tapimo 0.11.0 → 0.13.0

package/dist/apps/management/routes/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../src/apps/management/routes/api-keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAM7B,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAA;AAK3C,OAAO,KAAK,QAAQ,MAAM,+BAA+B,CAAA;AAKzD,kDAAkD;AAClD,yBAAiB,MAAM,CAAC;IACtB,oEAAoE;IAC7D,MAAM,GAAG;;;;;;;;;;;;;;;;qBAsEf,CAAA;IAED,6DAA6D;IACtD,MAAM,MAAM;;;qBAe8C,CAAA;IAEjE,mEAAmE;IAC5D,MAAM,SAAS;;qBASiD,CAAA;IAEvE,8CAA8C;IACvC,MAAM,SAAS;;;;qBAqBkC,CAAA;IAExD,2EAA2E;IACpE,MAAM,OAAO;;;;;;;;qBA4BkC,CAAA;IAEtD,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B,8CAA8C;QACvC,MAAM,QAAQ;;;;;;;;;;;;;;;;;yBAUpB,CAAA;KACF;IAED,6CAA6C;IAC7C,UAAiB,WAAW,CAAC;QAC3B,mDAAmD;QAC5C,MAAM,KAAK;;;;;0BAEgD,CAAA;QAElE,8CAA8C;QACvC,MAAM,QAAQ;;;;;;;;;;;;;;;;;;yBAKpB,CAAA;KACF;IAED,gDAAgD;IAChD,UAAiB,cAAc,CAAC;QAC9B,0DAA0D;QACnD,MAAM,KAAK;;;;;0BAEsD,CAAA;QAExE,2DAA2D;QACpD,MAAM,QAAQ;;;;;;;;;;;;;;;;;;yBAOpB,CAAA;KACF;IAED,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B,6CAA6C;QACtC,MAAM,QAAQ;;yBASyC,CAAA;KAC/D;IAED,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B,+DAA+D;QACxD,MAAM,IAAI;;yBASuD,CAAA;KACzE;CACF;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,OAAO,CAAC,OAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2HAmVpD;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,kDAAkD;IAClD,KAAK,OAAO,GAAG;QACb,oHAAoH;QACpH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAC9B,CAAA;CACF"}
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../src/apps/management/routes/api-keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAM7B,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAA;AAK3C,OAAO,KAAK,QAAQ,MAAM,+BAA+B,CAAA;AAMzD,kDAAkD;AAClD,yBAAiB,MAAM,CAAC;IACtB,oEAAoE;IAC7D,MAAM,GAAG;;;;;;;;;;;;;;;;qBAyEf,CAAA;IAED,6DAA6D;IACtD,MAAM,MAAM;;;qBAe8C,CAAA;IAEjE,mEAAmE;IAC5D,MAAM,SAAS;;qBASiD,CAAA;IAEvE,8CAA8C;IACvC,MAAM,SAAS;;;;qBAqBkC,CAAA;IAExD,iEAAiE;IAC1D,MAAM,YAAY;;;qBAekD,CAAA;IAE3E,2EAA2E;IACpE,MAAM,mBAAmB;;;;;;;;qBA+B/B,CAAA;IAED,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B,8CAA8C;QACvC,MAAM,QAAQ;;;;;;;;;;;;;;;;;yBAapB,CAAA;KACF;IAED,8CAA8C;IACvC,MAAM,UAAU;;;;;;;;;;;;;;;;;;qBAQtB,CAAA;IAED,6CAA6C;IAC7C,UAAiB,WAAW,CAAC;QAC3B,mDAAmD;QAC5C,MAAM,KAAK;;;;;0BAEgD,CAAA;QAElE,8CAA8C;QACvC,MAAM,QAAQ;;;;;;;;;;;;;;;;;;yBAAa,CAAA;KACnC;IAED,gDAAgD;IAChD,UAAiB,cAAc,CAAC;QAC9B,0DAA0D;QACnD,MAAM,KAAK;;;;;0BAEsD,CAAA;QAExE,2DAA2D;QACpD,MAAM,QAAQ;;;;;;;;;;;;;;;;;;yBAAa,CAAA;KACnC;IAED,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B,6CAA6C;QACtC,MAAM,QAAQ;;yBAYpB,CAAA;KACF;IAED,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B,mDAAmD;QAC5C,MAAM,QAAQ;;;;;;;;;;;;;;;;;yBAapB,CAAA;KACF;IAED,8CAA8C;IAC9C,UAAiB,YAAY,CAAC;QAC5B,+DAA+D;QACxD,MAAM,IAAI;;yBAYhB,CAAA;KACF;CACF;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,OAAO,CAAC,OAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2HA4jBpD;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,kDAAkD;IAClD,KAAK,OAAO,GAAG;QACb,oHAAoH;QACpH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAC9B,CAAA;CACF"}

package/dist/apps/management/routes/api-keys.js

@@ -10,16 +10,17 @@ import * as Billing from '../Billing.js';
 import * as OpenApi from '../../../internal/OpenApi.js';
 import * as Response from '../../../internal/Response.js';
 import * as Schema from '../../../internal/Schema.js';
+import * as Store from '../../../internal/Store.js';
 import * as Scope from '../../../Scope.js';
 import * as ManagementError from '../Error.js';
 /** Zod schemas owned by the API-keys resource. */
 export var schema;
 (function (schema) {
     /** One API key: metadata only — the token appears once, at mint. */
-    schema.Key = Schema.describe(z.object({
+    schema.Key = OpenApi.component(Schema.describe(z.object({
         allowedIps: ApiKey.schema.AllowedIps.check(z.describe('Client IP addresses and CIDR ranges allowed to use this key. An empty list means unrestricted.'), z.meta({ examples: [['203.0.113.0/24', '2001:db8::1']] })),
-        createdAt: z
-            .string()
+        createdAt: z.iso
+            .datetime()
             .check(z.describe('When the key was minted (ISO 8601).'), z.meta({ examples: ['2026-01-01T00:00:00.000Z'] })),
         createdBy: z
             .optional(z.string())
@@ -28,13 +29,13 @@ export var schema;
             .enum(['production', 'sandbox'])
             .check(z.describe('Key environment.'), z.meta({ examples: ['sandbox'] })),
         expiresAt: z
-            .optional(z.string())
+            .optional(z.iso.datetime())
             .check(z.describe('When the key expires (ISO 8601). Absent for a non-expiring key.'), z.meta({ examples: ['2027-01-01T00:00:00.000Z'] })),
         id: z
             .string()
             .check(z.describe('Opaque key id (`key_…`).'), z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] })),
         lastUsedAt: z
-            .optional(z.string())
+            .optional(z.iso.datetime())
             .check(z.describe('When the key last authenticated a request (ISO 8601).'), z.meta({ examples: ['2026-07-21T12:34:56.000Z'] })),
         name: z
             .optional(z.string())
@@ -50,7 +51,7 @@ export var schema;
         tokenLast4: z
             .string()
             .check(z.describe('Last 4 characters of the plaintext token.'), z.meta({ examples: ['a1b2'] })),
-    }), 'An API key: metadata only — the token appears once, at mint.');
+    }), 'An API key: metadata only — the token appears once, at mint.'), 'ApiKey');
     /** Path parameters addressing a project's key collection. */
     schema.Params = z
         .object({
@@ -84,8 +85,19 @@ export var schema;
             .check(z.describe('The project id (`prj_…`).'), z.meta({ examples: ['prj_1a2b3c4d5e6f7g8h9j0k1m2n'] })),
     })
         .check(z.describe('Path parameters for one API key.'));
+    /** Path parameters addressing one organization-level API key. */
+    schema.OrgKeyParams = z
+        .object({
+        keyId: z
+            .string()
+            .check(z.describe('The key id (`key_…`).'), z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] })),
+        orgId: z
+            .string()
+            .check(z.describe('The organization id (`org_…`).'), z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] })),
+    })
+        .check(z.describe('Path parameters for one organization-level API key.'));
     /** Request body minting a key. The wildcard scope is not issuable here. */
-    schema.KeyBody = z
+    schema.CreateApiKeyRequest = OpenApi.component(z
         .object({
         allowedIps: z
             .optional(ApiKey.schema.AllowedIps)
@@ -100,17 +112,21 @@ export var schema;
             ._default(z.array(z.string().check(z.minLength(1), z.refine((scope) => scope !== Scope.wildcard))), [])
             .check(z.describe('Scopes to grant.'), z.meta({ examples: [['data:read']] })),
     })
-        .check(z.describe('Fields for minting an API key.'));
+        .check(z.describe('Fields for minting an API key.')), 'CreateApiKeyRequest');
     /** Schemas for the createApiKey operation. */
     let createApiKey;
     (function (createApiKey) {
         /** The minted key plus its one-time token. */
-        createApiKey.Response = Schema.describe(z.extend(schema.Key, {
+        createApiKey.Response = OpenApi.component(Schema.describe(z.extend(schema.Key, {
             token: z
                 .string()
                 .check(z.describe('The plaintext token — shown once, unrecoverable afterward.'), z.meta({ examples: ['tempo_sandbox:sk:…'] })),
-        }), 'The minted key, including its one-time token.');
+        }), 'The minted key, including its one-time token.'), 'CreateApiKeyResponse');
     })(createApiKey = schema.createApiKey || (schema.createApiKey = {}));
+    /** Non-paginated list of API key metadata. */
+    schema.ApiKeyList = OpenApi.component(Schema.describe(z.object({
+        data: z.array(schema.Key).check(z.describe('The API keys, newest first.')),
+    }), 'A non-paginated list of API key metadata.'), 'ApiKeyList');
     /** Schemas for the listApiKeys operation. */
     let listApiKeys;
     (function (listApiKeys) {
@@ -119,9 +135,7 @@ export var schema;
             .strictObject({ environment: Schema.Environment })
             .check(z.describe("Query parameters for a project's API keys."));
         /** Non-paginated list of a project's keys. */
-        listApiKeys.Response = Schema.describe(z.object({
-            data: z.array(schema.Key).check(z.describe("The project's keys, newest first.")),
-        }), "A non-paginated list of a project's API keys (metadata only).");
+        listApiKeys.Response = schema.ApiKeyList;
     })(listApiKeys = schema.listApiKeys || (schema.listApiKeys = {}));
     /** Schemas for the listOrgApiKeys operation. */
     let listOrgApiKeys;
@@ -131,33 +145,39 @@ export var schema;
             .strictObject({ environment: Schema.Environment })
             .check(z.describe("Query parameters for an organization's API keys."));
         /** Non-paginated list of every key in the organization. */
-        listOrgApiKeys.Response = Schema.describe(z.object({
-            data: z
-                .array(schema.Key)
-                .check(z.describe("The organization's keys across all projects, newest first.")),
-        }), "A non-paginated list of an organization's API keys (metadata only).");
+        listOrgApiKeys.Response = schema.ApiKeyList;
     })(listOrgApiKeys = schema.listOrgApiKeys || (schema.listOrgApiKeys = {}));
     /** Schemas for the revokeApiKey operation. */
     let revokeApiKey;
     (function (revokeApiKey) {
         /** Confirmation that the key was revoked. */
-        revokeApiKey.Response = z
+        revokeApiKey.Response = OpenApi.component(z
             .object({
             id: z
                 .string()
                 .check(z.describe('ID of the key that was revoked.'), z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] })),
         })
-            .check(z.describe('Confirmation that the key was revoked.'));
+            .check(z.describe('Confirmation that the key was revoked.')), 'RevokeApiKeyResponse');
     })(revokeApiKey = schema.revokeApiKey || (schema.revokeApiKey = {}));
+    /** Schemas for the rotateApiKey operation. */
+    let rotateApiKey;
+    (function (rotateApiKey) {
+        /** The replacement key plus its one-time token. */
+        rotateApiKey.Response = OpenApi.component(Schema.describe(z.extend(schema.Key, {
+            token: z
+                .string()
+                .check(z.describe('The plaintext token — shown once, unrecoverable afterward.'), z.meta({ examples: ['tempo_sandbox:sk:…'] })),
+        }), 'The replacement key, including its one-time token.'), 'RotateApiKeyResponse');
+    })(rotateApiKey = schema.rotateApiKey || (schema.rotateApiKey = {}));
     /** Schemas for the updateApiKey operation. */
     let updateApiKey;
     (function (updateApiKey) {
         /** Request body replacing or clearing a key's IP allowlist. */
-        updateApiKey.Body = z
+        updateApiKey.Body = OpenApi.component(z
             .object({
             allowedIps: ApiKey.schema.AllowedIps.check(z.describe('Replacement client IP/CIDR allowlist. Use an empty list for unrestricted access.'), z.meta({ examples: [['203.0.113.0/24']] })),
         })
-            .check(z.describe("Fields for updating an API key's network access."));
+            .check(z.describe("Fields for updating an API key's network access.")), 'UpdateApiKeyRequest');
     })(updateApiKey = schema.updateApiKey || (schema.updateApiKey = {}));
 })(schema || (schema = {}));
 /**
@@ -169,7 +189,7 @@ export function apiKeys(options = {}) {
         .post('/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys', Auth.policy({ session: true }), Auth.ensureOrg({ role: 'admin' }), Auth.ensureProject(), OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
         message: 'Check the path parameters and try again.',
-    }), OpenApi.validate('json', schema.KeyBody, {
+    }), OpenApi.validate('json', schema.CreateApiKeyRequest, {
         code: 'body_invalid',
         message: 'Check the request body and try again.',
     }), OpenApi.describeRoute({
@@ -178,11 +198,18 @@ export function apiKeys(options = {}) {
         operationId: 'createApiKey',
         responses: OpenApi.responses({
             errors: {
+                400: {
+                    codes: ['body_invalid', 'param_invalid'],
+                    description: 'Malformed API key, invalid path, or invalid body.',
+                },
                 403: {
                     codes: ['scope_not_issuable'],
                     description: 'The requested scopes are not issuable.',
                 },
-                404: 'No accessible project was found for this id.',
+                404: {
+                    codes: ['api_keys_not_enabled', 'organization_not_found', 'project_not_found'],
+                    description: 'No accessible project or API key surface was found.',
+                },
             },
             success: {
                 description: 'The minted key, including its one-time token.',
@@ -196,6 +223,8 @@ export function apiKeys(options = {}) {
             return Auth.superAdminAccessError(c);
         if (Auth.narrowScope)
             return Auth.ensureProjectError(c);
+        if (Auth.narrowOrgRole)
+            return Auth.ensureOrgRoleError(c);
         if (OpenApi.narrowValidation)
             return OpenApi.validationError(c, {
                 code: 'param_invalid',
@@ -260,8 +289,14 @@ export function apiKeys(options = {}) {
         operationId: 'listApiKeys',
         responses: OpenApi.responses({
             errors: {
-                400: { codes: ['query_invalid'], description: 'Invalid query parameters.' },
-                404: 'No accessible project was found for this id.',
+                400: {
+                    codes: ['param_invalid', 'query_invalid'],
+                    description: 'Malformed API key, invalid path, or invalid query.',
+                },
+                404: {
+                    codes: ['api_keys_not_enabled', 'organization_not_found', 'project_not_found'],
+                    description: 'No accessible project or API key surface was found.',
+                },
             },
             success: {
                 description: "The project's keys, newest first (metadata only).",
@@ -314,8 +349,14 @@ export function apiKeys(options = {}) {
         operationId: 'listOrgApiKeys',
         responses: OpenApi.responses({
             errors: {
-                400: { codes: ['query_invalid'], description: 'Invalid query parameters.' },
-                404: 'No accessible organization was found for this id.',
+                400: {
+                    codes: ['param_invalid', 'query_invalid'],
+                    description: 'Malformed API key, invalid path, or invalid query.',
+                },
+                404: {
+                    codes: ['api_keys_not_enabled', 'organization_not_found'],
+                    description: 'No accessible organization or API key surface was found.',
+                },
             },
             success: {
                 description: "The organization's keys across all projects, newest first (metadata only).", // prettier-ignore
@@ -354,6 +395,115 @@ export function apiKeys(options = {}) {
         catch (cause) {
             return Response.upstream(c, cause);
         }
+    })
+        .post('/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}/rotate', Auth.policy({ session: true }), Auth.ensureOrg({ role: 'admin' }), OpenApi.validate('param', schema.OrgKeyParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+    }), OpenApi.describeRoute({
+        description: 'Create a replacement organization-level API key with the same access as an existing key. The existing key remains active until revoked.',
+        hide: hidden,
+        operationId: 'rotateOrgApiKey',
+        responses: OpenApi.responses({
+            errors: {
+                400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+                403: {
+                    codes: ['scope_not_issuable'],
+                    description: 'The source key contains scopes the caller cannot rotate.',
+                },
+                404: {
+                    codes: ['api_key_not_found', 'api_keys_not_enabled', 'organization_not_found'],
+                    description: 'No accessible API key or API key surface was found.',
+                },
+            },
+            success: {
+                description: 'The replacement key, including its one-time token.',
+                schema: schema.rotateApiKey.Response,
+            },
+        }),
+        summary: 'Rotate organization API key',
+        tags: ['API Keys'],
+    }), async (c) => {
+        if (Auth.narrowAccess)
+            return Auth.superAdminAccessError(c);
+        if (Auth.narrowOrgRole)
+            return Auth.ensureOrgRoleError(c);
+        if (OpenApi.narrowValidation)
+            return OpenApi.validationError(c, {
+                code: 'param_invalid',
+                message: 'Check the path parameters and try again.',
+            });
+        const kv = c.get('kv');
+        if (!kv)
+            return notEnabled(c);
+        const createdBy = mintedBy(c);
+        if (!createdBy)
+            return ManagementError.sessionRequired(c);
+        const { keyId } = c.req.valid('param');
+        try {
+            const source = await ApiKeys.get(kv.store, keyId, {
+                scopeCatalog: c.get('scopeCatalog'),
+            });
+            if (!source || source.orgId !== Auth.org(c).id || source.projectId !== undefined)
+                return keyNotFound(c);
+            if (!canRotate(c, source.scopes))
+                return Response.error(c, {
+                    code: 'scope_not_issuable',
+                    message: 'The source key contains scopes the caller cannot rotate.',
+                    status: 403,
+                });
+            return rotate(c, kv.store, source, createdBy);
+        }
+        catch (cause) {
+            return Response.upstream(c, cause);
+        }
+    })
+        .delete('/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}', Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }), Auth.ensureOrg({ role: 'admin' }), OpenApi.validate('param', schema.OrgKeyParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+    }), OpenApi.describeRoute({
+        description: 'Revoke an organization-level API key. Requests presenting its token stop resolving.',
+        hide: hidden,
+        operationId: 'revokeOrgApiKey',
+        responses: OpenApi.responses({
+            errors: {
+                400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+                404: {
+                    codes: ['api_key_not_found', 'api_keys_not_enabled', 'organization_not_found'],
+                    description: 'No accessible API key or API key surface was found.',
+                },
+            },
+            success: {
+                description: 'Confirmation that the key was revoked.',
+                schema: schema.revokeApiKey.Response,
+            },
+        }),
+        summary: 'Revoke organization API key',
+        tags: ['API Keys'],
+    }), async (c) => {
+        if (Auth.narrowAccess)
+            return Auth.accessError(c);
+        if (Auth.narrowOrgRole)
+            return Auth.ensureOrgRoleError(c);
+        if (OpenApi.narrowValidation)
+            return OpenApi.validationError(c, {
+                code: 'param_invalid',
+                message: 'Check the path parameters and try again.',
+            });
+        const kv = c.get('kv');
+        if (!kv)
+            return notEnabled(c);
+        const { keyId } = c.req.valid('param');
+        try {
+            const record = await ApiKeys.get(kv.store, keyId, {
+                scopeCatalog: c.get('scopeCatalog'),
+            });
+            if (!record || record.orgId !== Auth.org(c).id || record.projectId !== undefined)
+                return keyNotFound(c);
+            return revoke(c, kv.store, keyId);
+        }
+        catch (cause) {
+            return Response.upstream(c, cause);
+        }
     })
         .patch('/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}', Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }), Auth.ensureOrg({ role: 'admin' }), Auth.ensureProject(), OpenApi.validate('param', schema.KeyParams, {
         code: 'param_invalid',
@@ -367,7 +517,19 @@ export function apiKeys(options = {}) {
         operationId: 'updateApiKey',
         responses: OpenApi.responses({
             errors: {
-                404: 'No accessible API key was found for this id.',
+                400: {
+                    codes: ['body_invalid', 'param_invalid'],
+                    description: 'Malformed API key, invalid path, or invalid body.',
+                },
+                404: {
+                    codes: [
+                        'api_key_not_found',
+                        'api_keys_not_enabled',
+                        'organization_not_found',
+                        'project_not_found',
+                    ],
+                    description: 'No accessible API key or API key surface was found.',
+                },
             },
             success: {
                 description: 'The updated API key metadata.',
@@ -381,6 +543,8 @@ export function apiKeys(options = {}) {
             return Auth.accessError(c);
         if (Auth.narrowScope)
             return Auth.ensureProjectError(c);
+        if (Auth.narrowOrgRole)
+            return Auth.ensureOrgRoleError(c);
         if (OpenApi.narrowValidation)
             return OpenApi.validationError(c, {
                 code: 'param_invalid',
@@ -411,6 +575,74 @@ export function apiKeys(options = {}) {
         catch (cause) {
             return Response.upstream(c, cause);
         }
+    })
+        .post('/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}/rotate', Auth.policy({ session: true }), Auth.ensureOrg({ role: 'admin' }), Auth.ensureProject(), OpenApi.validate('param', schema.KeyParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+    }), OpenApi.describeRoute({
+        description: 'Create a replacement API key with the same access as an existing key. The existing key remains active until revoked.',
+        hide: hidden,
+        operationId: 'rotateApiKey',
+        responses: OpenApi.responses({
+            errors: {
+                400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+                403: {
+                    codes: ['scope_not_issuable'],
+                    description: 'The source key contains scopes the caller cannot rotate.',
+                },
+                404: {
+                    codes: [
+                        'api_key_not_found',
+                        'api_keys_not_enabled',
+                        'organization_not_found',
+                        'project_not_found',
+                    ],
+                    description: 'No accessible API key or API key surface was found.',
+                },
+            },
+            success: {
+                description: 'The replacement key, including its one-time token.',
+                schema: schema.rotateApiKey.Response,
+            },
+        }),
+        summary: 'Rotate API key',
+        tags: ['API Keys'],
+    }), async (c) => {
+        if (Auth.narrowAccess)
+            return Auth.superAdminAccessError(c);
+        if (Auth.narrowScope)
+            return Auth.ensureProjectError(c);
+        if (Auth.narrowOrgRole)
+            return Auth.ensureOrgRoleError(c);
+        if (OpenApi.narrowValidation)
+            return OpenApi.validationError(c, {
+                code: 'param_invalid',
+                message: 'Check the path parameters and try again.',
+            });
+        const kv = c.get('kv');
+        if (!kv)
+            return notEnabled(c);
+        const createdBy = mintedBy(c);
+        if (!createdBy)
+            return ManagementError.sessionRequired(c);
+        const { keyId } = c.req.valid('param');
+        try {
+            const source = await ApiKeys.get(kv.store, keyId, {
+                scopeCatalog: c.get('scopeCatalog'),
+            });
+            if (!source || source.orgId !== Auth.org(c).id || source.projectId !== Auth.project(c).id)
+                return keyNotFound(c);
+            if (!canRotate(c, source.scopes))
+                return Response.error(c, {
+                    code: 'scope_not_issuable',
+                    message: 'The source key contains scopes the caller cannot rotate.',
+                    status: 403,
+                });
+            return rotate(c, kv.store, source, createdBy);
+        }
+        catch (cause) {
+            return Response.upstream(c, cause);
+        }
     })
         .delete('/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}', Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }), Auth.ensureOrg({ role: 'admin' }), Auth.ensureProject(), OpenApi.validate('param', schema.KeyParams, {
         code: 'param_invalid',
@@ -420,7 +652,18 @@ export function apiKeys(options = {}) {
         hide: hidden,
         operationId: 'revokeApiKey',
         responses: OpenApi.responses({
-            errors: { 404: 'No accessible API key was found for this id.' },
+            errors: {
+                400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+                404: {
+                    codes: [
+                        'api_key_not_found',
+                        'api_keys_not_enabled',
+                        'organization_not_found',
+                        'project_not_found',
+                    ],
+                    description: 'No accessible API key or API key surface was found.',
+                },
+            },
             success: {
                 description: 'Confirmation that the key was revoked.',
                 schema: schema.revokeApiKey.Response,
@@ -433,6 +676,8 @@ export function apiKeys(options = {}) {
             return Auth.accessError(c);
         if (Auth.narrowScope)
             return Auth.ensureProjectError(c);
+        if (Auth.narrowOrgRole)
+            return Auth.ensureOrgRoleError(c);
         if (OpenApi.narrowValidation)
             return OpenApi.validationError(c, {
                 code: 'param_invalid',
@@ -450,10 +695,7 @@ export function apiKeys(options = {}) {
             });
             if (!record || record.orgId !== Auth.org(c).id || record.projectId !== Auth.project(c).id)
                 return keyNotFound(c);
-            const revoked = await ApiKeys.revoke(kv.store, keyId);
-            if (!revoked)
-                return keyNotFound(c);
-            return c.json(Response.validated(schema.revokeApiKey.Response, { id: keyId }), 200);
+            return revoke(c, kv.store, keyId);
         }
         catch (cause) {
             return Response.upstream(c, cause);
@@ -506,6 +748,42 @@ function canIssue(c, scopes) {
     }
     return false;
 }
+/** Checks caller-specific restrictions that still apply when copying existing grants. */
+function canRotate(c, scopes) {
+    const principal = Auth.getPrincipal(c);
+    if (principal?.type === 'super_admin')
+        return true;
+    if (principal?.type !== 'session')
+        return false;
+    return ((!scopes.includes('management:write') && !scopes.includes(Scope.wildcard)) ||
+        Auth.membership(c)?.role === 'owner');
+}
+/** Mints a replacement that preserves the source key's access and attribution. */
+async function rotate(c, store, source, createdBy) {
+    const billingActive = source.environment === 'sandbox'
+        ? await Billing.active(Db.get(c.get('db')), source.orgId, 'sandbox')
+        : undefined;
+    const { record, token } = await ApiKeys.mint(store, {
+        allowedIps: source.allowedIps,
+        createdBy,
+        environment: source.environment,
+        orgId: source.orgId,
+        ...(source.projectId === undefined ? {} : { projectId: source.projectId }),
+        scopes: source.scopes,
+        ...(billingActive === undefined ? {} : { billingActive }),
+        ...(source.expiresAt === undefined ? {} : { expiresAt: source.expiresAt }),
+        ...(source.name === undefined ? {} : { name: source.name }),
+        ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
+    }, { scopeCatalog: c.get('scopeCatalog') });
+    return c.json(Response.validated(schema.rotateApiKey.Response, { ...serializeKey(record), token }), 200);
+}
+/** Revokes an API key after its route has verified ownership. */
+async function revoke(c, store, keyId) {
+    const revoked = await ApiKeys.revoke(store, keyId);
+    if (!revoked)
+        return keyNotFound(c);
+    return c.json(Response.validated(schema.revokeApiKey.Response, { id: keyId }), 200);
+}
 function keyNotFound(c) {
     return Response.error(c, {
         code: 'api_key_not_found',