@keboola/api-client 21.0.0 → 23.0.0

package/dist/dataScience/index.d.cts

@@ -1,8 +1,8 @@
 import { C as ClientInitOptions, A as ApiResponse } from '../types-DqxZDbM1.cjs';
-import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath, k as DeleteSandboxPath } from '../utils-DDERw8dM.cjs';
-export { p as parseLogLines } from '../utils-DDERw8dM.cjs';
+import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath, k as DeleteSandboxPath } from '../utils-CuiDsDxz.cjs';
+export { p as parseLogLines } from '../utils-CuiDsDxz.cjs';
 import 'qs';
-import '../types-jKnx7Tm_.cjs';
+import '../types-BbM5WDSR.cjs';
 
 declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
     getAppRuns: (appId: GetDataAppRunsPath["appId"], query?: GetDataAppRunsQuery, signal?: AbortSignal) => Promise<{
@@ -65,7 +65,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }[]>;
     getApp: (appId: GetDataAppPath["appId"], signal?: AbortSignal) => Promise<{
@@ -85,7 +84,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }>;
     createApp: (body: CreateDataAppBody, signal?: AbortSignal) => Promise<{
@@ -105,7 +103,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }>;
     patchApp: (appId: PatchDataAppPath["appId"], body: PatchDataAppBody, signal?: AbortSignal) => Promise<{
@@ -125,7 +122,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }>;
     deleteApp: (appId: DeleteDataAppPath["appId"], signal?: AbortSignal) => Promise<ApiResponse<never>>;
@@ -149,7 +145,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }>;
     getRuntimes: (signal?: AbortSignal) => Promise<{

package/dist/dataScience/index.d.ts

@@ -1,8 +1,8 @@
 import { C as ClientInitOptions, A as ApiResponse } from '../types-DqxZDbM1.js';
-import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath, k as DeleteSandboxPath } from '../utils-C7eSJKtG.js';
-export { p as parseLogLines } from '../utils-C7eSJKtG.js';
+import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath, k as DeleteSandboxPath } from '../utils-zcz60drL.js';
+export { p as parseLogLines } from '../utils-zcz60drL.js';
 import 'qs';
-import '../types-jKnx7Tm_.js';
+import '../types-BbM5WDSR.js';
 
 declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
     getAppRuns: (appId: GetDataAppRunsPath["appId"], query?: GetDataAppRunsQuery, signal?: AbortSignal) => Promise<{
@@ -65,7 +65,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }[]>;
     getApp: (appId: GetDataAppPath["appId"], signal?: AbortSignal) => Promise<{
@@ -85,7 +84,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }>;
     createApp: (body: CreateDataAppBody, signal?: AbortSignal) => Promise<{
@@ -105,7 +103,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }>;
     patchApp: (appId: PatchDataAppPath["appId"], body: PatchDataAppBody, signal?: AbortSignal) => Promise<{
@@ -125,7 +122,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }>;
     deleteApp: (appId: DeleteDataAppPath["appId"], signal?: AbortSignal) => Promise<ApiResponse<never>>;
@@ -149,7 +145,6 @@ declare const createDataScienceClient: ({ baseUrl, middlewares, auth }: ClientIn
         autoSuspendAfterSeconds?: number;
         autoRestartEnabled?: boolean;
         size?: string | null;
-        provisioningStrategy: "jobQueue" | "operator";
         hasManagedGitRepo?: boolean;
     }>;
     getRuntimes: (signal?: AbortSignal) => Promise<{

package/dist/dataScience/index.js

@@ -1,6 +1,6 @@
-export { createDataScienceClient, parseLogLines } from '../chunk-4WX5W7YU.js';
+export { createDataScienceClient, parseLogLines } from '../chunk-F43HBNKD.js';
 import '../chunk-MSI6FVGG.js';
-import '../chunk-6JXSO3AR.js';
-import '../chunk-RK2VGHJE.js';
+import '../chunk-L4R66Q6S.js';
+import '../chunk-3B3GOGAL.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/dataScience/types.d.cts

@@ -1,2 +1,2 @@
-import '../types-jKnx7Tm_.cjs';
-export { C as CreateDataAppBody, l as DataApp, m as DataAppRun, D as DeleteDataAppPath, k as DeleteSandboxPath, f as GetAppsQuery, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, i as GetDataAppPasswordPath, g as GetDataAppPath, b as GetDataAppRunPath, G as GetDataAppRunsPath, a as GetDataAppRunsQuery, j as GetSandboxPath, L as LogEntry, h as PatchDataAppBody, P as PatchDataAppPath, n as RawAppRun, R as ResetDataAppPasswordPath, o as Runtime, q as RuntimeImageKey, S as Sandbox } from '../utils-DDERw8dM.cjs';
+import '../types-BbM5WDSR.cjs';
+export { C as CreateDataAppBody, l as DataApp, m as DataAppRun, D as DeleteDataAppPath, k as DeleteSandboxPath, f as GetAppsQuery, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, i as GetDataAppPasswordPath, g as GetDataAppPath, b as GetDataAppRunPath, G as GetDataAppRunsPath, a as GetDataAppRunsQuery, j as GetSandboxPath, L as LogEntry, h as PatchDataAppBody, P as PatchDataAppPath, n as RawAppRun, R as ResetDataAppPasswordPath, o as Runtime, q as RuntimeImageKey, S as Sandbox } from '../utils-CuiDsDxz.cjs';

package/dist/dataScience/types.d.ts

@@ -1,2 +1,2 @@
-import '../types-jKnx7Tm_.js';
-export { C as CreateDataAppBody, l as DataApp, m as DataAppRun, D as DeleteDataAppPath, k as DeleteSandboxPath, f as GetAppsQuery, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, i as GetDataAppPasswordPath, g as GetDataAppPath, b as GetDataAppRunPath, G as GetDataAppRunsPath, a as GetDataAppRunsQuery, j as GetSandboxPath, L as LogEntry, h as PatchDataAppBody, P as PatchDataAppPath, n as RawAppRun, R as ResetDataAppPasswordPath, o as Runtime, q as RuntimeImageKey, S as Sandbox } from '../utils-C7eSJKtG.js';
+import '../types-BbM5WDSR.js';
+export { C as CreateDataAppBody, l as DataApp, m as DataAppRun, D as DeleteDataAppPath, k as DeleteSandboxPath, f as GetAppsQuery, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, i as GetDataAppPasswordPath, g as GetDataAppPath, b as GetDataAppRunPath, G as GetDataAppRunsPath, a as GetDataAppRunsQuery, j as GetSandboxPath, L as LogEntry, h as PatchDataAppBody, P as PatchDataAppPath, n as RawAppRun, R as ResetDataAppPasswordPath, o as Runtime, q as RuntimeImageKey, S as Sandbox } from '../utils-zcz60drL.js';

package/dist/domain/permissions/index.cjs

@@ -24,6 +24,25 @@ var isAdminOrShare = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.Admi
 var isProductionManager = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.ProductionManager;
 var isDeveloperOrReviewer = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.Developer || role(token) === chunkYXGBD4WP_cjs.AdminRole.Reviewer;
 var isReadOnlyRole = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.ReadOnly;
+var isKnownAdminRole = (adminRole) => Object.values(chunkYXGBD4WP_cjs.AdminRole).includes(adminRole ?? "");
+var isKaiSettingsWriterRole = (adminRole) => {
+  switch (adminRole) {
+    case chunkYXGBD4WP_cjs.AdminRole.Admin:
+    case chunkYXGBD4WP_cjs.AdminRole.Share:
+      return true;
+    default:
+      return false;
+  }
+};
+var canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
+var assertCanWriteKaiSettings = (token) => {
+  if (!canWriteKaiSettings(token)) {
+    throw new PermissionDeniedError({
+      action: "write-kai-settings",
+      reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
+    });
+  }
+};
 var assertCanAdmin = (token) => {
   if (!isAdmin(token)) {
     throw new PermissionDeniedError({
@@ -124,14 +143,18 @@ exports.assertCanDevelopOrReview = assertCanDevelopOrReview;
 exports.assertCanMigrateFromTemplate = assertCanMigrateFromTemplate;
 exports.assertCanProductionManage = assertCanProductionManage;
 exports.assertCanPurgeConfiguration = assertCanPurgeConfiguration;
+exports.assertCanWriteKaiSettings = assertCanWriteKaiSettings;
 exports.canAssignFolder = canAssignFolder;
 exports.canCopyConfiguration = canCopyConfiguration;
 exports.canCreateConfiguration = canCreateConfiguration;
 exports.canMigrateFromTemplate = canMigrateFromTemplate;
 exports.canPurgeConfiguration = canPurgeConfiguration;
+exports.canWriteKaiSettings = canWriteKaiSettings;
 exports.isAdmin = isAdmin;
 exports.isAdminOrShare = isAdminOrShare;
 exports.isDeveloperOrReviewer = isDeveloperOrReviewer;
+exports.isKaiSettingsWriterRole = isKaiSettingsWriterRole;
+exports.isKnownAdminRole = isKnownAdminRole;
 exports.isProductionManager = isProductionManager;
 exports.isReadOnlyRole = isReadOnlyRole;
 //# sourceMappingURL=index.cjs.map

package/dist/domain/permissions/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRole"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAEnF,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACNA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRole"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAWnF,IAAM,gBAAA,GAAmB,CAAC,SAAA,KAC9B,MAAA,CAAO,OAAOA,2BAAS,CAAA,CAAe,QAAA,CAAS,SAAA,IAAa,EAAE;AAkB1D,IAAM,uBAAA,GAA0B,CAAC,SAAA,KAAkD;AACxF,EAAA,QAAQ,SAAA;AAAW,IACjB,KAAKA,2BAAA,CAAU,KAAA;AAAA,IACf,KAAKA,2BAAA,CAAU,KAAA;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACE,MAAA,OAAO,KAAA;AAAA;AAEb;AAQO,IAAM,mBAAA,GAAsB,CAAC,KAAA,KAClC,KAAA,CAAM,iBAAiB,uBAAA,CAAwB,KAAA,CAAM,OAAO,IAAI;AAE3D,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,MAAM,aAAA,GACV,CAAA,MAAA,EAAS,MAAM,KAAA,EAAO,IAAA,IAAQ,MAAM,CAAA,4BAAA,CAAA,GACpC;AAAA,KACL,CAAA;AAAA,EACH;AACF;AAEO,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;AChEA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/domain/permissions/index.d.cts

@@ -1,7 +1,7 @@
-import { S as StorageToken } from '../../types-B9SJ0cIc.cjs';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-DEFMKeAm.cjs';
+import { S as StorageToken } from '../../types-CfIKhNMg.cjs';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-CbJCjkdt.cjs';
 import '../../adminRoles-Cil1lavB.cjs';
-import '../../types-jKnx7Tm_.cjs';
+import '../../types-BbM5WDSR.cjs';
 
 /**
  * @module domain/permissions/errors
@@ -44,6 +44,41 @@ declare const isAdminOrShare: (token: StorageToken) => boolean;
 declare const isProductionManager: (token: StorageToken) => boolean;
 declare const isDeveloperOrReviewer: (token: StorageToken) => boolean;
 declare const isReadOnlyRole: (token: StorageToken) => boolean;
+/**
+ * Whether a role string is a member of `AdminRole` at all — distinct from
+ * whether it may do any particular thing. A role failing this check is not
+ * "denied", it's *unrecognized*: either Storage started returning a role this
+ * client has never heard of, or something upstream is sending garbage. Callers
+ * that deny-by-default on every predicate here (the common case) still want to
+ * know about this distinction, because it never shows up as a failed request —
+ * a caller should log it loudly rather than treat it as routine.
+ */
+declare const isKnownAdminRole: (adminRole: string | null | undefined) => boolean;
+/**
+ * Whether an admin role may write Kai's **project-wide** settings (custom
+ * instructions injected into every project member's system prompt).
+ *
+ * `admin` and `share` only. The value is a shared prompt-injection surface, so
+ * changing it counts as project administration rather than project work:
+ * `productionManager` and `guest` are read-only for project management in kbc-ui,
+ * and `developer`/`reviewer` are denied because `agent_settings` is keyed by
+ * `project_id` alone — editing it "inside a dev branch" writes production-visible
+ * global config.
+ *
+ * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist
+ * would admit each new one silently with no test failing. Takes the raw role
+ * string so a caller holding an unparsed `tokens.verify()` response can use it
+ * without fabricating a `StorageToken`. AI-3671.
+ */
+declare const isKaiSettingsWriterRole: (adminRole: string | null | undefined) => boolean;
+/**
+ * Whether this token may write Kai's project-wide settings. A limited
+ * (non-master) token never may: it carries no project role at all, and its
+ * `admin` block is absent despite the hand-authored type declaring it required
+ * (AI-3593) — hence the optional chain.
+ */
+declare const canWriteKaiSettings: (token: StorageToken) => boolean;
+declare const assertCanWriteKaiSettings: (token: StorageToken) => void;
 declare const assertCanAdmin: (token: StorageToken) => void;
 declare const assertCanAdminOrShare: (token: StorageToken) => void;
 declare const assertCanProductionManage: (token: StorageToken) => void;
@@ -111,4 +146,4 @@ declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: Configura
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
 
-export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager, isReadOnlyRole };
+export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };

package/dist/domain/permissions/index.d.ts

@@ -1,7 +1,7 @@
-import { S as StorageToken } from '../../types-BogOtZre.js';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-BpTHlKfO.js';
+import { S as StorageToken } from '../../types-CJ0RgA57.js';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-BV-vseKc.js';
 import '../../adminRoles-Cil1lavB.js';
-import '../../types-jKnx7Tm_.js';
+import '../../types-BbM5WDSR.js';
 
 /**
  * @module domain/permissions/errors
@@ -44,6 +44,41 @@ declare const isAdminOrShare: (token: StorageToken) => boolean;
 declare const isProductionManager: (token: StorageToken) => boolean;
 declare const isDeveloperOrReviewer: (token: StorageToken) => boolean;
 declare const isReadOnlyRole: (token: StorageToken) => boolean;
+/**
+ * Whether a role string is a member of `AdminRole` at all — distinct from
+ * whether it may do any particular thing. A role failing this check is not
+ * "denied", it's *unrecognized*: either Storage started returning a role this
+ * client has never heard of, or something upstream is sending garbage. Callers
+ * that deny-by-default on every predicate here (the common case) still want to
+ * know about this distinction, because it never shows up as a failed request —
+ * a caller should log it loudly rather than treat it as routine.
+ */
+declare const isKnownAdminRole: (adminRole: string | null | undefined) => boolean;
+/**
+ * Whether an admin role may write Kai's **project-wide** settings (custom
+ * instructions injected into every project member's system prompt).
+ *
+ * `admin` and `share` only. The value is a shared prompt-injection surface, so
+ * changing it counts as project administration rather than project work:
+ * `productionManager` and `guest` are read-only for project management in kbc-ui,
+ * and `developer`/`reviewer` are denied because `agent_settings` is keyed by
+ * `project_id` alone — editing it "inside a dev branch" writes production-visible
+ * global config.
+ *
+ * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist
+ * would admit each new one silently with no test failing. Takes the raw role
+ * string so a caller holding an unparsed `tokens.verify()` response can use it
+ * without fabricating a `StorageToken`. AI-3671.
+ */
+declare const isKaiSettingsWriterRole: (adminRole: string | null | undefined) => boolean;
+/**
+ * Whether this token may write Kai's project-wide settings. A limited
+ * (non-master) token never may: it carries no project role at all, and its
+ * `admin` block is absent despite the hand-authored type declaring it required
+ * (AI-3593) — hence the optional chain.
+ */
+declare const canWriteKaiSettings: (token: StorageToken) => boolean;
+declare const assertCanWriteKaiSettings: (token: StorageToken) => void;
 declare const assertCanAdmin: (token: StorageToken) => void;
 declare const assertCanAdminOrShare: (token: StorageToken) => void;
 declare const assertCanProductionManage: (token: StorageToken) => void;
@@ -111,4 +146,4 @@ declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: Configura
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
 
-export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager, isReadOnlyRole };
+export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };

package/dist/domain/permissions/index.js

@@ -22,6 +22,25 @@ var isAdminOrShare = (token) => role(token) === AdminRole.Admin || role(token) =
 var isProductionManager = (token) => role(token) === AdminRole.ProductionManager;
 var isDeveloperOrReviewer = (token) => role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;
 var isReadOnlyRole = (token) => role(token) === AdminRole.ReadOnly;
+var isKnownAdminRole = (adminRole) => Object.values(AdminRole).includes(adminRole ?? "");
+var isKaiSettingsWriterRole = (adminRole) => {
+  switch (adminRole) {
+    case AdminRole.Admin:
+    case AdminRole.Share:
+      return true;
+    default:
+      return false;
+  }
+};
+var canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
+var assertCanWriteKaiSettings = (token) => {
+  if (!canWriteKaiSettings(token)) {
+    throw new PermissionDeniedError({
+      action: "write-kai-settings",
+      reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
+    });
+  }
+};
 var assertCanAdmin = (token) => {
   if (!isAdmin(token)) {
     throw new PermissionDeniedError({
@@ -104,6 +123,6 @@ var assertCanAssignFolder = (token, ctx) => {
   }
 };
 
-export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isProductionManager, isReadOnlyRole };
+export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/domain/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAEnF,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACNA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAWnF,IAAM,gBAAA,GAAmB,CAAC,SAAA,KAC9B,MAAA,CAAO,OAAO,SAAS,CAAA,CAAe,QAAA,CAAS,SAAA,IAAa,EAAE;AAkB1D,IAAM,uBAAA,GAA0B,CAAC,SAAA,KAAkD;AACxF,EAAA,QAAQ,SAAA;AAAW,IACjB,KAAK,SAAA,CAAU,KAAA;AAAA,IACf,KAAK,SAAA,CAAU,KAAA;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACE,MAAA,OAAO,KAAA;AAAA;AAEb;AAQO,IAAM,mBAAA,GAAsB,CAAC,KAAA,KAClC,KAAA,CAAM,iBAAiB,uBAAA,CAAwB,KAAA,CAAM,OAAO,IAAI;AAE3D,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,MAAM,aAAA,GACV,CAAA,MAAA,EAAS,MAAM,KAAA,EAAO,IAAA,IAAQ,MAAM,CAAA,4BAAA,CAAA,GACpC;AAAA,KACL,CAAA;AAAA,EACH;AACF;AAEO,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;AChEA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/editor/index.cjs

@@ -1,14 +1,14 @@
 'use strict';
 
-var chunkRTQEMQIC_cjs = require('../chunk-RTQEMQIC.cjs');
-require('../chunk-UQWVZTEA.cjs');
-require('../chunk-IUN2ZSU3.cjs');
+var chunkYQEBJG5H_cjs = require('../chunk-YQEBJG5H.cjs');
+require('../chunk-43CGBOVT.cjs');
+require('../chunk-DMNWPVVT.cjs');
 
 
 
 Object.defineProperty(exports, "createEditorClient", {
   enumerable: true,
-  get: function () { return chunkRTQEMQIC_cjs.createEditorClient; }
+  get: function () { return chunkYQEBJG5H_cjs.createEditorClient; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/editor/index.d.cts

@@ -1,6 +1,6 @@
-import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-CWebeQXy.cjs';
+import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-CmdRXxqa.cjs';
 import { C as ClientInitOptions } from '../types-DqxZDbM1.cjs';
-import '../types-jKnx7Tm_.cjs';
+import '../types-BbM5WDSR.cjs';
 import 'qs';
 
 declare const createEditorClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {

package/dist/editor/index.d.ts

@@ -1,6 +1,6 @@
-import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-CFd7q2ed.js';
+import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-PG_v0QyH.js';
 import { C as ClientInitOptions } from '../types-DqxZDbM1.js';
-import '../types-jKnx7Tm_.js';
+import '../types-BbM5WDSR.js';
 import 'qs';
 
 declare const createEditorClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {

package/dist/editor/index.js

@@ -1,5 +1,5 @@
-export { createEditorClient } from '../chunk-P6OWDUN7.js';
-import '../chunk-6JXSO3AR.js';
-import '../chunk-RK2VGHJE.js';
+export { createEditorClient } from '../chunk-L63UYWJG.js';
+import '../chunk-L4R66Q6S.js';
+import '../chunk-3B3GOGAL.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/editor/types.d.cts

@@ -1,2 +1,2 @@
-import '../types-jKnx7Tm_.cjs';
-export { C as CreateSqlSessionBody, G as GetSqlSessionPath, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, a as GetSqlSessionsQuery, e as PostSqlRunQueryBody, P as PostSqlRunQueryPath, k as PostSqlSessionLoadBody, j as PostSqlSessionLoadPath, m as PostSqlSessionUnloadBody, l as PostSqlSessionUnloadPath, g as PostSqlTablePreviewBody, f as PostSqlTablePreviewPath, S as Session, n as SessionSchema, o as SessionSchemaBucket, p as SessionSchemaColumn, q as SessionSchemaDatabase, r as SessionSchemaTable, s as SqlSession } from '../types-CWebeQXy.cjs';
+import '../types-BbM5WDSR.cjs';
+export { C as CreateSqlSessionBody, G as GetSqlSessionPath, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, a as GetSqlSessionsQuery, e as PostSqlRunQueryBody, P as PostSqlRunQueryPath, k as PostSqlSessionLoadBody, j as PostSqlSessionLoadPath, m as PostSqlSessionUnloadBody, l as PostSqlSessionUnloadPath, g as PostSqlTablePreviewBody, f as PostSqlTablePreviewPath, S as Session, n as SessionSchema, o as SessionSchemaBucket, p as SessionSchemaColumn, q as SessionSchemaDatabase, r as SessionSchemaTable, s as SqlSession } from '../types-CmdRXxqa.cjs';

package/dist/editor/types.d.ts

@@ -1,2 +1,2 @@
-import '../types-jKnx7Tm_.js';
-export { C as CreateSqlSessionBody, G as GetSqlSessionPath, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, a as GetSqlSessionsQuery, e as PostSqlRunQueryBody, P as PostSqlRunQueryPath, k as PostSqlSessionLoadBody, j as PostSqlSessionLoadPath, m as PostSqlSessionUnloadBody, l as PostSqlSessionUnloadPath, g as PostSqlTablePreviewBody, f as PostSqlTablePreviewPath, S as Session, n as SessionSchema, o as SessionSchemaBucket, p as SessionSchemaColumn, q as SessionSchemaDatabase, r as SessionSchemaTable, s as SqlSession } from '../types-CFd7q2ed.js';
+import '../types-BbM5WDSR.js';
+export { C as CreateSqlSessionBody, G as GetSqlSessionPath, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, a as GetSqlSessionsQuery, e as PostSqlRunQueryBody, P as PostSqlRunQueryPath, k as PostSqlSessionLoadBody, j as PostSqlSessionLoadPath, m as PostSqlSessionUnloadBody, l as PostSqlSessionUnloadPath, g as PostSqlTablePreviewBody, f as PostSqlTablePreviewPath, S as Session, n as SessionSchema, o as SessionSchemaBucket, p as SessionSchemaColumn, q as SessionSchemaDatabase, r as SessionSchemaTable, s as SqlSession } from '../types-PG_v0QyH.js';

package/dist/encryption/index.cjs

@@ -1,13 +1,13 @@
 'use strict';
 
-var chunkNRJTA5P3_cjs = require('../chunk-NRJTA5P3.cjs');
-require('../chunk-IUN2ZSU3.cjs');
+var chunkCCC6I32C_cjs = require('../chunk-CCC6I32C.cjs');
+require('../chunk-DMNWPVVT.cjs');
 
 
 
 Object.defineProperty(exports, "createEncryptionClient", {
   enumerable: true,
-  get: function () { return chunkNRJTA5P3_cjs.createEncryptionClient; }
+  get: function () { return chunkCCC6I32C_cjs.createEncryptionClient; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/encryption/index.d.cts

@@ -1,9 +1,9 @@
 import { C as ClientInitOptions } from '../types-DqxZDbM1.cjs';
 import { EncryptQuery, ScopedSecrets } from './types.cjs';
 import 'qs';
-import '../types-B9SJ0cIc.cjs';
+import '../types-CfIKhNMg.cjs';
 import '../adminRoles-Cil1lavB.cjs';
-import '../types-jKnx7Tm_.cjs';
+import '../types-BbM5WDSR.cjs';
 
 declare const createEncryptionClient: ({ baseUrl, middlewares, }: Omit<ClientInitOptions, "auth">) => {
     encryptSecrets: <T extends Record<string, unknown>>(data: EncryptQuery & {

package/dist/encryption/index.d.ts

@@ -1,9 +1,9 @@
 import { C as ClientInitOptions } from '../types-DqxZDbM1.js';
 import { EncryptQuery, ScopedSecrets } from './types.js';
 import 'qs';
-import '../types-BogOtZre.js';
+import '../types-CJ0RgA57.js';
 import '../adminRoles-Cil1lavB.js';
-import '../types-jKnx7Tm_.js';
+import '../types-BbM5WDSR.js';
 
 declare const createEncryptionClient: ({ baseUrl, middlewares, }: Omit<ClientInitOptions, "auth">) => {
     encryptSecrets: <T extends Record<string, unknown>>(data: EncryptQuery & {

package/dist/encryption/index.js

@@ -1,4 +1,4 @@
-export { createEncryptionClient } from '../chunk-EXNR4FGV.js';
-import '../chunk-RK2VGHJE.js';
+export { createEncryptionClient } from '../chunk-MIUULCML.js';
+import '../chunk-3B3GOGAL.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/encryption/types.d.cts

@@ -1,6 +1,6 @@
-import { P as ProjectId } from '../types-B9SJ0cIc.cjs';
+import { P as ProjectId } from '../types-CfIKhNMg.cjs';
 import '../adminRoles-Cil1lavB.cjs';
-import '../types-jKnx7Tm_.cjs';
+import '../types-BbM5WDSR.cjs';
 
 type BranchType = 'default' | 'dev';
 type EncryptParamsByScope = {

package/dist/encryption/types.d.ts

@@ -1,6 +1,6 @@
-import { P as ProjectId } from '../types-BogOtZre.js';
+import { P as ProjectId } from '../types-CJ0RgA57.js';
 import '../adminRoles-Cil1lavB.js';
-import '../types-jKnx7Tm_.js';
+import '../types-BbM5WDSR.js';
 
 type BranchType = 'default' | 'dev';
 type EncryptParamsByScope = {