@keboola/api-client 18.0.1 → 20.0.0

package/dist/{chunk-EAWA66EE.cjs → chunk-YOPRPXER.cjs}

@@ -1,13 +1,14 @@
 'use strict';
 
-var chunkPC522LKL_cjs = require('./chunk-PC522LKL.cjs');
+var chunkHNP33VR5_cjs = require('./chunk-HNP33VR5.cjs');
+var chunkIUN2ZSU3_cjs = require('./chunk-IUN2ZSU3.cjs');
 
 // src/clients/queue/queueClient.ts
-var createQueueClient = ({ baseUrl, middlewares, token }) => {
-  const client = chunkPC522LKL_cjs.createOpenapiFetchClient({
+var createQueueClient = ({ baseUrl, middlewares, auth }) => {
+  const client = chunkIUN2ZSU3_cjs.createOpenapiFetchClient({
     baseUrl,
     middlewares,
-    headers: { [chunkPC522LKL_cjs.KeboolaHttpHeader.STORAGE_API_TOKEN]: token }
+    headers: chunkHNP33VR5_cjs.createAuthHeaders(auth)
   });
   const getJob = async (jobId, signal) => {
     const { data } = await client.get(
@@ -33,5 +34,5 @@ var createQueueClient = ({ baseUrl, middlewares, token }) => {
 };
 
 exports.createQueueClient = createQueueClient;
-//# sourceMappingURL=chunk-EAWA66EE.cjs.map
-//# sourceMappingURL=chunk-EAWA66EE.cjs.map
+//# sourceMappingURL=chunk-YOPRPXER.cjs.map
+//# sourceMappingURL=chunk-YOPRPXER.cjs.map

package/dist/chunk-YOPRPXER.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/clients/queue/queueClient.ts"],"names":["createOpenapiFetchClient","createAuthHeaders"],"mappings":";;;;;;AAOO,IAAM,oBAAoB,CAAC,EAAE,OAAA,EAAS,WAAA,EAAa,MAAK,KAAyB;AACtF,EAAA,MAAM,SAASA,0CAAA,CAAgC;AAAA,IAC7C,OAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAASC,oCAAkB,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAAiC,MAAA,KAAyB;AAC9E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,eAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM,EAAE,KAAA;AAAM,OAChB;AAAA,MACA,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OAAO,KAAA,EAAyB,MAAA,KAAyB;AAC1E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,cAAA;AAAA,MACA;AAAA,QACE;AAAA,OACF;AAAA,MACA,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,QAAQ,UAAA,EAAW;AAC9B","file":"chunk-YOPRPXER.cjs","sourcesContent":["import { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { GetQueueJobPath, SearchJobsQuery } from './types';\n\nexport const createQueueClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const getJob = async (jobId: GetQueueJobPath['jobId'], signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/jobs/{jobId}',\n      {\n        path: { jobId },\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const searchJobs = async (query?: SearchJobsQuery, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/search/jobs',\n      {\n        query,\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  return { getJob, searchJobs };\n};\n"]}

package/dist/{chunk-NFA5ITNG.cjs → chunk-YXGBD4WP.cjs}

@@ -6,9 +6,11 @@ var AdminRole = {
   Share: "share",
   ProductionManager: "productionManager",
   Developer: "developer",
-  Reviewer: "reviewer"
+  Reviewer: "reviewer",
+  ReadOnly: "readOnly",
+  Guest: "guest"
 };
 
 exports.AdminRole = AdminRole;
-//# sourceMappingURL=chunk-NFA5ITNG.cjs.map
-//# sourceMappingURL=chunk-NFA5ITNG.cjs.map
+//# sourceMappingURL=chunk-YXGBD4WP.cjs.map
+//# sourceMappingURL=chunk-YXGBD4WP.cjs.map

package/dist/chunk-YXGBD4WP.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants/adminRoles.ts"],"names":[],"mappings":";;;AAAO,IAAM,SAAA,GAAY;AAAA,EACvB,KAAA,EAAO,OAAA;AAAA,EACP,KAAA,EAAO,OAAA;AAAA,EACP,iBAAA,EAAmB,mBAAA;AAAA,EACnB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU,UAAA;AAAA,EACV,QAAA,EAAU,UAAA;AAAA,EACV,KAAA,EAAO;AACT","file":"chunk-YXGBD4WP.cjs","sourcesContent":["export const AdminRole = {\n  Admin: 'admin',\n  Share: 'share',\n  ProductionManager: 'productionManager',\n  Developer: 'developer',\n  Reviewer: 'reviewer',\n  ReadOnly: 'readOnly',\n  Guest: 'guest',\n} as const;\n\nexport type AdminRole = (typeof AdminRole)[keyof typeof AdminRole];\n"]}

package/dist/{chunk-X23LLSP6.js → chunk-ZAPK7HZS.js}

@@ -1,4 +1,5 @@
-import { createGenericFetchClient, KeboolaHttpHeader } from './chunk-FDFISPDO.js';
+import { createAuthHeaders } from './chunk-WJRHT346.js';
+import { createGenericFetchClient } from './chunk-RK2VGHJE.js';
 
 // src/clients/telemetry/provisioning/provisioning.ts
 var createProvisioning = (client) => {
@@ -16,11 +17,11 @@ var createProvisioning = (client) => {
 };
 
 // src/clients/telemetry/telemetryClient.ts
-var createTelemetryClient = ({ baseUrl, middlewares, token }) => {
+var createTelemetryClient = ({ baseUrl, middlewares, auth }) => {
   const client = createGenericFetchClient({
     baseUrl,
     middlewares,
-    headers: { [KeboolaHttpHeader.STORAGE_API_TOKEN]: token }
+    headers: createAuthHeaders(auth)
   });
   return {
     provisioning: createProvisioning(client)
@@ -28,5 +29,5 @@ var createTelemetryClient = ({ baseUrl, middlewares, token }) => {
 };
 
 export { createTelemetryClient };
-//# sourceMappingURL=chunk-X23LLSP6.js.map
-//# sourceMappingURL=chunk-X23LLSP6.js.map
+//# sourceMappingURL=chunk-ZAPK7HZS.js.map
+//# sourceMappingURL=chunk-ZAPK7HZS.js.map

package/dist/chunk-ZAPK7HZS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/clients/telemetry/provisioning/provisioning.ts","../src/clients/telemetry/telemetryClient.ts"],"names":[],"mappings":";;;;AAIO,IAAM,kBAAA,GAAqB,CAAC,MAAA,KAA+B;AAChE,EAAA,MAAM,iBAAA,GAAoB,OAAO,IAAA,EAA6B,MAAA,KAAyB;AACrF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA;AAAA,MAC5B,yBAAA;AAAA,MACA,EAAE,IAAA,EAAK;AAAA,MACP,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF,CAAA;;;ACVO,IAAM,wBAAwB,CAAC,EAAE,OAAA,EAAS,WAAA,EAAa,MAAK,KAAyB;AAC1F,EAAA,MAAM,SAAS,wBAAA,CAAyB;AAAA,IACtC,OAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAAS,kBAAkB,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,mBAAmB,MAAM;AAAA,GACzC;AACF","file":"chunk-ZAPK7HZS.js","sourcesContent":["import type { GenericFetchClient } from '../telemetryClient';\n\nimport type { CreateCredentialsBody, WorkspaceData } from './types';\n\nexport const createProvisioning = (client: GenericFetchClient) => {\n  const createCredentials = async (body: CreateCredentialsBody, signal?: AbortSignal) => {\n    const { data } = await client.post<WorkspaceData, void, void, CreateCredentialsBody>(\n      '/provisioning/workspace',\n      { body },\n      { signal },\n    );\n\n    return data;\n  };\n\n  return {\n    createCredentials,\n  };\n};\n","import { createGenericFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport { createProvisioning } from './provisioning/provisioning';\n\nexport type GenericFetchClient = ReturnType<typeof createGenericFetchClient>;\n\nexport const createTelemetryClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  return {\n    provisioning: createProvisioning(client),\n  };\n};\n"]}

package/dist/{chunk-3FYGTUWU.js → chunk-ZHNOZHJG.js}

@@ -1,4 +1,4 @@
-import { ApiError } from './chunk-FDFISPDO.js';
+import { ApiError } from './chunk-RK2VGHJE.js';
 
 // src/errors/ManagementClientAuthError.ts
 var ManagementClientAuthError = class extends ApiError {
@@ -12,5 +12,5 @@ var ManagementClientAuthError = class extends ApiError {
 };
 
 export { ManagementClientAuthError };
-//# sourceMappingURL=chunk-3FYGTUWU.js.map
-//# sourceMappingURL=chunk-3FYGTUWU.js.map
+//# sourceMappingURL=chunk-ZHNOZHJG.js.map
+//# sourceMappingURL=chunk-ZHNOZHJG.js.map

package/dist/{chunk-3FYGTUWU.js.map → chunk-ZHNOZHJG.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors/ManagementClientAuthError.ts"],"names":[],"mappings":";;;AAIO,IAAM,yBAAA,GAAN,cAAwC,QAAA,CAAS;AAAA,EACtD,KAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA,CAAY,KAAA,EAAe,OAAA,EAAiB,GAAA,EAAkB;AAC5D,IAAA,KAAA,CAAM,GAAG,CAAA;AACT,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF","file":"chunk-3FYGTUWU.js","sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.title = title;\n    this.message = message;\n  }\n}\n"]}
+{"version":3,"sources":["../src/errors/ManagementClientAuthError.ts"],"names":[],"mappings":";;;AAIO,IAAM,yBAAA,GAAN,cAAwC,QAAA,CAAS;AAAA,EACtD,KAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA,CAAY,KAAA,EAAe,OAAA,EAAiB,GAAA,EAAkB;AAC5D,IAAA,KAAA,CAAM,GAAG,CAAA;AACT,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF","file":"chunk-ZHNOZHJG.js","sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.title = title;\n    this.message = message;\n  }\n}\n"]}

package/dist/{chunk-KWO5WJUT.cjs → chunk-ZLW3243Q.cjs}

@@ -1,6 +1,7 @@
 'use strict';
 
-var chunkPC522LKL_cjs = require('./chunk-PC522LKL.cjs');
+var chunkHNP33VR5_cjs = require('./chunk-HNP33VR5.cjs');
+var chunkIUN2ZSU3_cjs = require('./chunk-IUN2ZSU3.cjs');
 
 // src/clients/metastore/repository/repository.ts
 var createRepository = (client) => {
@@ -162,11 +163,11 @@ var createSchema = (client) => {
 };
 
 // src/clients/metastore/metastoreClient.ts
-var createMetastoreClient = ({ baseUrl, middlewares, token }) => {
-  const client = chunkPC522LKL_cjs.createOpenapiFetchClient({
+var createMetastoreClient = ({ baseUrl, middlewares, auth }) => {
+  const client = chunkIUN2ZSU3_cjs.createOpenapiFetchClient({
     baseUrl,
     middlewares,
-    headers: { [chunkPC522LKL_cjs.KeboolaHttpHeader.STORAGE_API_TOKEN]: token }
+    headers: chunkHNP33VR5_cjs.createAuthHeaders(auth)
   });
   const healthCheck = async (signal) => {
     const { data } = await client.get("/health-check", {}, { signal });
@@ -180,5 +181,5 @@ var createMetastoreClient = ({ baseUrl, middlewares, token }) => {
 };
 
 exports.createMetastoreClient = createMetastoreClient;
-//# sourceMappingURL=chunk-KWO5WJUT.cjs.map
-//# sourceMappingURL=chunk-KWO5WJUT.cjs.map
+//# sourceMappingURL=chunk-ZLW3243Q.cjs.map
+//# sourceMappingURL=chunk-ZLW3243Q.cjs.map

package/dist/chunk-ZLW3243Q.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/clients/metastore/repository/repository.ts","../src/clients/metastore/schema/schema.ts","../src/clients/metastore/metastoreClient.ts"],"names":["createOpenapiFetchClient","createAuthHeaders"],"mappings":";;;;;;AAgBO,IAAM,gBAAA,GAAmB,CAAC,MAAA,KAAiC;AAChE,EAAA,MAAM,cAAA,GAAiB,OAIrB,KAAA,EACA,MAAA,KACG;AACH,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,iCAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA,OACR;AAAA,MACA,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,sBAAA,GAAyB,OAI7B,KAAA,EACA,MAAA,KACG;AACH,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,2CAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA,OACR;AAAA,MACA,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,aAAA,GAAgB,OAIpB,KAAA,EACA,MAAA,KACG;AACH,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,wCAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA,OACR;AAAA,MACA;AAAA,QACE;AAAA;AACF,KACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,mBAAmB,OAGvB;AAAA,IACA,UAAA;AAAA,IACA,IAAA;AAAA,IACA,GAAG;AAAA,GACL,KAAoC;AAClC,IAAA,MAAM,EAAE,IAAA,EAAM,iBAAA,KAAsB,MAAM,MAAA,CAAO,KAAK,iCAAA,EAAmC;AAAA,MACvF,IAAA,EAAM,EAAE,UAAA,EAAuB;AAAA,MAC/B,IAAA,EAAM;AAAA,QACJ,IAAA;AAAA,QACA,GAAG;AAAA;AACL,KACD,CAAA;AAED,IAAA,OAAO,iBAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmB,OAAO,KAAA,KAAgC;AAC9D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,OAAO,wCAAA,EAA0C;AAAA,MAC7E,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,mBAAmB,OAGvB;AAAA,IACA,UAAA;AAAA,IACA,IAAA;AAAA,IACA,IAAA;AAAA,IACA,GAAG;AAAA,GACL,KAAoC;AAClC,IAAA,MAAM,EAAE,IAAA,EAAM,iBAAA,EAAkB,GAAI,MAAM,MAAA,CAAO,KAAA;AAAA,MAC/C,wCAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA,UACJ,UAAA;AAAA,UACA;AAAA,SACF;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,IAAA;AAAA,UACA,GAAG;AAAA;AACL;AACF,KACF;AAEA,IAAA,OAAO,iBAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,oBAAoB,OAGxB;AAAA,IACA,UAAA;AAAA,IACA,IAAA;AAAA,IACA,IAAA;AAAA,IACA,GAAG;AAAA,GACL,KAAqC;AACnC,IAAA,MAAM,EAAE,IAAA,EAAM,kBAAA,EAAmB,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAChD,wCAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA,UACJ,UAAA;AAAA,UACA;AAAA,SACF;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,IAAA;AAAA,UACA,GAAG;AAAA;AACL;AACF,KACF;AAEA,IAAA,OAAO,kBAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,qBAAA,GAAwB,OAI5B,KAAA,EACA,MAAA,KACG;AACH,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,6DAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA,OACR;AAAA,MACA,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,wBAAA,GAA2B,OAAO,KAAA,KAAwC;AAC9E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,MAAA;AAAA,MAC5B,6DAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA;AACR,KACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA;AAAA,IAEL,cAAA;AAAA,IACA,sBAAA;AAAA;AAAA,IAGA,aAAA;AAAA,IACA,gBAAA;AAAA,IACA,gBAAA;AAAA,IACA,gBAAA;AAAA,IACA,iBAAA;AAAA;AAAA,IAGA,qBAAA;AAAA,IACA;AAAA,GACF;AACF,CAAA;;;ACjMO,IAAM,YAAA,GAAe,CAAC,MAAA,KAAiC;AAC5D,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,EAAsB,MAAA,KAAyB;AACtE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,6BAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA,OACR;AAAA,MACA,EAAE,MAAA;AAAO,KACX;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,kBAAA,GAAqB,OAAO,KAAA,EAA+B,MAAA,KAAyB;AACxF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,uCAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM;AAAA,OACR;AAAA,MACA,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA;AAAA,GACF;AACF,CAAA;;;ACtBO,IAAM,wBAAwB,CAAC,EAAE,OAAA,EAAS,WAAA,EAAa,MAAK,KAAyB;AAC1F,EAAA,MAAM,SAASA,0CAAA,CAAgC;AAAA,IAC7C,OAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAASC,oCAAkB,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,OAAO,MAAA,KAAyB;AAClD,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,eAAA,EAAiB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AACjE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,UAAA,EAAY,iBAAiB,MAAM,CAAA;AAAA,IACnC,MAAA,EAAQ,aAAa,MAAM;AAAA,GAC7B;AACF","file":"chunk-ZLW3243Q.cjs","sourcesContent":["import type { MetastoreFetchClient } from '../metastoreClient';\n\nimport type {\n  CreateMetaObjectInput,\n  DeleteMetaObjectPath,\n  DeleteMetaObjectRevisionPath,\n  GetMetaObjectPath,\n  GetMetaObjectRevisionPath,\n  GetMetaObjectRevisionsPath,\n  GetMetaObjectsPath,\n  MetaStoreListResponse,\n  MetaStoreObjectResponse,\n  ReplaceMetaObjectInput,\n  UpdateMetaObjectInput,\n} from './types';\n\nexport const createRepository = (client: MetastoreFetchClient) => {\n  const getMetaObjects = async <\n    TData extends Record<string, unknown>,\n    TDataOptional extends boolean = false,\n  >(\n    input: GetMetaObjectsPath,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/api/v1/repository/{objectType}',\n      {\n        path: input,\n      },\n      { signal },\n    );\n\n    return data as unknown as MetaStoreListResponse<TData, TDataOptional>;\n  };\n\n  const getMetaObjectRevisions = async <\n    TData extends Record<string, unknown>,\n    TDataOptional extends boolean = false,\n  >(\n    input: GetMetaObjectRevisionsPath,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/api/v1/repository/{objectType}/revisions',\n      {\n        path: input,\n      },\n      { signal },\n    );\n\n    return data as unknown as MetaStoreListResponse<TData, TDataOptional>;\n  };\n\n  const getMetaObject = async <\n    TData extends Record<string, unknown>,\n    TDataOptional extends boolean = false,\n  >(\n    input: GetMetaObjectPath,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/api/v1/repository/{objectType}/{UUID}',\n      {\n        path: input,\n      },\n      {\n        signal,\n      },\n    );\n\n    return data as unknown as MetaStoreObjectResponse<TData, TDataOptional>;\n  };\n\n  const createMetaObject = async <\n    TData extends Record<string, unknown>,\n    TDataOptional extends boolean = false,\n  >({\n    objectType,\n    data,\n    ...body\n  }: CreateMetaObjectInput<TData>) => {\n    const { data: createdMetaObject } = await client.post('/api/v1/repository/{objectType}', {\n      path: { objectType: objectType },\n      body: {\n        data: data as Record<string, never>,\n        ...body,\n      },\n    });\n\n    return createdMetaObject as unknown as MetaStoreObjectResponse<TData, TDataOptional>;\n  };\n\n  const deleteMetaObject = async (input: DeleteMetaObjectPath) => {\n    const { data } = await client.delete('/api/v1/repository/{objectType}/{UUID}', {\n      path: input,\n    });\n\n    return data;\n  };\n\n  const updateMetaObject = async <\n    TData extends Record<string, unknown>,\n    TDataOptional extends boolean = false,\n  >({\n    objectType,\n    UUID,\n    data,\n    ...body\n  }: UpdateMetaObjectInput<TData>) => {\n    const { data: updatedMetaObject } = await client.patch(\n      '/api/v1/repository/{objectType}/{UUID}',\n      {\n        path: {\n          objectType: objectType,\n          UUID: UUID,\n        },\n        body: {\n          data: data as Record<string, never>,\n          ...body,\n        },\n      },\n    );\n\n    return updatedMetaObject as unknown as MetaStoreObjectResponse<TData, TDataOptional>;\n  };\n\n  const replaceMetaObject = async <\n    TData extends Record<string, unknown>,\n    TDataOptional extends boolean = false,\n  >({\n    objectType,\n    UUID,\n    data,\n    ...body\n  }: ReplaceMetaObjectInput<TData>) => {\n    const { data: replacedMetaObject } = await client.put(\n      '/api/v1/repository/{objectType}/{UUID}',\n      {\n        path: {\n          objectType: objectType,\n          UUID: UUID,\n        },\n        body: {\n          data: data as Record<string, never>,\n          ...body,\n        },\n      },\n    );\n\n    return replacedMetaObject as unknown as MetaStoreObjectResponse<TData, TDataOptional>;\n  };\n\n  const getMetaObjectRevision = async <\n    TData extends Record<string, unknown>,\n    TDataOptional extends boolean = false,\n  >(\n    input: GetMetaObjectRevisionPath,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/api/v1/repository/{objectType}/{UUID}/revisions/{revision}',\n      {\n        path: input,\n      },\n      { signal },\n    );\n\n    return data as unknown as MetaStoreObjectResponse<TData, TDataOptional>;\n  };\n\n  const deleteMetaObjectRevision = async (input: DeleteMetaObjectRevisionPath) => {\n    const { data } = await client.delete(\n      '/api/v1/repository/{objectType}/{UUID}/revisions/{revision}',\n      {\n        path: input,\n      },\n    );\n\n    return data;\n  };\n\n  return {\n    // lists\n    getMetaObjects,\n    getMetaObjectRevisions,\n\n    // objects\n    getMetaObject,\n    createMetaObject,\n    deleteMetaObject,\n    updateMetaObject,\n    replaceMetaObject,\n\n    // revisons\n    getMetaObjectRevision,\n    deleteMetaObjectRevision,\n  };\n};\n","import type { MetastoreFetchClient } from '../metastoreClient';\n\nimport type { GetSchemaPath, GetVersionedSchemaPath } from './types';\n\nexport const createSchema = (client: MetastoreFetchClient) => {\n  const getSchema = async (input: GetSchemaPath, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/api/v1/schema/{objectType}',\n      {\n        path: input,\n      },\n      { signal },\n    );\n    return data;\n  };\n\n  const getVersionedSchema = async (input: GetVersionedSchemaPath, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/api/v1/schema/{objectType}/{version}',\n      {\n        path: input,\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  return {\n    getSchema,\n    getVersionedSchema,\n  };\n};\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createRepository } from './repository';\nimport { createSchema } from './schema';\n\nexport type MetastoreFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createMetastoreClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/health-check', {}, { signal });\n    return data;\n  };\n\n  return {\n    healthCheck,\n    repository: createRepository(client),\n    schema: createSchema(client),\n  };\n};\n"]}

package/dist/constants/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkNFA5ITNG_cjs = require('../chunk-NFA5ITNG.cjs');
+var chunkYXGBD4WP_cjs = require('../chunk-YXGBD4WP.cjs');
 var chunk3FZHFTLG_cjs = require('../chunk-3FZHFTLG.cjs');
 var chunkTTPJSPZA_cjs = require('../chunk-TTPJSPZA.cjs');
 
@@ -151,7 +151,7 @@ var URLS = {
 
 Object.defineProperty(exports, "AdminRole", {
   enumerable: true,
-  get: function () { return chunkNFA5ITNG_cjs.AdminRole; }
+  get: function () { return chunkYXGBD4WP_cjs.AdminRole; }
 });
 Object.defineProperty(exports, "ProjectFeature", {
   enumerable: true,

package/dist/constants/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AdminRole, B as Backend } from '../backends-BgUzAQul.cjs';
+export { A as AdminRole, B as Backend } from '../backends-Bofq_Nr0.cjs';
 
 declare const ComponentId: {
     readonly WR_DB_MYSQL: "keboola.wr-db-mysql";

package/dist/constants/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AdminRole, B as Backend } from '../backends-BgUzAQul.js';
+export { A as AdminRole, B as Backend } from '../backends-Bofq_Nr0.js';
 
 declare const ComponentId: {
     readonly WR_DB_MYSQL: "keboola.wr-db-mysql";

package/dist/constants/index.js

@@ -1,4 +1,4 @@
-export { AdminRole } from '../chunk-Y5QJJWDQ.js';
+export { AdminRole } from '../chunk-552FC4ZV.js';
 export { ProjectFeature } from '../chunk-GM3AKU5T.js';
 export { ComponentId } from '../chunk-WFBQUWRC.js';
 

package/dist/{createGenericFetchClient-CSHOaFE3.d.cts → createGenericFetchClient-CrB9cdk8.d.cts}

@@ -1,4 +1,4 @@
-import { b as CreateFetchClientOptions, P as PathParam, Q as QueryParam, B as BodyParam, F as FetchClientOptions, A as ApiResponse } from './types-BLJoO6YL.cjs';
+import { b as CreateFetchClientOptions, P as PathParam, Q as QueryParam, B as BodyParam, F as FetchClientOptions, A as ApiResponse } from './types-0yn6OefX.cjs';
 
 type FetchParams<Path = PathParam, Query = QueryParam, Body = BodyParam> = {
     path?: Path;

package/dist/{createGenericFetchClient-D_vU8nco.d.ts → createGenericFetchClient-D4tfhW6Z.d.ts}

@@ -1,4 +1,4 @@
-import { b as CreateFetchClientOptions, P as PathParam, Q as QueryParam, B as BodyParam, F as FetchClientOptions, A as ApiResponse } from './types-BLJoO6YL.js';
+import { b as CreateFetchClientOptions, P as PathParam, Q as QueryParam, B as BodyParam, F as FetchClientOptions, A as ApiResponse } from './types-0yn6OefX.js';
 
 type FetchParams<Path = PathParam, Query = QueryParam, Body = BodyParam> = {
     path?: Path;

package/dist/{createOpenapiFetchClient-B50N1zkV.d.ts → createOpenapiFetchClient-DLA4-_yg.d.ts}

@@ -1,4 +1,4 @@
-import { H as HttpMethod, b as CreateFetchClientOptions, F as FetchClientOptions, A as ApiResponse } from './types-BLJoO6YL.js';
+import { H as HttpMethod, b as CreateFetchClientOptions, F as FetchClientOptions, A as ApiResponse } from './types-0yn6OefX.js';
 import { O as OpenapiParametersType, a as OpenapiReturnType } from './types-jKnx7Tm_.js';
 
 type OpenapiPaths<Paths> = {

package/dist/{createOpenapiFetchClient-CKNLT4ND.d.cts → createOpenapiFetchClient-zK2SckO2.d.cts}

@@ -1,4 +1,4 @@
-import { H as HttpMethod, b as CreateFetchClientOptions, F as FetchClientOptions, A as ApiResponse } from './types-BLJoO6YL.cjs';
+import { H as HttpMethod, b as CreateFetchClientOptions, F as FetchClientOptions, A as ApiResponse } from './types-0yn6OefX.cjs';
 import { O as OpenapiParametersType, a as OpenapiReturnType } from './types-jKnx7Tm_.cjs';
 
 type OpenapiPaths<Paths> = {

package/dist/dataScience/index.cjs

@@ -1,18 +1,19 @@
 'use strict';
 
-var chunk2HPI7FTO_cjs = require('../chunk-2HPI7FTO.cjs');
+var chunk4H2DDEUI_cjs = require('../chunk-4H2DDEUI.cjs');
 require('../chunk-MRHQJNWF.cjs');
-require('../chunk-PC522LKL.cjs');
+require('../chunk-HNP33VR5.cjs');
+require('../chunk-IUN2ZSU3.cjs');
 
 
 
 Object.defineProperty(exports, "createDataScienceClient", {
   enumerable: true,
-  get: function () { return chunk2HPI7FTO_cjs.createDataScienceClient; }
+  get: function () { return chunk4H2DDEUI_cjs.createDataScienceClient; }
 });
 Object.defineProperty(exports, "parseLogLines", {
   enumerable: true,
-  get: function () { return chunk2HPI7FTO_cjs.parseLogLines; }
+  get: function () { return chunk4H2DDEUI_cjs.parseLogLines; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/dataScience/index.d.cts

@@ -1,10 +1,10 @@
-import { C as ClientInitOptions, A as ApiResponse } from '../types-BLJoO6YL.cjs';
+import { C as ClientInitOptions, A as ApiResponse } from '../types-0yn6OefX.cjs';
 import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath, k as DeleteSandboxPath } from '../utils-DDERw8dM.cjs';
 export { p as parseLogLines } from '../utils-DDERw8dM.cjs';
 import 'qs';
 import '../types-jKnx7Tm_.cjs';
 
-declare const createDataScienceClient: ({ baseUrl, middlewares, token }: ClientInitOptions) => {
+declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
     getAppRuns: (appId: GetDataAppRunsPath["appId"], query?: GetDataAppRunsQuery, signal?: AbortSignal) => Promise<{
         state: "failed" | "starting" | "running" | "finished";
         id: string;

package/dist/dataScience/index.d.ts

@@ -1,10 +1,10 @@
-import { C as ClientInitOptions, A as ApiResponse } from '../types-BLJoO6YL.js';
+import { C as ClientInitOptions, A as ApiResponse } from '../types-0yn6OefX.js';
 import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath, k as DeleteSandboxPath } from '../utils-C7eSJKtG.js';
 export { p as parseLogLines } from '../utils-C7eSJKtG.js';
 import 'qs';
 import '../types-jKnx7Tm_.js';
 
-declare const createDataScienceClient: ({ baseUrl, middlewares, token }: ClientInitOptions) => {
+declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
     getAppRuns: (appId: GetDataAppRunsPath["appId"], query?: GetDataAppRunsQuery, signal?: AbortSignal) => Promise<{
         state: "failed" | "starting" | "running" | "finished";
         id: string;

package/dist/dataScience/index.js

@@ -1,5 +1,6 @@
-export { createDataScienceClient, parseLogLines } from '../chunk-PC5GISUV.js';
+export { createDataScienceClient, parseLogLines } from '../chunk-HEVDH4JQ.js';
 import '../chunk-MSI6FVGG.js';
-import '../chunk-FDFISPDO.js';
+import '../chunk-WJRHT346.js';
+import '../chunk-RK2VGHJE.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/domain/permissions/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkNFA5ITNG_cjs = require('../../chunk-NFA5ITNG.cjs');
+var chunkYXGBD4WP_cjs = require('../../chunk-YXGBD4WP.cjs');
 var chunkGF4XZK5N_cjs = require('../../chunk-GF4XZK5N.cjs');
 
 // src/domain/permissions/errors.ts
@@ -19,10 +19,11 @@ var PermissionDeniedError = class extends Error {
 
 // src/domain/permissions/admin.ts
 var role = (token) => token.admin.role;
-var isAdmin = (token) => role(token) === chunkNFA5ITNG_cjs.AdminRole.Admin;
-var isAdminOrShare = (token) => role(token) === chunkNFA5ITNG_cjs.AdminRole.Admin || role(token) === chunkNFA5ITNG_cjs.AdminRole.Share;
-var isProductionManager = (token) => role(token) === chunkNFA5ITNG_cjs.AdminRole.ProductionManager;
-var isDeveloperOrReviewer = (token) => role(token) === chunkNFA5ITNG_cjs.AdminRole.Developer || role(token) === chunkNFA5ITNG_cjs.AdminRole.Reviewer;
+var isAdmin = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.Admin;
+var isAdminOrShare = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.Admin || role(token) === chunkYXGBD4WP_cjs.AdminRole.Share;
+var isProductionManager = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.ProductionManager;
+var isDeveloperOrReviewer = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.Developer || role(token) === chunkYXGBD4WP_cjs.AdminRole.Reviewer;
+var isReadOnlyRole = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.ReadOnly;
 var assertCanAdmin = (token) => {
   if (!isAdmin(token)) {
     throw new PermissionDeniedError({
@@ -132,5 +133,6 @@ exports.isAdmin = isAdmin;
 exports.isAdminOrShare = isAdminOrShare;
 exports.isDeveloperOrReviewer = isDeveloperOrReviewer;
 exports.isProductionManager = isProductionManager;
+exports.isReadOnlyRole = isReadOnlyRole;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/domain/permissions/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRole"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAE5D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRole"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAEnF,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACNA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/domain/permissions/index.d.cts

@@ -1,6 +1,6 @@
-import { S as StorageToken } from '../../types-CMEwVQ78.cjs';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-NJuUPx8-.cjs';
-import '../../backends-BgUzAQul.cjs';
+import { S as StorageToken } from '../../types-ClxrZC77.cjs';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-CX3TEH8A.cjs';
+import '../../backends-Bofq_Nr0.cjs';
 import '../../types-jKnx7Tm_.cjs';
 
 /**
@@ -43,6 +43,7 @@ declare const isAdmin: (token: StorageToken) => boolean;
 declare const isAdminOrShare: (token: StorageToken) => boolean;
 declare const isProductionManager: (token: StorageToken) => boolean;
 declare const isDeveloperOrReviewer: (token: StorageToken) => boolean;
+declare const isReadOnlyRole: (token: StorageToken) => boolean;
 declare const assertCanAdmin: (token: StorageToken) => void;
 declare const assertCanAdminOrShare: (token: StorageToken) => void;
 declare const assertCanProductionManage: (token: StorageToken) => void;
@@ -110,4 +111,4 @@ declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: Configura
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
 
-export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager };
+export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager, isReadOnlyRole };

package/dist/domain/permissions/index.d.ts

@@ -1,6 +1,6 @@
-import { S as StorageToken } from '../../types-GmAeMsok.js';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-BxSa1Ci9.js';
-import '../../backends-BgUzAQul.js';
+import { S as StorageToken } from '../../types-o8eTf_G9.js';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-Bj7A_TSe.js';
+import '../../backends-Bofq_Nr0.js';
 import '../../types-jKnx7Tm_.js';
 
 /**
@@ -43,6 +43,7 @@ declare const isAdmin: (token: StorageToken) => boolean;
 declare const isAdminOrShare: (token: StorageToken) => boolean;
 declare const isProductionManager: (token: StorageToken) => boolean;
 declare const isDeveloperOrReviewer: (token: StorageToken) => boolean;
+declare const isReadOnlyRole: (token: StorageToken) => boolean;
 declare const assertCanAdmin: (token: StorageToken) => void;
 declare const assertCanAdminOrShare: (token: StorageToken) => void;
 declare const assertCanProductionManage: (token: StorageToken) => void;
@@ -110,4 +111,4 @@ declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: Configura
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
 
-export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager };
+export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager, isReadOnlyRole };

package/dist/domain/permissions/index.js

@@ -1,4 +1,4 @@
-import { AdminRole } from '../../chunk-Y5QJJWDQ.js';
+import { AdminRole } from '../../chunk-552FC4ZV.js';
 export { hasAdminFeature, hasFeature } from '../../chunk-UABYNGBZ.js';
 
 // src/domain/permissions/errors.ts
@@ -21,6 +21,7 @@ var isAdmin = (token) => role(token) === AdminRole.Admin;
 var isAdminOrShare = (token) => role(token) === AdminRole.Admin || role(token) === AdminRole.Share;
 var isProductionManager = (token) => role(token) === AdminRole.ProductionManager;
 var isDeveloperOrReviewer = (token) => role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;
+var isReadOnlyRole = (token) => role(token) === AdminRole.ReadOnly;
 var assertCanAdmin = (token) => {
   if (!isAdmin(token)) {
     throw new PermissionDeniedError({
@@ -103,6 +104,6 @@ var assertCanAssignFolder = (token, ctx) => {
   }
 };
 
-export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager };
+export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager, isReadOnlyRole };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/domain/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAE5D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAEnF,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACNA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/editor/index.cjs

@@ -1,13 +1,14 @@
 'use strict';
 
-var chunk7CTIKR3B_cjs = require('../chunk-7CTIKR3B.cjs');
-require('../chunk-PC522LKL.cjs');
+var chunkAKDJSXVJ_cjs = require('../chunk-AKDJSXVJ.cjs');
+require('../chunk-HNP33VR5.cjs');
+require('../chunk-IUN2ZSU3.cjs');
 
 
 
 Object.defineProperty(exports, "createEditorClient", {
   enumerable: true,
-  get: function () { return chunk7CTIKR3B_cjs.createEditorClient; }
+  get: function () { return chunkAKDJSXVJ_cjs.createEditorClient; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/editor/index.d.cts

@@ -1,9 +1,9 @@
 import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-CWebeQXy.cjs';
-import { C as ClientInitOptions } from '../types-BLJoO6YL.cjs';
+import { C as ClientInitOptions } from '../types-0yn6OefX.cjs';
 import '../types-jKnx7Tm_.cjs';
 import 'qs';
 
-declare const createEditorClient: ({ baseUrl, middlewares, token }: ClientInitOptions) => {
+declare const createEditorClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
     createSession: (body: CreateSqlSessionBody) => Promise<{
         id: string;
         createdAt: string;

package/dist/editor/index.d.ts

@@ -1,9 +1,9 @@
 import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-CFd7q2ed.js';
-import { C as ClientInitOptions } from '../types-BLJoO6YL.js';
+import { C as ClientInitOptions } from '../types-0yn6OefX.js';
 import '../types-jKnx7Tm_.js';
 import 'qs';
 
-declare const createEditorClient: ({ baseUrl, middlewares, token }: ClientInitOptions) => {
+declare const createEditorClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
     createSession: (body: CreateSqlSessionBody) => Promise<{
         id: string;
         createdAt: string;

package/dist/editor/index.js

@@ -1,4 +1,5 @@
-export { createEditorClient } from '../chunk-YD3KMWND.js';
-import '../chunk-FDFISPDO.js';
+export { createEditorClient } from '../chunk-K6E7LOWZ.js';
+import '../chunk-WJRHT346.js';
+import '../chunk-RK2VGHJE.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map