACHD,MAAa,4BAA4B,EAAE,OAAO;CAChD,OAAO,EAAE,MAAM,CAAC,CAAC,SAAS;CAC1B,aAAa,EAAE,KAAK,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,UAAU,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,SAAS;CAC7C,UAAU,EAAE,MAAM,CAAC,CAAC,SAAS;AAC/B,CAAC;;;ACND,MAAa,6BAA6B,EAAE,OAAO;CACjD,IAAI,EAAE,KAAK;CACX,WAAW,EAAE,SAAS;CACtB,QAAQ,EAAE,KAAK;CACf,UAAU,EAAE,KAAK,CAAC,CAAC,SAAS;CAC5B,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS;CACxB,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS;CAC3B,UAAU,EAAE,KAAK,CAAC,CAAC,SAAS;CAC5B,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,WAAW,EAAE,SAAS,CAAC,CAAC,SAAS;CACjC,aAAa,EAAE,SAAS,CAAC,CAAC,SAAS;CACnC,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS;AAC3B,CAAC;;;ACXD,MAAa,mCAAmC,2BAC7C,OAAO;CACN,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;CAChD,UAAU,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;CAC/C,MAAM,EAAE,MAAM,cAAc,CAAC,CAAC,SAAS;AACzC,CAAC,CAAC,CACD,KAAK;CACJ,OAAO;CACP,aAAa;AACf,CAAC;;;ACXH,MAAa,4BAA4B,EAAE,OAAO;CAChD,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC;CAC7B,UAAU,EAAE,KAAK;CACjB,SAAS,EAAE,KAAK;CAChB,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;CAChD,UAAU,EAAE,KAAK,CAAC,CAAC,SAAS;CAC5B,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;;CAEhC,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS;AAC1B,CAAC;;;ACTD,MAAa,0BAA0B,gBAAgB,OAAO,EAC5D,QAAQ,EACL,KAAK;CACJ;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,CACD,SAAS,EACd,CAAC;;;ACFD,MAAa,yBAAyB,QAAQ;CAC5C,MAAM;CACN,UAAU,CAAC;AACb,CAAC"}