@keboola/api-client 23.0.0 → 24.0.0

package/dist/chunk-PSR3N4NC.js

@@ -0,0 +1,136 @@
+import { AdminRole } from './chunk-552FC4ZV.js';
+
+// src/domain/permissions/errors.ts
+var PermissionDeniedError = class extends Error {
+  action;
+  reason;
+  subject;
+  constructor({ action, reason, subject }) {
+    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);
+    this.name = "PermissionDeniedError";
+    this.action = action;
+    this.reason = reason;
+    this.subject = subject;
+  }
+};
+
+// src/domain/permissions/admin.ts
+var role = (token) => token.admin.role;
+var isAdmin = (token) => role(token) === AdminRole.Admin;
+var isAdminOrShare = (token) => role(token) === AdminRole.Admin || role(token) === AdminRole.Share;
+var isProductionManager = (token) => role(token) === AdminRole.ProductionManager;
+var isDeveloperOrReviewer = (token) => role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;
+var isReadOnlyRole = (token) => role(token) === AdminRole.ReadOnly;
+var isKnownAdminRole = (adminRole) => Object.values(AdminRole).includes(adminRole ?? "");
+var isKaiSettingsWriterRole = (adminRole) => {
+  switch (adminRole) {
+    case AdminRole.Admin:
+    case AdminRole.Share:
+      return true;
+    default:
+      return false;
+  }
+};
+var canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
+var assertCanWriteKaiSettings = (token) => {
+  if (!canWriteKaiSettings(token)) {
+    throw new PermissionDeniedError({
+      action: "write-kai-settings",
+      reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
+    });
+  }
+};
+var assertCanAdmin = (token) => {
+  if (!isAdmin(token)) {
+    throw new PermissionDeniedError({
+      action: "admin",
+      reason: `role '${role(token)}' is not admin`
+    });
+  }
+};
+var assertCanAdminOrShare = (token) => {
+  if (!isAdminOrShare(token)) {
+    throw new PermissionDeniedError({
+      action: "admin-or-share",
+      reason: `role '${role(token)}' is not admin or share`
+    });
+  }
+};
+var assertCanProductionManage = (token) => {
+  if (!isProductionManager(token)) {
+    throw new PermissionDeniedError({
+      action: "production-manage",
+      reason: `role '${role(token)}' is not productionManager`
+    });
+  }
+};
+var assertCanDevelopOrReview = (token) => {
+  if (!isDeveloperOrReviewer(token)) {
+    throw new PermissionDeniedError({
+      action: "develop-or-review",
+      reason: `role '${role(token)}' is not developer or reviewer`
+    });
+  }
+};
+
+// src/domain/permissions/configurations.ts
+var meetsBaseRule = (token, ctx) => ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);
+var baseDenialReason = (ctx) => ctx.isDevModeActive ? "dev branch requires developer or reviewer role" : "production requires productionManager role";
+var canCreateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+var canUpdateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+var canCopyConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+var canMigrateFromTemplate = (token, ctx) => meetsBaseRule(token, ctx);
+var canPurgeConfiguration = (token) => isAdmin(token);
+var canAssignFolder = (token, ctx) => meetsBaseRule(token, ctx);
+var assertCanCreateConfiguration = (token, ctx) => {
+  if (!canCreateConfiguration(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "create-configuration",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanUpdateConfiguration = (token, ctx) => {
+  if (!canUpdateConfiguration(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "update-configuration",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanCopyConfiguration = (token, ctx) => {
+  if (!canCopyConfiguration(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "copy-configuration",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanMigrateFromTemplate = (token, ctx) => {
+  if (!canMigrateFromTemplate(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "migrate-from-template",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanPurgeConfiguration = (token, ctx) => {
+  if (!canPurgeConfiguration(token)) {
+    throw new PermissionDeniedError({
+      action: "purge-configuration",
+      reason: "purge requires admin role"
+    });
+  }
+};
+var assertCanAssignFolder = (token, ctx) => {
+  if (!canAssignFolder(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "assign-folder",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+
+export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };
+//# sourceMappingURL=chunk-PSR3N4NC.js.map
+//# sourceMappingURL=chunk-PSR3N4NC.js.map

package/dist/chunk-PSR3N4NC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAWnF,IAAM,gBAAA,GAAmB,CAAC,SAAA,KAC9B,MAAA,CAAO,OAAO,SAAS,CAAA,CAAe,QAAA,CAAS,SAAA,IAAa,EAAE;AAkB1D,IAAM,uBAAA,GAA0B,CAAC,SAAA,KAAkD;AACxF,EAAA,QAAQ,SAAA;AAAW,IACjB,KAAK,SAAA,CAAU,KAAA;AAAA,IACf,KAAK,SAAA,CAAU,KAAA;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACE,MAAA,OAAO,KAAA;AAAA;AAEb;AAQO,IAAM,mBAAA,GAAsB,CAAC,KAAA,KAClC,KAAA,CAAM,iBAAiB,uBAAA,CAAwB,KAAA,CAAM,OAAO,IAAI;AAE3D,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,MAAM,aAAA,GACV,CAAA,MAAA,EAAS,MAAM,KAAA,EAAO,IAAA,IAAQ,MAAM,CAAA,4BAAA,CAAA,GACpC;AAAA,KACL,CAAA;AAAA,EACH;AACF;AAEO,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;AChEA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"chunk-PSR3N4NC.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/{chunk-HZSZQFEO.cjs → chunk-QZKDBVAU.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
 var chunkFMS5PNM2_cjs = require('./chunk-FMS5PNM2.cjs');
-var chunk43CGBOVT_cjs = require('./chunk-43CGBOVT.cjs');
-var chunkDMNWPVVT_cjs = require('./chunk-DMNWPVVT.cjs');
+var chunk7RO6PKZ4_cjs = require('./chunk-7RO6PKZ4.cjs');
+var chunkMMOAH3EH_cjs = require('./chunk-MMOAH3EH.cjs');
 
 // src/errors/ServiceUnavailableError.ts
 var ServiceUnavailableError = class _ServiceUnavailableError extends Error {
@@ -259,7 +259,7 @@ var createBuckets = (client) => {
       );
       return toBucketListing(data, bucketId);
     } catch (error) {
-      if (chunkDMNWPVVT_cjs.isApiError(error) && error.response.status === 404) return null;
+      if (chunkMMOAH3EH_cjs.isApiError(error) && error.response.status === 404) return null;
       throw error;
     }
   };
@@ -979,7 +979,7 @@ var tryParseNewToken = (data) => {
 var createRefreshTokenMiddlware = ({ accessToken, onRefresh }) => {
   let current = accessToken;
   return (next) => async (request) => {
-    request.request.headers.set(chunkDMNWPVVT_cjs.KeboolaHttpHeader.STORAGE_API_TOKEN, current);
+    request.request.headers.set(chunkMMOAH3EH_cjs.KeboolaHttpHeader.STORAGE_API_TOKEN, current);
     if (!isTokenRefreshEndpoint(request.request)) return next(request);
     const response = await next(request);
     const newToken = tryParseNewToken(response.data);
@@ -1431,17 +1431,17 @@ var createStorageClient = ({
   middlewares = [],
   onRefreshToken
 }) => {
-  const headers = chunk43CGBOVT_cjs.createAuthHeaders(auth);
+  const headers = chunk7RO6PKZ4_cjs.createAuthHeaders(auth);
   const allMiddlewares = onRefreshToken && auth.type === "sapi-token" ? [
     ...middlewares,
     createRefreshTokenMiddlware({ accessToken: auth.token, onRefresh: onRefreshToken })
   ] : middlewares;
-  const client = chunkDMNWPVVT_cjs.createGenericFetchClient({
+  const client = chunkMMOAH3EH_cjs.createGenericFetchClient({
     baseUrl,
     middlewares: allMiddlewares,
     headers
   });
-  const openApiClient = chunkDMNWPVVT_cjs.createOpenapiFetchClient({
+  const openApiClient = chunkMMOAH3EH_cjs.createOpenapiFetchClient({
     baseUrl,
     middlewares: allMiddlewares,
     headers
@@ -1478,5 +1478,5 @@ var createStorageClient = ({
 exports.ServiceUnavailableError = ServiceUnavailableError;
 exports.createStorageClient = createStorageClient;
 exports.series = series;
-//# sourceMappingURL=chunk-HZSZQFEO.cjs.map
-//# sourceMappingURL=chunk-HZSZQFEO.cjs.map
+//# sourceMappingURL=chunk-QZKDBVAU.cjs.map
+//# sourceMappingURL=chunk-QZKDBVAU.cjs.map