uapp-communication-sdk 1.0.0-dev.54

package/types/core/result/result.d.ts

@@ -0,0 +1,35 @@
+import type { AppError } from '@core/errors/app-error';
+/**
+ * A `Result` makes success and failure explicit in the type system.
+ *
+ * Application use cases return `Result<T>` instead of throwing, so callers are *forced* by the
+ * compiler to handle the failure branch. This is the project's standard for any operation that
+ * can fail for an expected reason (validation, auth, network). Truly unexpected/programmer
+ * errors may still throw.
+ */
+export type Result<TValue, TError extends AppError = AppError> = Success<TValue> | Failure<TError>;
+export interface Success<TValue> {
+    readonly ok: true;
+    readonly value: TValue;
+}
+export interface Failure<TError extends AppError> {
+    readonly ok: false;
+    readonly error: TError;
+}
+export declare const ok: <TValue>(value: TValue) => Success<TValue>;
+export declare const err: <TError extends AppError>(error: TError) => Failure<TError>;
+export declare const isOk: <TValue, TError extends AppError>(result: Result<TValue, TError>) => result is Success<TValue>;
+export declare const isErr: <TValue, TError extends AppError>(result: Result<TValue, TError>) => result is Failure<TError>;
+/** Transform the success value while preserving any failure unchanged. */
+export declare const mapResult: <TValue, TNext, TError extends AppError>(result: Result<TValue, TError>, map: (value: TValue) => TNext) => Result<TNext, TError>;
+/** Transform the error value while preserving any success unchanged. */
+export declare const mapError: <TValue, TError extends AppError, TNextError extends AppError>(result: Result<TValue, TError>, map: (error: TError) => TNextError) => Result<TValue, TNextError>;
+/** Synchronous version of unwrapResult for non-Promise Result values. */
+export declare const unwrapResultSync: <TValue>(result: Result<TValue>) => TValue;
+/**
+ * Bridge a `Result`-returning use case into a throwing context (TanStack Query's `queryFn`/
+ * `mutationFn`, which signal failure by throwing). Resolves to the value, or throws the
+ * concrete `AppError` so Query's `error` is always a typed domain/infrastructure error.
+ */
+export declare const unwrapResult: <TValue>(promise: Promise<Result<TValue>>) => Promise<TValue>;
+//# sourceMappingURL=result.d.ts.map

package/types/core/result/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../../../../src/core/result/result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,SAAS,QAAQ,GAAG,QAAQ,IACzD,OAAO,CAAC,MAAM,CAAC,GACf,OAAO,CAAC,MAAM,CAAC,CAAC;AAEpB,MAAM,WAAW,OAAO,CAAC,MAAM;IAC7B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,OAAO,CAAC,MAAM,SAAS,QAAQ;IAC9C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,EAAE,GAAI,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAGvD,CAAC;AAEH,eAAO,MAAM,GAAG,GAAI,MAAM,SAAS,QAAQ,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAGzE,CAAC;AAEH,eAAO,MAAM,IAAI,GAAI,MAAM,EAAE,MAAM,SAAS,QAAQ,EAClD,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,MAAM,IAAI,OAAO,CAAC,MAAM,CAAc,CAAC;AAE1C,eAAO,MAAM,KAAK,GAAI,MAAM,EAAE,MAAM,SAAS,QAAQ,EACnD,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,MAAM,IAAI,OAAO,CAAC,MAAM,CAAe,CAAC;AAE3C,0EAA0E;AAC1E,eAAO,MAAM,SAAS,GAAI,MAAM,EAAE,KAAK,EAAE,MAAM,SAAS,QAAQ,EAC9D,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,KAAK,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,KAC5B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAiD,CAAC;AAEzE,wEAAwE;AACxE,eAAO,MAAM,QAAQ,GAAI,MAAM,EAAE,MAAM,SAAS,QAAQ,EAAE,UAAU,SAAS,QAAQ,EACnF,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,KAAK,CAAC,KAAK,EAAE,MAAM,KAAK,UAAU,KACjC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAsD,CAAC;AAEnF,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,GAAI,MAAM,EAAE,QAAQ,MAAM,CAAC,MAAM,CAAC,KAAG,MAKjE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAU,MAAM,EACvC,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAC/B,OAAO,CAAC,MAAM,CAGhB,CAAC"}

package/types/core/time/clock.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Time abstraction. Never call `new Date()` directly in domain/application code — depend on a
+ * `Clock` so behaviour around token expiry, timeouts, etc. is deterministic and testable.
+ */
+export interface Clock {
+    now(): Date;
+}
+export declare class SystemClock implements Clock {
+    now(): Date;
+}
+/** Test double: returns a fixed, optionally advanceable instant. */
+export declare class FixedClock implements Clock {
+    private current;
+    constructor(current: Date);
+    now(): Date;
+    set(next: Date): void;
+    advanceSeconds(seconds: number): void;
+    advanceMinutes(minutes: number): void;
+    advanceHours(hours: number): void;
+    advanceDays(days: number): void;
+}
+//# sourceMappingURL=clock.d.ts.map

package/types/core/time/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../../../../../src/core/time/clock.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,IAAI,CAAC;CACb;AAED,qBAAa,WAAY,YAAW,KAAK;IAChC,GAAG,IAAI,IAAI;CAGnB;AAED,oEAAoE;AACpE,qBAAa,UAAW,YAAW,KAAK;IACnB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,IAAI;IAEjC,GAAG,IAAI,IAAI;IAIX,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAIrB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIrC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIrC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIjC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAGvC"}

package/types/core/time/index.d.ts

@@ -0,0 +1,4 @@
+export * from './clock';
+export * from './timezone';
+export * from './viewer-timezone';
+//# sourceMappingURL=index.d.ts.map

package/types/core/time/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/time/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC"}

package/types/core/time/timezone.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Time-zone helpers for rendering wall-clock times in a chosen IANA zone. Pure and side-effect-free
+ * except {@link deviceTimeZone} (which reads the host's locale). Offsets are evaluated at a concrete
+ * instant so they are DST-correct; callers pass a reference `Date` (from a `Clock`) rather than "now".
+ */
+/** The IANA time zone of the current device/browser, e.g. `"Asia/Dhaka"`. */
+export declare const deviceTimeZone: () => string;
+/** The wall-clock an instant reads as in a given IANA zone — the DST-correct way to get its zone-local parts. */
+export interface ZonedDateParts {
+    readonly year: number;
+    /** 1–12 (not the `Date`-style 0–11). */
+    readonly month: number;
+    readonly day: number;
+    /** 0–23. */
+    readonly hour: number;
+    readonly minute: number;
+    readonly second: number;
+}
+/**
+ * The calendar/clock parts of the instant `at` as seen in `timeZone`, via `Intl` with an explicit zone —
+ * so reading an absolute-UTC instant back out is DST-correct and independent of the host/device zone. This
+ * is the one place the `formatToParts` extraction lives; higher-level formatters build on it rather than
+ * calling device-local `Date` getters (which would render in the machine's zone, not the viewer's).
+ */
+export declare const zonedDateParts: (at: Date, timeZone: string) => ZonedDateParts;
+/**
+ * The offset of `timeZone` from UTC at the instant `at`, in minutes (positive = ahead of UTC). DST-aware
+ * because it is evaluated at a concrete instant.
+ */
+export declare const zoneOffsetMinutes: (timeZone: string, at: Date) => number;
+/**
+ * Re-express a wall-clock `HH:MM` from `fromZone` to `toZone`, using each zone's offset at `at` (the DST
+ * reference instant). Wraps around midnight. Returns the input unchanged when it is not a `HH:MM` string
+ * (e.g. an empty placeholder) or when the two zones are the same.
+ */
+export declare const shiftWallClockZone: (hm: string, fromZone: string, toZone: string, at: Date) => string;
+/**
+ * Convert a wall-clock (`yyyy-mm-dd` date + `HH:MM` time) authored in `timeZone` into the absolute UTC
+ * instant (ISO-8601), so a value entered "in the user's zone" is persisted correctly. The zone offset is
+ * resolved at the instant itself and refined once, so it is DST-correct except within the ~1h transition
+ * window (inherently ambiguous). Throws on an unparseable date/time.
+ */
+export declare const zonedWallClockToUtcIso: (isoDate: string, hhmm: string, timeZone: string) => string;
+/** Human-readable UTC offset from a minutes value, e.g. 360 → "GMT+06:00", -300 → "GMT-05:00". */
+export declare const formatZoneOffset: (offsetMinutes: number) => string;
+//# sourceMappingURL=timezone.d.ts.map

package/types/core/time/timezone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timezone.d.ts","sourceRoot":"","sources":["../../../../../src/core/time/timezone.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,cAAc,QAAO,MACgB,CAAC;AAEnD,iHAAiH;AACjH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,YAAY;IACZ,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,IAAI,IAAI,EAAE,UAAU,MAAM,KAAG,cAsB3D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,EAAE,IAAI,IAAI,KAAG,MAI9D,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,IAAI,MAAM,EACV,UAAU,MAAM,EAChB,QAAQ,MAAM,EACd,IAAI,IAAI,KACP,MASF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,UAAU,MAAM,KACf,MAaF,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,GAAI,eAAe,MAAM,KAAG,MAIxD,CAAC"}

package/types/core/time/viewer-timezone.d.ts

@@ -0,0 +1,26 @@
+export interface ViewerTimeZoneInput {
+    /** Ephemeral, explicit view pick (schedule top-bar / booking selector). Wins for display; never anchors. */
+    readonly pick?: string | undefined;
+    /** The user's persisted personal (home/working) timezone; `''`/undefined when unset. */
+    readonly personal?: string | undefined;
+    /** Server-resolved availability anchor (personal → branch → default → `"UTC"`). */
+    readonly anchor?: string | undefined;
+}
+export declare class ViewerTimeZone {
+    /** The IANA zone instants are rendered in. */
+    readonly display: string;
+    /** The IANA zone the user's availability/working hours are anchored to. */
+    readonly anchor: string;
+    private constructor();
+    /** Resolve the viewer's zones from an (optional) explicit pick plus their preferences. */
+    static from(input: ViewerTimeZoneInput): ViewerTimeZone;
+    /** True when rendering needs no reprojection from the anchor zone into the display zone. */
+    get displayMatchesAnchor(): boolean;
+    /** A UTC ISO instant (e.g. `"2026-07-21T09:00:00Z"`) as 24h `HH:MM` in the display zone. */
+    formatTime(utcIso: string): string;
+    /** `HH:MM – HH:MM` in the display zone; `''` when either bound is missing/unresolved. */
+    formatTimeRange(startUtc: string | null | undefined, endUtc: string | null | undefined): string;
+    /** A UTC ISO instant formatted as a date in the display zone (defaults to `"Thu, 25 Jun"`). */
+    formatDate(utcIso: string, options?: Intl.DateTimeFormatOptions): string;
+}
+//# sourceMappingURL=viewer-timezone.d.ts.map

package/types/core/time/viewer-timezone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewer-timezone.d.ts","sourceRoot":"","sources":["../../../../../src/core/time/viewer-timezone.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,mBAAmB;IAClC,4GAA4G;IAC5G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,qBAAa,cAAc;IAEvB,8CAA8C;aAC9B,OAAO,EAAE,MAAM;IAC/B,2EAA2E;aAC3D,MAAM,EAAE,MAAM;IAJhC,OAAO;IAOP,0FAA0F;WAC5E,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc;IAY9D,4FAA4F;IAC5F,IAAW,oBAAoB,IAAI,OAAO,CAEzC;IAED,4FAA4F;IACrF,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IASzC,yFAAyF;IAClF,eAAe,CACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,MAAM;IAKT,+FAA+F;IACxF,UAAU,CACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,IAAI,CAAC,qBAIb,GACA,MAAM;CAMV"}

package/types/features/api-keys/api-keys-module.d.ts

@@ -0,0 +1,19 @@
+import type { HttpClient } from '@core/http';
+import type { Logger } from '@core/logger';
+import { CreateApiKeyUseCase, UpdateApiKeyUseCase, RotateApiKeyUseCase, ConfirmApiKeyRotationUseCase, DeleteApiKeyUseCase } from './application';
+import type { ApiKeyGateway } from './domain';
+export interface ApiKeysModuleDeps {
+    readonly httpClient: HttpClient;
+    readonly logger: Logger;
+}
+export interface ApiKeysModule {
+    readonly gateway: ApiKeyGateway;
+    readonly logger: Logger;
+    readonly createApiKeyUseCase: CreateApiKeyUseCase;
+    readonly updateApiKeyUseCase: UpdateApiKeyUseCase;
+    readonly rotateApiKeyUseCase: RotateApiKeyUseCase;
+    readonly confirmApiKeyRotationUseCase: ConfirmApiKeyRotationUseCase;
+    readonly deleteApiKeyUseCase: DeleteApiKeyUseCase;
+}
+export declare const createApiKeysModule: (deps: ApiKeysModuleDeps) => ApiKeysModule;
+//# sourceMappingURL=api-keys-module.d.ts.map

package/types/features/api-keys/api-keys-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys-module.d.ts","sourceRoot":"","sources":["../../../../../src/features/api-keys/api-keys-module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAC5B,mBAAmB,EACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,4BAA4B,EAAE,4BAA4B,CAAC;IACpE,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;CACnD;AAED,eAAO,MAAM,mBAAmB,GAAI,MAAM,iBAAiB,KAAG,aAkB7D,CAAC"}

package/types/features/api-keys/application/index.d.ts

@@ -0,0 +1,7 @@
+export * from './queries/use-api-keys';
+export * from './use-cases/create-api-key';
+export * from './use-cases/update-api-key';
+export * from './use-cases/rotate-api-key';
+export * from './use-cases/confirm-api-key-rotation';
+export * from './use-cases/delete-api-key';
+//# sourceMappingURL=index.d.ts.map

package/types/features/api-keys/application/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/application/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC"}

package/types/features/api-keys/application/queries/use-api-keys.d.ts

@@ -0,0 +1,10 @@
+import { type UseQueryResult } from '@tanstack/react-query';
+import type { ApiKey, ApiKeyGateway } from '../../domain';
+import type { Logger } from '@core/logger';
+export declare const API_KEYS_QUERY_KEY: readonly ["api-keys"];
+export interface UseApiKeysDeps {
+    readonly gateway: ApiKeyGateway;
+    readonly logger: Logger;
+}
+export declare const useApiKeys: (deps: UseApiKeysDeps) => UseQueryResult<readonly ApiKey[]>;
+//# sourceMappingURL=use-api-keys.d.ts.map

package/types/features/api-keys/application/queries/use-api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-api-keys.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/application/queries/use-api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,eAAO,MAAM,kBAAkB,uBAAwB,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,UAAU,GAAI,MAAM,cAAc,KAAG,cAAc,CAAC,SAAS,MAAM,EAAE,CAYjF,CAAC"}

package/types/features/api-keys/application/use-cases/confirm-api-key-rotation.d.ts

@@ -0,0 +1,18 @@
+import type { Result } from '@core/result';
+import type { Logger } from '@core/logger';
+import type { ApiKeyGateway, ApiKeyError, ApiKey } from '../../domain';
+export interface ConfirmApiKeyRotationUseCaseDeps {
+    readonly gateway: ApiKeyGateway;
+    readonly logger: Logger;
+}
+/**
+ * Completes a two-phase secret rotation: retires the PREVIOUS secret once every embed has been
+ * redeployed with the new one. Until this runs both secrets verify, so rotation causes no outage.
+ */
+export declare class ConfirmApiKeyRotationUseCase {
+    private readonly gateway;
+    private readonly logger;
+    constructor(deps: ConfirmApiKeyRotationUseCaseDeps);
+    execute(id: string): Promise<Result<ApiKey, ApiKeyError>>;
+}
+//# sourceMappingURL=confirm-api-key-rotation.d.ts.map

package/types/features/api-keys/application/use-cases/confirm-api-key-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-api-key-rotation.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/application/use-cases/confirm-api-key-rotation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,gCAAgC;IAK5C,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAIvE"}

package/types/features/api-keys/application/use-cases/create-api-key.d.ts

@@ -0,0 +1,14 @@
+import type { Result } from '@core/result';
+import type { Logger } from '@core/logger';
+import type { ApiKeyGateway, ApiKeyError, CreateApiKeyCommand, ApiKeyCredentials } from '../../domain';
+export interface CreateApiKeyUseCaseDeps {
+    readonly gateway: ApiKeyGateway;
+    readonly logger: Logger;
+}
+export declare class CreateApiKeyUseCase {
+    private readonly gateway;
+    private readonly logger;
+    constructor(deps: CreateApiKeyUseCaseDeps);
+    execute(cmd: CreateApiKeyCommand): Promise<Result<ApiKeyCredentials, ApiKeyError>>;
+}
+//# sourceMappingURL=create-api-key.d.ts.map

package/types/features/api-keys/application/use-cases/create-api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-api-key.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/application/use-cases/create-api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,uBAAuB;IAKnC,OAAO,CAClB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;CAInD"}

package/types/features/api-keys/application/use-cases/delete-api-key.d.ts

@@ -0,0 +1,15 @@
+import type { Result } from '@core/result';
+import type { Logger } from '@core/logger';
+import type { ApiKeyGateway, ApiKeyError } from '../../domain';
+export interface DeleteApiKeyUseCaseDeps {
+    readonly gateway: ApiKeyGateway;
+    readonly logger: Logger;
+}
+/** Permanently revokes an SDK client. Every embed using its key stops authenticating immediately. */
+export declare class DeleteApiKeyUseCase {
+    private readonly gateway;
+    private readonly logger;
+    constructor(deps: DeleteApiKeyUseCaseDeps);
+    execute(id: string): Promise<Result<void, ApiKeyError>>;
+}
+//# sourceMappingURL=delete-api-key.d.ts.map

package/types/features/api-keys/application/use-cases/delete-api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-api-key.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/application/use-cases/delete-api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qGAAqG;AACrG,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,uBAAuB;IAKnC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;CAIrE"}

package/types/features/api-keys/application/use-cases/rotate-api-key.d.ts

@@ -0,0 +1,14 @@
+import type { Result } from '@core/result';
+import type { Logger } from '@core/logger';
+import type { ApiKeyGateway, ApiKeyError, ApiKeyCredentials } from '../../domain';
+export interface RotateApiKeyUseCaseDeps {
+    readonly gateway: ApiKeyGateway;
+    readonly logger: Logger;
+}
+export declare class RotateApiKeyUseCase {
+    private readonly gateway;
+    private readonly logger;
+    constructor(deps: RotateApiKeyUseCaseDeps);
+    execute(id: string): Promise<Result<ApiKeyCredentials, ApiKeyError>>;
+}
+//# sourceMappingURL=rotate-api-key.d.ts.map

package/types/features/api-keys/application/use-cases/rotate-api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-api-key.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/application/use-cases/rotate-api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAElF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,uBAAuB;IAKnC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;CAIlF"}

package/types/features/api-keys/application/use-cases/update-api-key.d.ts

@@ -0,0 +1,14 @@
+import type { Result } from '@core/result';
+import type { Logger } from '@core/logger';
+import type { ApiKeyGateway, ApiKeyError, UpdateApiKeyCommand, ApiKey } from '../../domain';
+export interface UpdateApiKeyUseCaseDeps {
+    readonly gateway: ApiKeyGateway;
+    readonly logger: Logger;
+}
+export declare class UpdateApiKeyUseCase {
+    private readonly gateway;
+    private readonly logger;
+    constructor(deps: UpdateApiKeyUseCaseDeps);
+    execute(id: string, cmd: UpdateApiKeyCommand): Promise<Result<ApiKey, ApiKeyError>>;
+}
+//# sourceMappingURL=update-api-key.d.ts.map

package/types/features/api-keys/application/use-cases/update-api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-api-key.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/application/use-cases/update-api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,MAAM,EACP,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,uBAAuB;IAKnC,OAAO,CAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAIxC"}

package/types/features/api-keys/domain/entities/api-key-credentials.d.ts

@@ -0,0 +1,7 @@
+import type { ApiKey } from './api-key';
+export interface ApiKeyCredentials {
+    readonly key: string;
+    readonly secret: string;
+    readonly client: ApiKey;
+}
+//# sourceMappingURL=api-key-credentials.d.ts.map

package/types/features/api-keys/domain/entities/api-key-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/domain/entities/api-key-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB"}

package/types/features/api-keys/domain/entities/api-key.d.ts

@@ -0,0 +1,58 @@
+export interface ApiKeyRoleMapping {
+    readonly hostRole: string;
+    readonly abpRole: string;
+}
+/**
+ * Which user namespace this key's assertions resolve into. Sent over the wire as the backend enum's
+ * numeric value.
+ *
+ * - `Isolated` — the key gets its own namespace. Nothing it asserts can reach a user belonging to
+ *   another key or to UAPP SSO, because the email in an assertion is unverified.
+ * - `UappSso` — the key speaks for UAPP SSO, so a person signing in directly and the same person
+ *   arriving through an embedded widget are one account. Only selectable where UAPP SSO applies;
+ *   the server refuses it otherwise.
+ */
+export declare const SDK_IDENTITY_MODE: {
+    readonly Isolated: 0;
+    readonly UappSso: 1;
+};
+export type SdkIdentityMode = (typeof SDK_IDENTITY_MODE)[keyof typeof SDK_IDENTITY_MODE];
+export interface ApiKeyProps {
+    readonly id: string;
+    readonly key: string;
+    readonly displayName: string;
+    readonly allowedModules: number;
+    readonly defaultAbpRole: string;
+    readonly isActive: boolean;
+    readonly identityMode: SdkIdentityMode;
+    /**
+     * User type given to people this key provisions who hold none, or null for no default.
+     *
+     * Not cosmetic: an untyped user reads as "not onboarded" to the backend's member-pool resolver,
+     * which then falls back to the whole tenant directory. An SDK user never acquires a type on their
+     * own, so leaving this unset makes every person in the tenant visible to them.
+     */
+    readonly defaultUserTypeId: string | null;
+    readonly isRotationPending: boolean;
+    readonly allowedOrigins: readonly string[];
+    readonly roleMappings: readonly ApiKeyRoleMapping[];
+}
+/**
+ * An API Key (SDK Client) for embedding the Communication Hub.
+ * Immutable: state changes return a new ApiKey rather than mutating in place.
+ */
+export declare class ApiKey {
+    readonly id: string;
+    readonly key: string;
+    readonly displayName: string;
+    readonly allowedModules: number;
+    readonly defaultAbpRole: string;
+    readonly isActive: boolean;
+    readonly identityMode: SdkIdentityMode;
+    readonly defaultUserTypeId: string | null;
+    readonly isRotationPending: boolean;
+    readonly allowedOrigins: readonly string[];
+    readonly roleMappings: readonly ApiKeyRoleMapping[];
+    constructor(props: ApiKeyProps);
+}
+//# sourceMappingURL=api-key.d.ts.map

package/types/features/api-keys/domain/entities/api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/domain/entities/api-key.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;CAGpB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAEzF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrD;AAED;;;GAGG;AACH,qBAAa,MAAM;IACjB,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,SAAgB,QAAQ,EAAE,OAAO,CAAC;IAClC,SAAgB,YAAY,EAAE,eAAe,CAAC;IAC9C,SAAgB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,SAAgB,iBAAiB,EAAE,OAAO,CAAC;IAC3C,SAAgB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,SAAgB,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;gBAExC,KAAK,EAAE,WAAW;CAatC"}

package/types/features/api-keys/domain/entities/index.d.ts

@@ -0,0 +1,3 @@
+export * from './api-key';
+export * from './api-key-credentials';
+//# sourceMappingURL=index.d.ts.map

package/types/features/api-keys/domain/entities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/domain/entities/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,uBAAuB,CAAC"}

package/types/features/api-keys/domain/errors/api-key-errors.d.ts

@@ -0,0 +1,20 @@
+import { DomainError } from '@core/errors';
+/** Base type for every api-keys-domain failure. Lets callers catch/switch on intent. */
+export declare abstract class ApiKeyError extends DomainError {
+}
+/** The api-keys API could not be reached or returned an unexpected response. */
+export declare class ApiKeysUnavailableError extends ApiKeyError {
+    readonly code = "API_KEYS_UNAVAILABLE";
+    constructor(cause?: unknown);
+}
+/** An API key display name failed domain validation. */
+export declare class InvalidApiKeyNameError extends ApiKeyError {
+    readonly code = "INVALID_API_KEY_NAME";
+    constructor(reason: string);
+}
+/** An entry of the origin allowlist is not a usable origin. */
+export declare class InvalidApiKeyOriginError extends ApiKeyError {
+    readonly code = "INVALID_API_KEY_ORIGIN";
+    constructor(reason: string);
+}
+//# sourceMappingURL=api-key-errors.d.ts.map

package/types/features/api-keys/domain/errors/api-key-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-errors.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/domain/errors/api-key-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,wFAAwF;AACxF,8BAAsB,WAAY,SAAQ,WAAW;CAAG;AAExD,gFAAgF;AAChF,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAgB,IAAI,0BAA0B;gBAE3B,KAAK,CAAC,EAAE,OAAO;CAGnC;AAED,wDAAwD;AACxD,qBAAa,sBAAuB,SAAQ,WAAW;IACrD,SAAgB,IAAI,0BAA0B;gBAE3B,MAAM,EAAE,MAAM;CAGlC;AAED,+DAA+D;AAC/D,qBAAa,wBAAyB,SAAQ,WAAW;IACvD,SAAgB,IAAI,4BAA4B;gBAE7B,MAAM,EAAE,MAAM;CAGlC"}

package/types/features/api-keys/domain/index.d.ts

@@ -0,0 +1,6 @@
+export * from './entities/api-key';
+export * from './entities/api-key-credentials';
+export * from './value-objects';
+export * from './ports/api-key-gateway';
+export * from './errors/api-key-errors';
+//# sourceMappingURL=index.d.ts.map

package/types/features/api-keys/domain/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/features/api-keys/domain/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC"}

package/types/features/api-keys/domain/ports/api-key-gateway.d.ts

@@ -0,0 +1,50 @@
+import type { Result } from '@core/result';
+import type { ApiKeyError } from '../errors/api-key-errors';
+import type { ApiKey, SdkIdentityMode } from '../entities/api-key';
+import type { ApiKeyCredentials } from '../entities/api-key-credentials';
+export interface CreateApiKeyCommand {
+    readonly displayName: string;
+    readonly allowedModules: number;
+    readonly defaultAbpRole: string;
+    /**
+     * Settable at creation because it is decided by what the key is FOR, which is known while creating
+     * it, and it governs identity resolution and the integration guide the admin is then shown.
+     */
+    readonly identityMode: SdkIdentityMode;
+    /** Leaving this null is not neutral — an untyped user's member pool is the whole tenant. */
+    readonly defaultUserTypeId: string | null;
+    readonly allowedOrigins: readonly string[];
+    readonly roleMappings: readonly {
+        hostRole: string;
+        abpRole: string;
+    }[];
+}
+export interface UpdateApiKeyCommand {
+    /**
+     * Required by the server, which rejects the whole update without it. Editable here too — the
+     * backend has always supported renaming, and a form that had to send a value it would not let you
+     * change was how this came to be omitted in the first place.
+     */
+    readonly displayName: string;
+    readonly allowedModules: number;
+    readonly defaultAbpRole: string;
+    readonly isActive: boolean;
+    readonly identityMode: SdkIdentityMode;
+    readonly defaultUserTypeId: string | null;
+    readonly allowedOrigins: readonly string[];
+    readonly roleMappings: readonly {
+        hostRole: string;
+        abpRole: string;
+    }[];
+}
+export interface ApiKeyGateway {
+    getList(): Promise<Result<readonly ApiKey[], ApiKeyError>>;
+    create(cmd: CreateApiKeyCommand): Promise<Result<ApiKeyCredentials, ApiKeyError>>;
+    update(id: string, cmd: UpdateApiKeyCommand): Promise<Result<ApiKey, ApiKeyError>>;
+    /** Phase 1 of rotation: mint a new secret while the old one still verifies. */
+    rotateSecret(id: string): Promise<Result<ApiKeyCredentials, ApiKeyError>>;
+    /** Phase 2 of rotation: retire the previous secret. */
+    confirmRotation(id: string): Promise<Result<ApiKey, ApiKeyError>>;
+    remove(id: string): Promise<Result<void, ApiKeyError>>;
+}
+//# sourceMappingURL=api-key-gateway.d.ts.map

package/types/features/api-keys/domain/ports/api-key-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-gateway.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/domain/ports/api-key-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,4FAA4F;IAC5F,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzE;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzE;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACnF,+EAA+E;IAC/E,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1E,uDAAuD;IACvD,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;CACxD"}

package/types/features/api-keys/domain/value-objects/api-key-display-name.d.ts

@@ -0,0 +1,8 @@
+import { type Result } from '@core/result';
+import { type ApiKeyError } from '../errors/api-key-errors';
+export declare class ApiKeyDisplayName {
+    readonly value: string;
+    private constructor();
+    static create(raw: string): Result<ApiKeyDisplayName, ApiKeyError>;
+}
+//# sourceMappingURL=api-key-display-name.d.ts.map

package/types/features/api-keys/domain/value-objects/api-key-display-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-display-name.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/domain/value-objects/api-key-display-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAA0B,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEpF,qBAAa,iBAAiB;IAC5B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,OAAO;WAIO,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC;CAc1E"}

package/types/features/api-keys/domain/value-objects/api-key-origin.d.ts

@@ -0,0 +1,28 @@
+import { type Result } from '@core/result';
+import { type ApiKeyError } from '../errors/api-key-errors';
+/**
+ * One entry of a key's origin allowlist, in the canonical form the backend stores.
+ *
+ * <p>Mirrors `SdkOriginNormalizer` (Domain.Shared): `scheme://host[:port]`, lowercased, with the
+ * scheme's default port elided so `https://a.com` and `https://a.com:443` are the same entry. Path,
+ * query, fragment and userinfo are discarded rather than compared — `https://evil.com#https://good.com`
+ * must never be able to masquerade as an allowed entry.</p>
+ *
+ * <p>It exists on this side because the backend <em>silently drops</em> anything that does not
+ * normalize. An admin who types `example.com` would get an empty allowlist back, and an empty
+ * allowlist means no origin check at all — the key would be usable from any site, which is the exact
+ * opposite of what they were trying to do. Validating here turns that into a visible error while they
+ * are still looking at the form.</p>
+ */
+export declare class ApiKeyOrigin {
+    readonly value: string;
+    private constructor();
+    static create(raw: string): Result<ApiKeyOrigin, ApiKeyError>;
+}
+/**
+ * Parses the allowlist textarea: one origin per line, blank lines ignored. Fails on the FIRST bad
+ * entry rather than dropping it, and de-duplicates by canonical form so `https://a.com` and
+ * `https://a.com:443/` do not both end up in the list.
+ */
+export declare const parseApiKeyOrigins: (raw: string) => Result<readonly string[], ApiKeyError>;
+//# sourceMappingURL=api-key-origin.d.ts.map

package/types/features/api-keys/domain/value-objects/api-key-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-origin.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/domain/value-objects/api-key-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,qBAAa,YAAY;IACvB,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,OAAO;WAIO,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC;CA+BrE;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,MAAM,KACV,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,WAAW,CAkBvC,CAAC"}

package/types/features/api-keys/domain/value-objects/index.d.ts

@@ -0,0 +1,3 @@
+export * from './api-key-display-name';
+export * from './api-key-origin';
+//# sourceMappingURL=index.d.ts.map

package/types/features/api-keys/domain/value-objects/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/features/api-keys/domain/value-objects/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC"}

package/types/features/api-keys/index.d.ts

@@ -0,0 +1,6 @@
+export * from './domain';
+export * from './application';
+export * from './infrastructure';
+export * from './api-keys-module';
+export * from './presentation';
+//# sourceMappingURL=index.d.ts.map

package/types/features/api-keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/api-keys/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}