@keboola/api-client 1.0.1 → 3.0.0

package/dist/domain/permissions/index.d.cts

@@ -1,5 +1,111 @@
+import { S as StorageToken } from '../../types-DYMMsuU0.cjs';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-CYhB6rYN.cjs';
+
+/**
+ * @module domain/permissions/errors
+ *
+ * Stable error contract for permission denials.
+ *
+ * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The
+ * three public fields are part of the SDK's published contract — consumers
+ * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`
+ * and surface `reason` in UI, so renames here are breaking changes.
+ *
+ * PII boundary on `subject`:
+ *   `subject` is optional and intended for debugging hints only — admin id,
+ *   role name, configuration id, branch id, etc. It MUST NOT carry the full
+ *   `StorageToken`, raw tokens, secrets, or any value that could be logged or
+ *   surfaced to a user without further redaction.
+ */
 declare class PermissionDeniedError extends Error {
-    constructor(message: string);
+    readonly action: string;
+    readonly reason?: string;
+    readonly subject?: string;
+    constructor({ action, reason, subject }: {
+        action: string;
+        reason?: string;
+        subject?: string;
+    });
 }
 
-export { PermissionDeniedError };
+/**
+ * @module domain/permissions/admin
+ *
+ * Baseline admin-role predicates. Token-only — depend purely on the admin
+ * role string carried in `StorageToken.admin.role`. Each predicate has an
+ * `assertCan*` pair that throws `PermissionDeniedError` with a stable
+ * kebab-case `action` field documented per pair.
+ */
+
+declare const isAdmin: (token: StorageToken) => boolean;
+declare const isAdminOrShare: (token: StorageToken) => boolean;
+declare const isProductionManager: (token: StorageToken) => boolean;
+declare const isDeveloperOrReviewer: (token: StorageToken) => boolean;
+declare const assertCanAdmin: (token: StorageToken) => void;
+declare const assertCanAdminOrShare: (token: StorageToken) => void;
+declare const assertCanProductionManage: (token: StorageToken) => void;
+declare const assertCanDevelopOrReview: (token: StorageToken) => void;
+
+/**
+ * @module domain/permissions/configurations
+ *
+ * Predicate pairs guarding the Core SDK configuration workflow methods
+ * (create / copy / migrate-from-template / purge / assign-folder). Each
+ * predicate composes the baseline admin role predicates with the caller-
+ * supplied dev-mode flag from `ctx`.
+ *
+ * Rule shape:
+ *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a
+ *     developer or reviewer.
+ *   - In production (`ctx.isDevModeActive === false`) → caller must be a
+ *     production manager.
+ *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.
+ *     Purge is destructive and the situational base rule does not apply —
+ *     `token.admin.role` is a single scalar, so requiring both "admin" and
+ *     "developer/reviewer/productionManager" simultaneously would be an
+ *     impossible conjunction. The `ctx` parameter is accepted for signature
+ *     symmetry with the other configuration predicates and ignored.
+ *
+ * `ctx` is the trailing object argument convention for composed predicates;
+ * extra fields land here as future rules grow (see AGENTS.md).
+ */
+
+/**
+ * Caller-supplied context for configuration predicates.
+ *
+ * @property isDevModeActive — `true` when the user is operating inside a
+ *   development branch (any storage branch other than the protected default /
+ *   production branch); `false` when operating on the default branch in
+ *   production.
+ *
+ *   How the caller determines this:
+ *   - The active branch comes from the caller's own routing / app state
+ *     (e.g. `/branch/:branchId` in kbc-ui).
+ *   - A branch is "dev mode" when it is **not** the default branch returned by
+ *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).
+ *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`
+ *     compared against the default branch id; the api-client itself stays
+ *     isomorphic and never reads that state directly.
+ *
+ *   Why it changes the rule:
+ *   - In dev branches Keboola allows broader write access — `developer` and
+ *     `reviewer` roles may create / copy / migrate configurations because the
+ *     branch is sandboxed from production.
+ *   - On the default branch only `productionManager` (or `admin`) may perform
+ *     the same writes, since changes ship live to production.
+ */
+type ConfigurationCtx = {
+    isDevModeActive: boolean;
+};
+declare const canCreateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canCopyConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const assertCanCreateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanCopyConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
+
+export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager };

package/dist/domain/permissions/index.d.ts

@@ -1,5 +1,111 @@
+import { S as StorageToken } from '../../types-DYMMsuU0.js';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-Bzslbq4u.js';
+
+/**
+ * @module domain/permissions/errors
+ *
+ * Stable error contract for permission denials.
+ *
+ * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The
+ * three public fields are part of the SDK's published contract — consumers
+ * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`
+ * and surface `reason` in UI, so renames here are breaking changes.
+ *
+ * PII boundary on `subject`:
+ *   `subject` is optional and intended for debugging hints only — admin id,
+ *   role name, configuration id, branch id, etc. It MUST NOT carry the full
+ *   `StorageToken`, raw tokens, secrets, or any value that could be logged or
+ *   surfaced to a user without further redaction.
+ */
 declare class PermissionDeniedError extends Error {
-    constructor(message: string);
+    readonly action: string;
+    readonly reason?: string;
+    readonly subject?: string;
+    constructor({ action, reason, subject }: {
+        action: string;
+        reason?: string;
+        subject?: string;
+    });
 }
 
-export { PermissionDeniedError };
+/**
+ * @module domain/permissions/admin
+ *
+ * Baseline admin-role predicates. Token-only — depend purely on the admin
+ * role string carried in `StorageToken.admin.role`. Each predicate has an
+ * `assertCan*` pair that throws `PermissionDeniedError` with a stable
+ * kebab-case `action` field documented per pair.
+ */
+
+declare const isAdmin: (token: StorageToken) => boolean;
+declare const isAdminOrShare: (token: StorageToken) => boolean;
+declare const isProductionManager: (token: StorageToken) => boolean;
+declare const isDeveloperOrReviewer: (token: StorageToken) => boolean;
+declare const assertCanAdmin: (token: StorageToken) => void;
+declare const assertCanAdminOrShare: (token: StorageToken) => void;
+declare const assertCanProductionManage: (token: StorageToken) => void;
+declare const assertCanDevelopOrReview: (token: StorageToken) => void;
+
+/**
+ * @module domain/permissions/configurations
+ *
+ * Predicate pairs guarding the Core SDK configuration workflow methods
+ * (create / copy / migrate-from-template / purge / assign-folder). Each
+ * predicate composes the baseline admin role predicates with the caller-
+ * supplied dev-mode flag from `ctx`.
+ *
+ * Rule shape:
+ *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a
+ *     developer or reviewer.
+ *   - In production (`ctx.isDevModeActive === false`) → caller must be a
+ *     production manager.
+ *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.
+ *     Purge is destructive and the situational base rule does not apply —
+ *     `token.admin.role` is a single scalar, so requiring both "admin" and
+ *     "developer/reviewer/productionManager" simultaneously would be an
+ *     impossible conjunction. The `ctx` parameter is accepted for signature
+ *     symmetry with the other configuration predicates and ignored.
+ *
+ * `ctx` is the trailing object argument convention for composed predicates;
+ * extra fields land here as future rules grow (see AGENTS.md).
+ */
+
+/**
+ * Caller-supplied context for configuration predicates.
+ *
+ * @property isDevModeActive — `true` when the user is operating inside a
+ *   development branch (any storage branch other than the protected default /
+ *   production branch); `false` when operating on the default branch in
+ *   production.
+ *
+ *   How the caller determines this:
+ *   - The active branch comes from the caller's own routing / app state
+ *     (e.g. `/branch/:branchId` in kbc-ui).
+ *   - A branch is "dev mode" when it is **not** the default branch returned by
+ *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).
+ *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`
+ *     compared against the default branch id; the api-client itself stays
+ *     isomorphic and never reads that state directly.
+ *
+ *   Why it changes the rule:
+ *   - In dev branches Keboola allows broader write access — `developer` and
+ *     `reviewer` roles may create / copy / migrate configurations because the
+ *     branch is sandboxed from production.
+ *   - On the default branch only `productionManager` (or `admin`) may perform
+ *     the same writes, since changes ship live to production.
+ */
+type ConfigurationCtx = {
+    isDevModeActive: boolean;
+};
+declare const canCreateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canCopyConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const assertCanCreateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanCopyConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
+
+export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager };

package/dist/domain/permissions/index.js

@@ -1,11 +1,114 @@
+export { hasAdminFeature, hasFeature } from '../../chunk-UABYNGBZ.js';
+
 // src/domain/permissions/errors.ts
 var PermissionDeniedError = class extends Error {
-  constructor(message) {
-    super(message);
+  action;
+  reason;
+  subject;
+  constructor({ action, reason, subject }) {
+    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);
     this.name = "PermissionDeniedError";
+    this.action = action;
+    this.reason = reason;
+    this.subject = subject;
+  }
+};
+
+// src/domain/permissions/admin.ts
+var AdminRoles = {
+  ADMIN: "admin",
+  SHARE: "share",
+  PRODUCTION_MANAGER: "productionManager",
+  DEVELOPER: "developer",
+  REVIEWER: "reviewer"
+};
+var role = (token) => token.admin.role;
+var isAdmin = (token) => role(token) === AdminRoles.ADMIN;
+var isAdminOrShare = (token) => role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;
+var isProductionManager = (token) => role(token) === AdminRoles.PRODUCTION_MANAGER;
+var isDeveloperOrReviewer = (token) => role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;
+var assertCanAdmin = (token) => {
+  if (!isAdmin(token)) {
+    throw new PermissionDeniedError({
+      action: "admin",
+      reason: `role '${role(token)}' is not admin`
+    });
+  }
+};
+var assertCanAdminOrShare = (token) => {
+  if (!isAdminOrShare(token)) {
+    throw new PermissionDeniedError({
+      action: "admin-or-share",
+      reason: `role '${role(token)}' is not admin or share`
+    });
+  }
+};
+var assertCanProductionManage = (token) => {
+  if (!isProductionManager(token)) {
+    throw new PermissionDeniedError({
+      action: "production-manage",
+      reason: `role '${role(token)}' is not productionManager`
+    });
+  }
+};
+var assertCanDevelopOrReview = (token) => {
+  if (!isDeveloperOrReviewer(token)) {
+    throw new PermissionDeniedError({
+      action: "develop-or-review",
+      reason: `role '${role(token)}' is not developer or reviewer`
+    });
+  }
+};
+
+// src/domain/permissions/configurations.ts
+var meetsBaseRule = (token, ctx) => ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);
+var baseDenialReason = (ctx) => ctx.isDevModeActive ? "dev branch requires developer or reviewer role" : "production requires productionManager role";
+var canCreateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+var canCopyConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+var canMigrateFromTemplate = (token, ctx) => meetsBaseRule(token, ctx);
+var canPurgeConfiguration = (token) => isAdmin(token);
+var canAssignFolder = (token, ctx) => meetsBaseRule(token, ctx);
+var assertCanCreateConfiguration = (token, ctx) => {
+  if (!canCreateConfiguration(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "create-configuration",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanCopyConfiguration = (token, ctx) => {
+  if (!canCopyConfiguration(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "copy-configuration",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanMigrateFromTemplate = (token, ctx) => {
+  if (!canMigrateFromTemplate(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "migrate-from-template",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanPurgeConfiguration = (token, ctx) => {
+  if (!canPurgeConfiguration(token)) {
+    throw new PermissionDeniedError({
+      action: "purge-configuration",
+      reason: "purge requires admin role"
+    });
+  }
+};
+var assertCanAssignFolder = (token, ctx) => {
+  if (!canAssignFolder(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "assign-folder",
+      reason: baseDenialReason(ctx)
+    });
   }
 };
 
-export { PermissionDeniedError };
+export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/domain/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts"],"names":[],"mappings":";AAAO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF","file":"index.js","sourcesContent":["export class PermissionDeniedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PermissionDeniedError';\n  }\n}\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;AChBA,IAAM,UAAA,GAAa;AAAA,EACjB,KAAA,EAAO,OAAA;AAAA,EACP,KAAA,EAAO,OAAA;AAAA,EACP,kBAAA,EAAoB,mBAAA;AAAA,EACpB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU;AACZ,CAAA;AAEA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACXA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { PermissionDeniedError } from './errors';\n\nconst AdminRoles = {\n  ADMIN: 'admin',\n  SHARE: 'share',\n  PRODUCTION_MANAGER: 'productionManager',\n  DEVELOPER: 'developer',\n  REVIEWER: 'reviewer',\n} as const;\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/editor/index.cjs

@@ -1,272 +1,13 @@
 'use strict';
 
-var qs = require('qs');
+var chunkTIIRBQUA_cjs = require('../chunk-TIIRBQUA.cjs');
+require('../chunk-HPVTVQBJ.cjs');
 
-function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var qs__default = /*#__PURE__*/_interopDefault(qs);
 
-// src/errors/ApiError.ts
-var ApiError = class extends Error {
-  response;
-  request;
-  data;
-  constructor({ response, request, data }) {
-    super(response.statusText);
-    this.response = response;
-    this.request = request;
-    this.data = data;
-  }
-};
-
-// src/constants.ts
-var HttpStatus = {
-  NO_CONTENT: 204};
-
-// src/fetchClient/createFetchClient/utils.ts
-var HttpHeader = {
-  CONTENT_TYPE: "content-type"};
-var HttpContentType = {
-  JSON: "application/json"};
-var defaultValidateStatus = ({ response }) => response.status >= 200 && response.status <= 299;
-function removeUndefined(obj) {
-  const objCopy = { ...obj };
-  for (const [key, value] of Object.entries(objCopy)) {
-    if (value == null) delete objCopy[key];
-  }
-  return objCopy;
-}
-var parseData = async (response) => {
-  if (response.status === HttpStatus.NO_CONTENT) return null;
-  const contentType = response.headers.get(HttpHeader.CONTENT_TYPE);
-  if (contentType && contentType == HttpContentType.JSON) {
-    return response.json();
-  }
-  const text = await response.text();
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-};
-var cleanHeadersInit = (headersInit) => {
-  if (Array.isArray(headersInit)) return headersInit;
-  if (headersInit instanceof Headers) return headersInit;
-  if (headersInit == null) return headersInit;
-  return removeUndefined(headersInit);
-};
-var createHeaders = (headersInitA, headersInitB) => {
-  const headersA = new Headers(cleanHeadersInit(headersInitA));
-  const headersB = new Headers(cleanHeadersInit(headersInitB));
-  headersB.forEach((value, key) => {
-    headersA.set(key, value);
-  });
-  return headersA;
-};
-var createPath = (path, pathParam = {}) => path.replace(/\{([^}]+)}/g, (_, key) => {
-  if (!(key in pathParam))
-    throw new Error(`Path parameter "${key}" is missing in the path "${path}"`);
-  return encodeURIComponent(pathParam[key]);
+Object.defineProperty(exports, "createEditorClient", {
+  enumerable: true,
+  get: function () { return chunkTIIRBQUA_cjs.createEditorClient; }
 });
-var createSearch = (query, options = {}) => {
-  return qs__default.default.stringify(query, {
-    encodeValuesOnly: true,
-    skipNulls: true,
-    ...options
-  });
-};
-var createBody = (body, headers) => {
-  if (body == null) return null;
-  if (body instanceof FormData) return body;
-  if (typeof body === "string") return body;
-  const stringifyBody = JSON.stringify(body);
-  const stringBody = stringifyBody === "{}" ? null : stringifyBody;
-  if (stringBody) headers.set(HttpHeader.CONTENT_TYPE, HttpContentType.JSON);
-  return stringBody;
-};
-var createFetchRequest = ({
-  url,
-  method,
-  params,
-  options = {},
-  defaultOptions
-}) => {
-  const {
-    baseUrl,
-    validateStatus: defValidateStatus = defaultValidateStatus,
-    headers: defaultHeaders,
-    ...restDefaultOptions
-  } = defaultOptions;
-  const { validateStatus, queryArrayFormat, headers: endpointHeaders, ...restOptions } = options;
-  const headers = createHeaders(defaultHeaders, endpointHeaders);
-  const path = createPath(url, params.path);
-  const search = createSearch(params.query ?? {}, { arrayFormat: queryArrayFormat });
-  const body = createBody(params.body, headers);
-  const urlInstance = new URL(baseUrl + path);
-  urlInstance.search = search;
-  const request = new Request(urlInstance, {
-    ...restDefaultOptions,
-    ...restOptions,
-    headers,
-    method: method.toUpperCase(),
-    body
-  });
-  return { request, validateStatus: validateStatus ?? defValidateStatus };
-};
-
-// src/fetchClient/createFetchClient/createFetchClient.ts
-var isApiError = (error) => error instanceof ApiError;
-var createCoreFetch = (fetchFn) => async ({ request, validateStatus }) => {
-  const response = await fetchFn(request);
-  const data = await parseData(response);
-  const apiResponse = {
-    request,
-    response,
-    data
-  };
-  const boolOrError = validateStatus(apiResponse);
-  if (isApiError(boolOrError)) throw boolOrError;
-  if (!boolOrError) throw new ApiError(apiResponse);
-  return apiResponse;
-};
-var createFetchClient = ({
-  middlewares = [],
-  ...defaultOptions
-}) => {
-  const coreFetch = createCoreFetch(defaultOptions.fetchFn ?? fetch);
-  const fetchWithMiddlewares = middlewares.reduceRight(
-    (next, middleware) => middleware(next),
-    coreFetch
-  );
-  const createFetchMethod = (method) => async (url, params, options = {}) => {
-    const request = createFetchRequest({
-      url,
-      method,
-      params,
-      defaultOptions,
-      options
-    });
-    const methodMiddlewares = options?.middlewares ?? [];
-    return methodMiddlewares.reduceRight(
-      (next, middleware) => middleware(next),
-      fetchWithMiddlewares
-    )(request);
-  };
-  return {
-    get: createFetchMethod("get"),
-    post: createFetchMethod("post"),
-    put: createFetchMethod("put"),
-    patch: createFetchMethod("patch"),
-    delete: createFetchMethod("delete")
-  };
-};
-
-// src/fetchClient/createOpenapiFetchClient.ts
-var createOpenapiFetchClient = (defaultOptions) => createFetchClient(defaultOptions);
-
-// src/clients/editor/editorClient.ts
-var createEditorClient = ({ baseUrl, middlewares }) => {
-  const client = createOpenapiFetchClient({
-    baseUrl,
-    middlewares
-  });
-  const createSession = async (body) => {
-    const { data } = await client.post("/sql/sessions", {
-      body
-    });
-    return data;
-  };
-  const getSession = async ({ id }, signal) => {
-    const { data } = await client.get(`/sql/sessions/{id}`, { path: { id } }, { signal });
-    return data;
-  };
-  const getSessions = async (query, signal) => {
-    const { data } = await client.get(`/sql/sessions`, { query }, { signal });
-    return data;
-  };
-  const getSessionSchema = async ({
-    id,
-    onlyWorkspaceSchema = "1",
-    loadTables = "1"
-  }, signal) => {
-    const { data } = await client.get(
-      `/sql/sessions/{id}/schema`,
-      {
-        path: { id },
-        query: { onlyWorkspaceSchema, loadTables }
-      },
-      { signal }
-    );
-    return data;
-  };
-  const createQueryJob = async ({ id }, body) => {
-    const { data } = await client.post(`/sql/sessions/{id}/run-query`, {
-      path: { id },
-      body
-    });
-    return data;
-  };
-  const tablePreview = async ({ id }, body) => {
-    const { data } = await client.post(`/sql/sessions/{id}/table-preview`, {
-      path: { id },
-      body
-    });
-    return data;
-  };
-  const tableDefinition = async ({ id, ...query }, signal) => {
-    const { data } = await client.get(
-      `/sql/sessions/{id}/table-ddl`,
-      { path: { id }, query },
-      { signal }
-    );
-    return data;
-  };
-  const load = async ({ id }, body) => {
-    const { data } = await client.post(`/sql/sessions/{id}/load`, {
-      path: { id },
-      body
-    });
-    return data;
-  };
-  const unload = async ({ id }, body) => {
-    const { data } = await client.post(`/sql/sessions/{id}/unload`, {
-      path: { id },
-      // BE error: The body is optional; however, without it, the request will fail with the message "Request content type must be application/json."
-      // This is expected, as our client cannot correctly determine the content type without the body.
-      // This issue should be addressed to indicate that the body is required in their Swagger schema.
-      body: body ?? { tableId: null }
-    });
-    return data;
-  };
-  const resetWorkspacePassword = async (id) => {
-    const { data } = await client.post(`/sql/sessions/{id}/reset-password`, {
-      path: { id }
-    });
-    return data;
-  };
-  const getSessionCredentials = async (id, signal) => {
-    const { data } = await client.get(
-      `/sql/sessions/{id}/credentials`,
-      { path: { id } },
-      { signal }
-    );
-    return data;
-  };
-  return {
-    createSession,
-    getSession,
-    getSessions,
-    getSessionSchema,
-    createQueryJob,
-    tablePreview,
-    tableDefinition,
-    load,
-    unload,
-    resetWorkspacePassword,
-    getSessionCredentials
-  };
-};
-
-exports.createEditorClient = createEditorClient;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map