@keboola/api-client 23.0.0 → 25.0.0

package/dist/chunk-N4COL54U.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors/SyncActionError.ts"],"names":[],"mappings":";;;AAWO,IAAM,eAAA,GAAN,MAAM,gBAAA,SAAwB,KAAA,CAAM;AAAA,EACzC,WAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAEA,WAAA,CAAY,SAAiB,EAAE,WAAA,EAAa,MAAM,IAAA,EAAK,GAA4B,EAAC,EAAG;AACrF,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,gBAAA,CAAgB,SAAS,CAAA;AAAA,EACvD;AACF;AAEO,IAAM,iBAAA,GAAoB,CAAC,KAAA,KAChC,KAAA,YAAiB","file":"chunk-N4COL54U.cjs","sourcesContent":["type SyncActionErrorOptions = {\n  exceptionId?: string;\n  code?: number;\n  data?: unknown;\n};\n\n/**\n * A sync action reports failure two ways: a non-2xx response, and a 2xx response whose body carries\n * `status: 'error'` (the component ran, and said no). Both collapse into this class so consumers\n * branch on one thing.\n */\nexport class SyncActionError extends Error {\n  exceptionId?: string;\n  code?: number;\n  data?: unknown;\n\n  constructor(message: string, { exceptionId, code, data }: SyncActionErrorOptions = {}) {\n    super(message);\n    this.name = 'SyncActionError';\n    this.exceptionId = exceptionId;\n    this.code = code;\n    this.data = data;\n    Object.setPrototypeOf(this, SyncActionError.prototype);\n  }\n}\n\nexport const isSyncActionError = (error: unknown): error is SyncActionError =>\n  error instanceof SyncActionError;\n"]}

package/dist/{chunk-5ZOWA7DA.cjs → chunk-NVQ6LGDO.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunk43CGBOVT_cjs = require('./chunk-43CGBOVT.cjs');
-var chunkDMNWPVVT_cjs = require('./chunk-DMNWPVVT.cjs');
+var chunk7RO6PKZ4_cjs = require('./chunk-7RO6PKZ4.cjs');
+var chunkMMOAH3EH_cjs = require('./chunk-MMOAH3EH.cjs');
 
 // src/clients/telemetry/provisioning/provisioning.ts
 var createProvisioning = (client) => {
@@ -20,10 +20,10 @@ var createProvisioning = (client) => {
 
 // src/clients/telemetry/telemetryClient.ts
 var createTelemetryClient = ({ baseUrl, middlewares, auth }) => {
-  const client = chunkDMNWPVVT_cjs.createGenericFetchClient({
+  const client = chunkMMOAH3EH_cjs.createGenericFetchClient({
     baseUrl,
     middlewares,
-    headers: chunk43CGBOVT_cjs.createAuthHeaders(auth)
+    headers: chunk7RO6PKZ4_cjs.createAuthHeaders(auth)
   });
   return {
     provisioning: createProvisioning(client)
@@ -31,5 +31,5 @@ var createTelemetryClient = ({ baseUrl, middlewares, auth }) => {
 };
 
 exports.createTelemetryClient = createTelemetryClient;
-//# sourceMappingURL=chunk-5ZOWA7DA.cjs.map
-//# sourceMappingURL=chunk-5ZOWA7DA.cjs.map
+//# sourceMappingURL=chunk-NVQ6LGDO.cjs.map
+//# sourceMappingURL=chunk-NVQ6LGDO.cjs.map

package/dist/{chunk-5ZOWA7DA.cjs.map → chunk-NVQ6LGDO.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/clients/telemetry/provisioning/provisioning.ts","../src/clients/telemetry/telemetryClient.ts"],"names":["createGenericFetchClient","createAuthHeaders"],"mappings":";;;;;;AAIO,IAAM,kBAAA,GAAqB,CAAC,MAAA,KAA+B;AAChE,EAAA,MAAM,iBAAA,GAAoB,OAAO,IAAA,EAA6B,MAAA,KAAyB;AACrF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA;AAAA,MAC5B,yBAAA;AAAA,MACA,EAAE,IAAA,EAAK;AAAA,MACP,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF,CAAA;;;ACVO,IAAM,wBAAwB,CAAC,EAAE,OAAA,EAAS,WAAA,EAAa,MAAK,KAAyB;AAC1F,EAAA,MAAM,SAASA,0CAAA,CAAyB;AAAA,IACtC,OAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAASC,oCAAkB,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,mBAAmB,MAAM;AAAA,GACzC;AACF","file":"chunk-5ZOWA7DA.cjs","sourcesContent":["import type { GenericFetchClient } from '../telemetryClient';\n\nimport type { CreateCredentialsBody, WorkspaceData } from './types';\n\nexport const createProvisioning = (client: GenericFetchClient) => {\n  const createCredentials = async (body: CreateCredentialsBody, signal?: AbortSignal) => {\n    const { data } = await client.post<WorkspaceData, void, void, CreateCredentialsBody>(\n      '/provisioning/workspace',\n      { body },\n      { signal },\n    );\n\n    return data;\n  };\n\n  return {\n    createCredentials,\n  };\n};\n","import { createGenericFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport { createProvisioning } from './provisioning/provisioning';\n\nexport type GenericFetchClient = ReturnType<typeof createGenericFetchClient>;\n\nexport const createTelemetryClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  return {\n    provisioning: createProvisioning(client),\n  };\n};\n"]}
+{"version":3,"sources":["../src/clients/telemetry/provisioning/provisioning.ts","../src/clients/telemetry/telemetryClient.ts"],"names":["createGenericFetchClient","createAuthHeaders"],"mappings":";;;;;;AAIO,IAAM,kBAAA,GAAqB,CAAC,MAAA,KAA+B;AAChE,EAAA,MAAM,iBAAA,GAAoB,OAAO,IAAA,EAA6B,MAAA,KAAyB;AACrF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA;AAAA,MAC5B,yBAAA;AAAA,MACA,EAAE,IAAA,EAAK;AAAA,MACP,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO;AAAA,IACL;AAAA,GACF;AACF,CAAA;;;ACVO,IAAM,wBAAwB,CAAC,EAAE,OAAA,EAAS,WAAA,EAAa,MAAK,KAAyB;AAC1F,EAAA,MAAM,SAASA,0CAAA,CAAyB;AAAA,IACtC,OAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAASC,oCAAkB,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,YAAA,EAAc,mBAAmB,MAAM;AAAA,GACzC;AACF","file":"chunk-NVQ6LGDO.cjs","sourcesContent":["import type { GenericFetchClient } from '../telemetryClient';\n\nimport type { CreateCredentialsBody, WorkspaceData } from './types';\n\nexport const createProvisioning = (client: GenericFetchClient) => {\n  const createCredentials = async (body: CreateCredentialsBody, signal?: AbortSignal) => {\n    const { data } = await client.post<WorkspaceData, void, void, CreateCredentialsBody>(\n      '/provisioning/workspace',\n      { body },\n      { signal },\n    );\n\n    return data;\n  };\n\n  return {\n    createCredentials,\n  };\n};\n","import { createGenericFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport { createProvisioning } from './provisioning/provisioning';\n\nexport type GenericFetchClient = ReturnType<typeof createGenericFetchClient>;\n\nexport const createTelemetryClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  return {\n    provisioning: createProvisioning(client),\n  };\n};\n"]}

package/dist/{chunk-5Z6M32UE.js → chunk-NVRVPWNY.js}

@@ -1,6 +1,6 @@
 import { suggestionsApiResponseSchema } from './chunk-4RC5E3SL.js';
-import { createAuthHeaders } from './chunk-L4R66Q6S.js';
-import { createOpenapiFetchClient, KeboolaHttpHeader } from './chunk-3B3GOGAL.js';
+import { createAuthHeaders } from './chunk-EDX5D6UY.js';
+import { createOpenapiFetchClient, KeboolaHttpHeader } from './chunk-XHDYLUM4.js';
 import { z } from 'zod';
 
 var agentSettingsSchema = z.object({
@@ -144,5 +144,5 @@ var createChatClient = ({
 };
 
 export { createChatClient };
-//# sourceMappingURL=chunk-5Z6M32UE.js.map
-//# sourceMappingURL=chunk-5Z6M32UE.js.map
+//# sourceMappingURL=chunk-NVRVPWNY.js.map
+//# sourceMappingURL=chunk-NVRVPWNY.js.map

package/dist/{chunk-5Z6M32UE.js.map → chunk-NVRVPWNY.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/clients/chat/chatClient.ts"],"names":[],"mappings":";;;;;AAyBA,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EACnC,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,kBAAA,EAAoB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACxC,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAW,EAAE,MAAA;AACf,CAAC,CAAA;AAED,IAAM,4BAA4B,CAAA,CAAE,IAAA,CAAK,CAAC,cAAA,EAAgB,YAAA,EAAc,SAAS,CAAC,CAAA;AAElF,IAAM,uBAAA,GAA0B,EAAE,MAAA,CAAO;AAAA,EACvC,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,kBAAA,EAAoB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACxC,eAAA,EAAiB,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,yBAAyB,EAAE,QAAA,EAAS;AAAA,EAC1E,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAW,EAAE,MAAA;AACf,CAAC,CAAA;AAED,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EAC9B,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,EAAE,MAAA,EAAO;AAAA,EACtB,QAAA,EAAU,EAAE,OAAA;AACd,CAAC,CAAA;AAED,IAAM,uBAAA,GAA0B,EAAE,MAAA,CAAO;AAAA,EACvC,KAAA,EAAO,CAAA,CAAE,KAAA,CAAM,cAAc;AAC/B,CAAC,CAAA;AAED,IAAM,sBAAsB,CAAA,CAAE,KAAA;AAAA,EAC5B,EAAE,MAAA,CAAO;AAAA,IACP,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,IACjB,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,IACpB,SAAA,EAAW,EAAE,OAAA;AAAQ,GACtB;AACH,CAAA;AAMO,IAAM,mBAAmB,CAAC;AAAA,EAC/B,OAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,KAAyB;AACvB,EAAA,MAAM,SAAS,wBAAA,CAAgC;AAAA,IAC7C,OAAA;AAAA,IACA,OAAA,EAAS,IAAI,OAAA,CAAQ;AAAA,MACnB,CAAC,iBAAA,CAAkB,eAAe,GAAG,aAAA;AAAA,MACrC,GAAG,kBAAkB,IAAI;AAAA,KAC1B,CAAA;AAAA,IACD;AAAA,GACD,CAAA;AAED,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,KAA6B;AACrD,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAI,UAAA,EAAY,EAAE,KAAA,EAAO,MAAA,EAAQ,CAAA;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,EAA2B,MAAA,KAAyB;AACzE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAI,YAAA,EAAc,EAAE,IAAA,EAAM,EAAE,IAAI,MAAA,EAAO,EAAE,EAAG,EAAE,QAAQ,CAAA;AACpF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,KAAmB;AAC3C,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,EAAE,KAAA,EAAO,EAAE,EAAA,EAAI,MAAA,IAAU,CAAA;AACvE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAqD;AAC3E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,EAAE,KAAA,EAAO,EAAE,MAAA,EAAO,EAAG,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,IAAI,CAAA;AACjD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,KAAwB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC9C,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OAAO,OAAA,KAAyB;AACjD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,MAAA,CAAO,KAAK,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AACjE,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAiD;AACvE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC1D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,cAAA,GAAiB,OACrB,OAAA,EACA,MAAA,KACoC;AACpC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,EAAE,QAAQ,CAAA;AAEhF,IAAA,MAAM,MAAA,GAAS,4BAAA,CAA6B,SAAA,CAAU,IAAI,CAAA;AAC1D,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmB,OAAO,MAAA,KAAiD;AAC/E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC7D,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,IAAI,CAAA;AACjD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,mBAAA,GAAsB,OAC1B,OAAA,EACA,MAAA,KAC2B;AAC3B,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,KAAA,CAAM,WAAA,EAAa,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,EAAE,QAAQ,CAAA;AAC9E,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,IAAI,CAAA;AACjD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,oBAAA,GAAuB,OAAO,MAAA,KAAqD;AACvF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,gBAAA,EAAkB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAClE,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC/D;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,uBAAA,GAA0B,OAC9B,OAAA,EACA,MAAA,KAC+B;AAC/B,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,KAAA,CAAM,gBAAA,EAAkB,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,EAAE,QAAQ,CAAA;AACnF,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC/D;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,YAAA,GAAe,OAAO,MAAA,KAAqD;AAC/E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,iBAAA,EAAmB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,IACtD;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA;AAAA,IACA,QAAA;AAAA,IACA,cAAA;AAAA,IACA,gBAAA;AAAA,IACA,mBAAA;AAAA,IACA,oBAAA;AAAA,IACA,uBAAA;AAAA,IACA;AAAA,GACF;AACF","file":"chunk-5Z6M32UE.js","sourcesContent":["import { z } from 'zod';\n\nimport { createOpenapiFetchClient } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { SuggestionsApiResponse, SuggestionsRequestBody } from './suggestions';\nimport { suggestionsApiResponseSchema } from './suggestions';\nimport type {\n  AgentSettings,\n  ChatRequest,\n  GetChatPath,\n  GetHistoryQuery,\n  GetVotesQuery,\n  ToolsListResponse,\n  UpdateAgentSettingsRequest,\n  UpdateUserAgentSettingsRequest,\n  UsageResponse,\n  UserAgentSettings,\n  Vote,\n  VoteRequest,\n} from './types';\n\nconst agentSettingsSchema = z.object({\n  projectId: z.string(),\n  customInstructions: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\n\nconst toolPermissionValueSchema = z.enum(['always_allow', 'always_ask', 'blocked']);\n\nconst userAgentSettingsSchema = z.object({\n  projectId: z.string(),\n  userId: z.string(),\n  customInstructions: z.string().nullable(),\n  toolPermissions: z.record(z.string(), toolPermissionValueSchema).nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\n\nconst toolInfoSchema = z.object({\n  name: z.string(),\n  description: z.string(),\n  readOnly: z.boolean(),\n});\n\nconst toolsListResponseSchema = z.object({\n  tools: z.array(toolInfoSchema),\n});\n\nconst votesResponseSchema = z.array(\n  z.object({\n    chatId: z.string(),\n    messageId: z.string(),\n    isUpvoted: z.boolean(),\n  }),\n);\n\ntype ChatClientOptions = ClientInitOptions & {\n  storageApiUrl: string;\n};\n\nexport const createChatClient = ({\n  baseUrl,\n  middlewares,\n  storageApiUrl,\n  auth,\n}: ChatClientOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    headers: new Headers({\n      [KeboolaHttpHeader.STORAGE_API_URL]: storageApiUrl,\n      ...createAuthHeaders(auth),\n    }),\n    middlewares,\n  });\n\n  const getHistory = async (params?: GetHistoryQuery) => {\n    const { data } = await client.get('/history', { query: params });\n    return data;\n  };\n\n  const getChat = async (chatId: GetChatPath['id'], signal?: AbortSignal) => {\n    const { data } = await client.get('/chat/{id}', { path: { id: chatId } }, { signal });\n    return data;\n  };\n\n  const deleteChat = async (chatId: string) => {\n    const { data } = await client.delete('/chat', { query: { id: chatId } });\n    return data;\n  };\n\n  const getVotes = async (chatId: GetVotesQuery['chatId']): Promise<Vote[]> => {\n    const { data } = await client.get('/vote', { query: { chatId } });\n\n    const result = votesResponseSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid votes response format');\n    }\n\n    return result.data;\n  };\n\n  const submitVote = async (params: VoteRequest) => {\n    await client.patch('/vote', { body: params });\n  };\n\n  const createChat = async (request: ChatRequest) => {\n    const { response } = await client.post('/chat', { body: request });\n    return response;\n  };\n\n  const getUsage = async (signal?: AbortSignal): Promise<UsageResponse> => {\n    const { data } = await client.get('/usage', {}, { signal });\n    return data;\n  };\n\n  const getSuggestions = async (\n    request: SuggestionsRequestBody,\n    signal?: AbortSignal,\n  ): Promise<SuggestionsApiResponse> => {\n    const { data } = await client.post('/suggestions', { body: request }, { signal });\n\n    const result = suggestionsApiResponseSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid suggestions response format');\n    }\n\n    return result.data;\n  };\n\n  const getAgentSettings = async (signal?: AbortSignal): Promise<AgentSettings> => {\n    const { data } = await client.get('/settings', {}, { signal });\n    const result = agentSettingsSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid agent settings response format');\n    }\n    return result.data;\n  };\n\n  const updateAgentSettings = async (\n    request: UpdateAgentSettingsRequest,\n    signal?: AbortSignal,\n  ): Promise<AgentSettings> => {\n    const { data } = await client.patch('/settings', { body: request }, { signal });\n    const result = agentSettingsSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid agent settings response format');\n    }\n    return result.data;\n  };\n\n  const getUserAgentSettings = async (signal?: AbortSignal): Promise<UserAgentSettings> => {\n    const { data } = await client.get('/settings/user', {}, { signal });\n    const result = userAgentSettingsSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid user agent settings response format');\n    }\n    return result.data;\n  };\n\n  const updateUserAgentSettings = async (\n    request: UpdateUserAgentSettingsRequest,\n    signal?: AbortSignal,\n  ): Promise<UserAgentSettings> => {\n    const { data } = await client.patch('/settings/user', { body: request }, { signal });\n    const result = userAgentSettingsSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid user agent settings response format');\n    }\n    return result.data;\n  };\n\n  const getToolsList = async (signal?: AbortSignal): Promise<ToolsListResponse> => {\n    const { data } = await client.get('/settings/tools', {}, { signal });\n    const result = toolsListResponseSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid tools list response format');\n    }\n    return result.data;\n  };\n\n  return {\n    getHistory,\n    getChat,\n    deleteChat,\n    createChat,\n    getVotes,\n    submitVote,\n    getUsage,\n    getSuggestions,\n    getAgentSettings,\n    updateAgentSettings,\n    getUserAgentSettings,\n    updateUserAgentSettings,\n    getToolsList,\n  };\n};\n"]}
+{"version":3,"sources":["../src/clients/chat/chatClient.ts"],"names":[],"mappings":";;;;;AAyBA,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EACnC,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,kBAAA,EAAoB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACxC,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAW,EAAE,MAAA;AACf,CAAC,CAAA;AAED,IAAM,4BAA4B,CAAA,CAAE,IAAA,CAAK,CAAC,cAAA,EAAgB,YAAA,EAAc,SAAS,CAAC,CAAA;AAElF,IAAM,uBAAA,GAA0B,EAAE,MAAA,CAAO;AAAA,EACvC,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,kBAAA,EAAoB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACxC,eAAA,EAAiB,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,yBAAyB,EAAE,QAAA,EAAS;AAAA,EAC1E,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAW,EAAE,MAAA;AACf,CAAC,CAAA;AAED,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EAC9B,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,EAAE,MAAA,EAAO;AAAA,EACtB,QAAA,EAAU,EAAE,OAAA;AACd,CAAC,CAAA;AAED,IAAM,uBAAA,GAA0B,EAAE,MAAA,CAAO;AAAA,EACvC,KAAA,EAAO,CAAA,CAAE,KAAA,CAAM,cAAc;AAC/B,CAAC,CAAA;AAED,IAAM,sBAAsB,CAAA,CAAE,KAAA;AAAA,EAC5B,EAAE,MAAA,CAAO;AAAA,IACP,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,IACjB,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,IACpB,SAAA,EAAW,EAAE,OAAA;AAAQ,GACtB;AACH,CAAA;AAMO,IAAM,mBAAmB,CAAC;AAAA,EAC/B,OAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA,KAAyB;AACvB,EAAA,MAAM,SAAS,wBAAA,CAAgC;AAAA,IAC7C,OAAA;AAAA,IACA,OAAA,EAAS,IAAI,OAAA,CAAQ;AAAA,MACnB,CAAC,iBAAA,CAAkB,eAAe,GAAG,aAAA;AAAA,MACrC,GAAG,kBAAkB,IAAI;AAAA,KAC1B,CAAA;AAAA,IACD;AAAA,GACD,CAAA;AAED,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,KAA6B;AACrD,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAI,UAAA,EAAY,EAAE,KAAA,EAAO,MAAA,EAAQ,CAAA;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,EAA2B,MAAA,KAAyB;AACzE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAI,YAAA,EAAc,EAAE,IAAA,EAAM,EAAE,IAAI,MAAA,EAAO,EAAE,EAAG,EAAE,QAAQ,CAAA;AACpF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,KAAmB;AAC3C,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,EAAE,KAAA,EAAO,EAAE,EAAA,EAAI,MAAA,IAAU,CAAA;AACvE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAqD;AAC3E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,EAAE,KAAA,EAAO,EAAE,MAAA,EAAO,EAAG,CAAA;AAEhE,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,IAAI,CAAA;AACjD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AAEA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,KAAwB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC9C,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OAAO,OAAA,KAAyB;AACjD,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,MAAA,CAAO,KAAK,OAAA,EAAS,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AACjE,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,MAAA,KAAiD;AACvE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC1D,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,cAAA,GAAiB,OACrB,OAAA,EACA,MAAA,KACoC;AACpC,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,EAAE,QAAQ,CAAA;AAEhF,IAAA,MAAM,MAAA,GAAS,4BAAA,CAA6B,SAAA,CAAU,IAAI,CAAA;AAC1D,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmB,OAAO,MAAA,KAAiD;AAC/E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC7D,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,IAAI,CAAA;AACjD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,mBAAA,GAAsB,OAC1B,OAAA,EACA,MAAA,KAC2B;AAC3B,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,KAAA,CAAM,WAAA,EAAa,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,EAAE,QAAQ,CAAA;AAC9E,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,IAAI,CAAA;AACjD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,oBAAA,GAAuB,OAAO,MAAA,KAAqD;AACvF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,gBAAA,EAAkB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAClE,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC/D;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,uBAAA,GAA0B,OAC9B,OAAA,EACA,MAAA,KAC+B;AAC/B,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,KAAA,CAAM,gBAAA,EAAkB,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,EAAE,QAAQ,CAAA;AACnF,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC/D;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,YAAA,GAAe,OAAO,MAAA,KAAqD;AAC/E,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,iBAAA,EAAmB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AACnE,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,SAAA,CAAU,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,IACtD;AACA,IAAA,OAAO,MAAA,CAAO,IAAA;AAAA,EAChB,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA;AAAA,IACA,QAAA;AAAA,IACA,cAAA;AAAA,IACA,gBAAA;AAAA,IACA,mBAAA;AAAA,IACA,oBAAA;AAAA,IACA,uBAAA;AAAA,IACA;AAAA,GACF;AACF","file":"chunk-NVRVPWNY.js","sourcesContent":["import { z } from 'zod';\n\nimport { createOpenapiFetchClient } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { SuggestionsApiResponse, SuggestionsRequestBody } from './suggestions';\nimport { suggestionsApiResponseSchema } from './suggestions';\nimport type {\n  AgentSettings,\n  ChatRequest,\n  GetChatPath,\n  GetHistoryQuery,\n  GetVotesQuery,\n  ToolsListResponse,\n  UpdateAgentSettingsRequest,\n  UpdateUserAgentSettingsRequest,\n  UsageResponse,\n  UserAgentSettings,\n  Vote,\n  VoteRequest,\n} from './types';\n\nconst agentSettingsSchema = z.object({\n  projectId: z.string(),\n  customInstructions: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\n\nconst toolPermissionValueSchema = z.enum(['always_allow', 'always_ask', 'blocked']);\n\nconst userAgentSettingsSchema = z.object({\n  projectId: z.string(),\n  userId: z.string(),\n  customInstructions: z.string().nullable(),\n  toolPermissions: z.record(z.string(), toolPermissionValueSchema).nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\n\nconst toolInfoSchema = z.object({\n  name: z.string(),\n  description: z.string(),\n  readOnly: z.boolean(),\n});\n\nconst toolsListResponseSchema = z.object({\n  tools: z.array(toolInfoSchema),\n});\n\nconst votesResponseSchema = z.array(\n  z.object({\n    chatId: z.string(),\n    messageId: z.string(),\n    isUpvoted: z.boolean(),\n  }),\n);\n\ntype ChatClientOptions = ClientInitOptions & {\n  storageApiUrl: string;\n};\n\nexport const createChatClient = ({\n  baseUrl,\n  middlewares,\n  storageApiUrl,\n  auth,\n}: ChatClientOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    headers: new Headers({\n      [KeboolaHttpHeader.STORAGE_API_URL]: storageApiUrl,\n      ...createAuthHeaders(auth),\n    }),\n    middlewares,\n  });\n\n  const getHistory = async (params?: GetHistoryQuery) => {\n    const { data } = await client.get('/history', { query: params });\n    return data;\n  };\n\n  const getChat = async (chatId: GetChatPath['id'], signal?: AbortSignal) => {\n    const { data } = await client.get('/chat/{id}', { path: { id: chatId } }, { signal });\n    return data;\n  };\n\n  const deleteChat = async (chatId: string) => {\n    const { data } = await client.delete('/chat', { query: { id: chatId } });\n    return data;\n  };\n\n  const getVotes = async (chatId: GetVotesQuery['chatId']): Promise<Vote[]> => {\n    const { data } = await client.get('/vote', { query: { chatId } });\n\n    const result = votesResponseSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid votes response format');\n    }\n\n    return result.data;\n  };\n\n  const submitVote = async (params: VoteRequest) => {\n    await client.patch('/vote', { body: params });\n  };\n\n  const createChat = async (request: ChatRequest) => {\n    const { response } = await client.post('/chat', { body: request });\n    return response;\n  };\n\n  const getUsage = async (signal?: AbortSignal): Promise<UsageResponse> => {\n    const { data } = await client.get('/usage', {}, { signal });\n    return data;\n  };\n\n  const getSuggestions = async (\n    request: SuggestionsRequestBody,\n    signal?: AbortSignal,\n  ): Promise<SuggestionsApiResponse> => {\n    const { data } = await client.post('/suggestions', { body: request }, { signal });\n\n    const result = suggestionsApiResponseSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid suggestions response format');\n    }\n\n    return result.data;\n  };\n\n  const getAgentSettings = async (signal?: AbortSignal): Promise<AgentSettings> => {\n    const { data } = await client.get('/settings', {}, { signal });\n    const result = agentSettingsSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid agent settings response format');\n    }\n    return result.data;\n  };\n\n  const updateAgentSettings = async (\n    request: UpdateAgentSettingsRequest,\n    signal?: AbortSignal,\n  ): Promise<AgentSettings> => {\n    const { data } = await client.patch('/settings', { body: request }, { signal });\n    const result = agentSettingsSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid agent settings response format');\n    }\n    return result.data;\n  };\n\n  const getUserAgentSettings = async (signal?: AbortSignal): Promise<UserAgentSettings> => {\n    const { data } = await client.get('/settings/user', {}, { signal });\n    const result = userAgentSettingsSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid user agent settings response format');\n    }\n    return result.data;\n  };\n\n  const updateUserAgentSettings = async (\n    request: UpdateUserAgentSettingsRequest,\n    signal?: AbortSignal,\n  ): Promise<UserAgentSettings> => {\n    const { data } = await client.patch('/settings/user', { body: request }, { signal });\n    const result = userAgentSettingsSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid user agent settings response format');\n    }\n    return result.data;\n  };\n\n  const getToolsList = async (signal?: AbortSignal): Promise<ToolsListResponse> => {\n    const { data } = await client.get('/settings/tools', {}, { signal });\n    const result = toolsListResponseSchema.safeParse(data);\n    if (!result.success) {\n      throw new Error('Invalid tools list response format');\n    }\n    return result.data;\n  };\n\n  return {\n    getHistory,\n    getChat,\n    deleteChat,\n    createChat,\n    getVotes,\n    submitVote,\n    getUsage,\n    getSuggestions,\n    getAgentSettings,\n    updateAgentSettings,\n    getUserAgentSettings,\n    updateUserAgentSettings,\n    getToolsList,\n  };\n};\n"]}

package/dist/{chunk-HFZCZ7PZ.js → chunk-OUSPQ55W.js}

@@ -1,4 +1,4 @@
-import { createOpenapiFetchClient, HttpHeader } from './chunk-3B3GOGAL.js';
+import { createOpenapiFetchClient, HttpHeader } from './chunk-XHDYLUM4.js';
 import * as z from 'zod';
 
 var loginInputSchema = z.object({
@@ -259,5 +259,5 @@ var createAuthClient = ({ baseUrl, middlewares }) => {
 };
 
 export { changeInputSchema, createAuthClient, loginInputSchema, loginResultSchema, loginSuccessSchema, mfaChallengeSchema, mfaCodeInputSchema, mfaWebauthnInputSchema, oidcInputSchema, resetInputSchema, resetRequestInputSchema };
-//# sourceMappingURL=chunk-HFZCZ7PZ.js.map
-//# sourceMappingURL=chunk-HFZCZ7PZ.js.map
+//# sourceMappingURL=chunk-OUSPQ55W.js.map
+//# sourceMappingURL=chunk-OUSPQ55W.js.map

package/dist/{chunk-HFZCZ7PZ.js.map → chunk-OUSPQ55W.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/clients/auth/login/schemas.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/device/device.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/authClient.ts"],"names":["z2","z3","email"],"mappings":";;;AAEO,IAAM,mBAAqB,CAAA,CAAA,MAAA,CAAO;AAAA,EACvC,OAAS,CAAA,CAAA,KAAA,EAAM;AAAA,EACf,QAAA,EAAY,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU;AACxC,CAAC;AAEM,IAAM,kBAAoB,CAAA,CAAA,MAAA,CAAO;AAAA,EACtC,SAAA,EAAa,CAAA,CAAA,IAAA,CAAK,CAAC,QAAA,EAAU,WAAW,CAAC,CAAA;AAAA,EACzC,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU;AACvC,CAAC;AAKD,IAAM,aAAe,CAAA,CAAA,MAAA,CAAO;AAAA,EAC1B,IAAM,CAAA,CAAA,MAAA,EAAO;AAAA,EACb,OAAS,CAAA,CAAA,MAAA,EAAO;AAAA,EAChB,MAAQ,CAAA,CAAA,MAAA;AACV,CAAC,CAAA;AAIM,IAAM,qBAAuB,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,WAAA,EAAe,CAAA,CAAA,OAAA,CAAQ,KAAK,CAAA,CAAE,QAAQ,KAAK,CAAA;AAAA,EAC3C,aAAe,CAAA,CAAA,MAAA,EAAO;AAAA,EACtB,cAAgB,CAAA,CAAA,MAAA,EAAO;AAAA,EACvB,WAAa,CAAA,CAAA,MAAA,EAAO;AAAA,EACpB,WAAa,CAAA,CAAA,MAAA,EAAO;AAAA,EACpB,WAAa,CAAA,CAAA,MAAA,EAAO;AAAA,EACpB,IAAA,EAAM;AACR,CAAC;AAGM,IAAM,qBAAuB,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,WAAA,EAAe,UAAQ,IAAI,CAAA;AAAA,EAC3B,SAAW,CAAA,CAAA,MAAA,EAAO;AAAA,EAClB,UAAY,CAAA,CAAA,MAAA,EAAO;AAAA,EACnB,WAAa,CAAA,CAAA,MAAA,EAAO;AAAA,EACpB,cAAA,EAAkB,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ;AACpC,CAAC;AAEM,IAAM,iBAAA,GAAsB,CAAA,CAAA,KAAA,CAAM,CAAC,kBAAA,EAAoB,kBAAkB,CAAC;ACxC1E,IAAM,qBAAuBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,UAAYA,CAAA,CAAA,MAAA,EAAO;AAAA,EACnB,IAAA,EAAQA,CAAA,CAAA,IAAA,CAAK,CAAC,MAAA,EAAQ,eAAe,CAAC,CAAA;AAAA,EACtC,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU;AACpC,CAAC;AAEM,IAAM,yBAA2BA,CAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,UAAYA,CAAA,CAAA,MAAA,EAAO;AAAA,EACnB,WAAaA,CAAA,CAAA,MAAA;AACf,CAAC;ACTM,IAAM,0BAA4BC,CAAA,CAAA,MAAA,CAAO;AAAA,EAC9C,OAASA,CAAA,CAAA,KAAA;AACX,CAAC;AAEM,IAAM,mBAAqBA,CAAA,CAAA,MAAA,CAAO;AAAA;AAAA,EAEvC,KAAA,EAASA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU,CAAA;AAAA,EACnC,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU,CAAA;AAAA;AAAA;AAAA,EAGzC,cAAA,EAAkBA,CAAA,CAAA,OAAA,EAAQ,CAAE,OAAA,CAAQ,IAAI;AAC1C,CAAC;AAEM,IAAM,oBAAsBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACxC,eAAA,EAAmBA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU,CAAA;AAAA,EAC7C,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU,CAAA;AAAA;AAAA;AAAA;AAAA,EAIzC,mBAAA,EAAuBA,CAAA,CAAA,OAAA,EAAQ,CAAE,OAAA,CAAQ,IAAI;AAC/C,CAAC;;;ACdM,IAAM,YAAA,GAAe,CAAC,MAAA,KAAmC;AAC9D,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAqC,MAAA,KAAyB;AAClF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,iBAAA,EAAmB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC1E,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAsC,MAAA,KAAyB;AACpF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,yBAAA,EAA2B,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAClF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,EAAuC,MAAA,KAAyB;AACtF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,uBAAA,EAAyB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAChF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAS;AACrC,CAAA;;;ACnBO,IAAM,WAAA,GAAc,CAAC,MAAA,KAAmC;AAC7D,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAiB,MAAA,KAAyB;AAC9D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,gBAAA,EAAkB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACzE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,YAAA,GAAe,OAAO,KAAA,EAAmB,MAAA,KAAyB;AACtE,IAAA,MAAM,EAAE,KAAA,EAAAC,MAAAA,EAAO,UAAS,GAAI,gBAAA,CAAiB,MAAM,KAAK,CAAA;AAExD,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,EAAE,SAAA,EAAW,YAAY,KAAA,EAAAA,MAAAA,EAAO,QAAA,EAAS,EAAgB,MAAM,CAAA;AAGzF,IAAA,OAAO,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAAA,EACrC,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,KAAA,EAAkB,MAAA,KAAyB;AACjE,IAAA,MAAM,EAAE,SAAA,EAAW,OAAA,EAAQ,GAAI,eAAA,CAAgB,MAAM,KAAK,CAAA;AAE1D,IAAA,MAAM,OAAO,MAAM,MAAA,CAAO,EAAE,SAAA,EAAW,OAAA,IAAwB,MAAM,CAAA;AACrE,IAAA,OAAO,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAAA,EACrC,CAAA;AAEA,EAAA,OAAO,EAAE,cAAc,QAAA,EAAS;AAClC,CAAA;;;ACvBO,IAAM,SAAA,GAAY,CAAC,MAAA,KAAmC;AAC3D,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAqB,MAAA,KAAyB;AACnE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACvE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,cAAA,GAAiB,OAAO,KAAA,EAAqB,MAAA,KAAyB;AAC1E,IAAA,MAAM,EAAE,QAAA,EAAU,IAAA,EAAM,MAAK,GAAI,kBAAA,CAAmB,MAAM,KAAK,CAAA;AAE/D,IAAA,OAAO,QAAQ,EAAE,QAAA,EAAU,IAAA,EAAM,IAAA,IAAyB,MAAM,CAAA;AAAA,EAClE,CAAA;AAEA,EAAA,MAAM,kBAAA,GAAqB,OAAO,KAAA,EAAyB,MAAA,KAAyB;AAClF,IAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAU,GAAI,sBAAA,CAAuB,MAAM,KAAK,CAAA;AAElE,IAAA,OAAO,QAAQ,EAAE,QAAA,EAAU,MAAM,UAAA,EAAY,SAAA,IAA8B,MAAM,CAAA;AAAA,EACnF,CAAA;AAEA,EAAA,MAAM,uBAAA,GAA0B,OAAO,MAAA,KAAyB;AAC9D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,6BAAA,EAA+B,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAChF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAKA,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,KAAA,EAAO,OAAO,MAAA,KAAyB;AACrC,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,mBAAA,EAAqB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AACtE,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,OAAO,KAAA,EAAuB,MAAA,KAAyB;AAC7D,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,0BAAA,EAA4B,EAAE,IAAA,EAAM,KAAA,EAAM,EAAG,EAAE,QAAQ,CAAA;AAC1F,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,OAAA,EAAS,OAAO,EAAA,EAA2B,MAAA,KAAyB;AAClE,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,wBAAA,EAA0B,EAAE,IAAA,EAAM,EAAE,EAAA,EAAG,EAAE,EAAG,EAAE,MAAA,EAAQ,CAAA;AAAA,IAC5E;AAAA,GACF;AAEA,EAAA,OAAO,EAAE,cAAA,EAAgB,kBAAA,EAAoB,uBAAA,EAAyB,IAAA,EAAK;AAC7E,CAAA;;;AC1CO,IAAM,cAAA,GAAiB,CAAC,MAAA,KAAmC;AAGhE,EAAA,MAAM,YAAA,GAAe,OAAO,KAAA,EAA0B,MAAA,KAAyB;AAC7E,IAAA,MAAM,IAAA,GAAO,uBAAA,CAAwB,KAAA,CAAM,KAAK,CAAA;AAChD,IAAA,MAAM,MAAA,CAAO,KAAK,iCAAA,EAAmC,EAAE,MAAK,EAAG,EAAE,QAAQ,CAAA;AAAA,EAC3E,CAAA;AAIA,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,EAAmB,MAAA,KAAyB;AAG/D,IAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,KAAA,CAAM,KAAK,CAAA;AACzC,IAAA,MAAM,MAAA,CAAO,KAAK,yBAAA,EAA2B,EAAE,MAAK,EAAG,EAAE,QAAQ,CAAA;AAAA,EACnE,CAAA;AAKA,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAA4B,MAAA,KAAyB;AACzE,IAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,KAAA,CAAM,KAAK,CAAA;AAC1C,IAAA,MAAM,MAAA,CAAO,KAAK,0BAAA,EAA4B,EAAE,MAAK,EAAG,EAAE,QAAQ,CAAA;AAAA,EACpE,CAAA;AAEA,EAAA,OAAO,EAAE,YAAA,EAAc,KAAA,EAAO,MAAA,EAAO;AACvC,CAAA;;;AC3BO,IAAM,SAAA,GAAY,CAAC,MAAA,KAAmC;AAC3D,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAyB;AAC7C,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,cAAA,EAAgB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAChE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAqB,MAAA,KAAyB;AAClE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACvE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,EAAwB,MAAA,KAAyB;AACvE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,uBAAA,EAAyB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAChF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,EAAA,EAAyB,MAAA,KAAyB;AACtE,IAAA,MAAM,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,EAAE,IAAA,EAAM,EAAE,EAAA,EAAG,EAAE,EAAG,EAAE,MAAA,EAAQ,CAAA;AAAA,EACvE,CAAA;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAO;AAC5C,CAAA;;;ACrBO,IAAM,UAAA,GAAa,CAAC,MAAA,KAAmC;AAC5D,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,EAAwB,MAAA,KAAyB;AACvE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,qBAAA,EAAuB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC9E,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,QAAA,EAAS;AACpB,CAAA;;;ACPO,IAAM,UAAA,GAAa,CAAC,MAAA,KAAmC;AAC5D,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAsB,MAAA,KAAyB;AACnE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,sBAAA,EAAwB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC/E,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,EAAyB,MAAA,KAAyB;AACxE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,wBAAA,EAA0B,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACjF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC5B,CAAA;;;ACZO,IAAM,aAAA,GAAgB,CAAC,MAAA,KAAmC;AAC/D,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAyB;AAC7C,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,mBAAA,EAAqB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AACrE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,SAAA,EAA2C,MAAA,KAAyB;AACxF,IAAA,MAAM,MAAA,CAAO,MAAA,CAAO,+BAAA,EAAiC,EAAE,IAAA,EAAM,EAAE,SAAA,EAAU,EAAE,EAAG,EAAE,MAAA,EAAQ,CAAA;AAAA,EAC1F,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,KAAyB;AAChD,IAAA,MAAM,OAAO,MAAA,CAAO,mBAAA,EAAqB,EAAC,EAAG,EAAE,QAAQ,CAAA;AAAA,EACzD,CAAA;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAA,EAAU;AACrC,CAAA;;;ACfO,IAAM,UAAA,GAAa,CAAC,MAAA,KAAmC;AAC5D,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAgB,MAAA,KAAyB;AAC7D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACxE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,KAAyB;AAChD,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,yBAAA,EAA2B,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC5E,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAC7B,CAAA;;;ACXO,IAAM,WAAA,GAAc,CAAC,MAAA,KAAmC;AAC7D,EAAA,MAAM,OAAA,GAAU,OAAO,YAAA,EAAsB,MAAA,KAAyB;AACpE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA;AAAA,MAC5B,wBAAA;AAAA,MACA,EAAE,IAAA,EAAM,EAAE,YAAA,EAAa,EAAE;AAAA,MACzB,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAOA,EAAA,MAAM,UAAA,GAAa,OAAO,KAAA,EAAgB,MAAA,KAAyB;AACjE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,2BAAA;AAAA,MACA,EAAC;AAAA,MACD,EAAE,MAAA,EAAQ,OAAA,EAAS,KAAA,GAAQ,EAAE,CAAC,UAAA,CAAW,aAAa,GAAG,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,KAAO,MAAA;AAAU,KAC3F;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAuB,MAAA,KAAyB;AACpE,IAAA,MAAM,MAAA,CAAO,KAAK,uBAAA,EAAyB,EAAE,MAAK,EAAG,EAAE,QAAQ,CAAA;AAAA,EACjE,CAAA;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,UAAA,EAAY,MAAA,EAAO;AACvC,CAAA;;;AChBO,IAAM,gBAAA,GAAmB,CAAC,EAAE,OAAA,EAAS,aAAY,KAA6B;AACnF,EAAA,MAAM,MAAA,GAAS,wBAAA,CAAgC,EAAE,OAAA,EAAS,aAAa,CAAA;AAEvE,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,YAAY,MAAM,CAAA;AAAA,IACzB,GAAA,EAAK,UAAU,MAAM,CAAA;AAAA,IACrB,QAAA,EAAU,eAAe,MAAM,CAAA;AAAA,IAC/B,IAAA,EAAM,WAAW,MAAM,CAAA;AAAA,IACvB,GAAA,EAAK,UAAU,MAAM,CAAA;AAAA,IACrB,MAAA,EAAQ,aAAa,MAAM,CAAA;AAAA,IAC3B,IAAA,EAAM,WAAW,MAAM,CAAA;AAAA,IACvB,IAAA,EAAM,WAAW,MAAM,CAAA;AAAA,IACvB,OAAA,EAAS,cAAc,MAAM,CAAA;AAAA,IAC7B,KAAA,EAAO,YAAY,MAAM;AAAA,GAC3B;AACF","file":"chunk-HFZCZ7PZ.js","sourcesContent":["import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n// MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import * as z from 'zod';\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum(['totp', 'recovery_code']),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  return { withPassword, withOidc };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput } from './schemas';\nimport { mfaCodeInputSchema, mfaWebauthnInputSchema } from './schemas';\nimport type { DisableTotpPath, TotpVerifyBody, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: 'webauthn', assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyBody, signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body: input }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { CreatePatBody, ExchangePatBody, RevokePatPath } from './types';\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (body: CreatePatBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body }, { signal });\n    return data;\n  };\n\n  const exchange = async (body?: ExchangePatBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat/exchange', { body }, { signal });\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo', { body }, { signal });\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({ baseUrl, middlewares });\n\n  return {\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n  };\n};\n"]}
+{"version":3,"sources":["../src/clients/auth/login/schemas.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/device/device.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/authClient.ts"],"names":["z2","z3","email"],"mappings":";;;AAEO,IAAM,mBAAqB,CAAA,CAAA,MAAA,CAAO;AAAA,EACvC,OAAS,CAAA,CAAA,KAAA,EAAM;AAAA,EACf,QAAA,EAAY,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU;AACxC,CAAC;AAEM,IAAM,kBAAoB,CAAA,CAAA,MAAA,CAAO;AAAA,EACtC,SAAA,EAAa,CAAA,CAAA,IAAA,CAAK,CAAC,QAAA,EAAU,WAAW,CAAC,CAAA;AAAA,EACzC,OAAA,EAAW,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU;AACvC,CAAC;AAKD,IAAM,aAAe,CAAA,CAAA,MAAA,CAAO;AAAA,EAC1B,IAAM,CAAA,CAAA,MAAA,EAAO;AAAA,EACb,OAAS,CAAA,CAAA,MAAA,EAAO;AAAA,EAChB,MAAQ,CAAA,CAAA,MAAA;AACV,CAAC,CAAA;AAIM,IAAM,qBAAuB,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,WAAA,EAAe,CAAA,CAAA,OAAA,CAAQ,KAAK,CAAA,CAAE,QAAQ,KAAK,CAAA;AAAA,EAC3C,aAAe,CAAA,CAAA,MAAA,EAAO;AAAA,EACtB,cAAgB,CAAA,CAAA,MAAA,EAAO;AAAA,EACvB,WAAa,CAAA,CAAA,MAAA,EAAO;AAAA,EACpB,WAAa,CAAA,CAAA,MAAA,EAAO;AAAA,EACpB,WAAa,CAAA,CAAA,MAAA,EAAO;AAAA,EACpB,IAAA,EAAM;AACR,CAAC;AAGM,IAAM,qBAAuB,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,WAAA,EAAe,UAAQ,IAAI,CAAA;AAAA,EAC3B,SAAW,CAAA,CAAA,MAAA,EAAO;AAAA,EAClB,UAAY,CAAA,CAAA,MAAA,EAAO;AAAA,EACnB,WAAa,CAAA,CAAA,MAAA,EAAO;AAAA,EACpB,cAAA,EAAkB,CAAA,CAAA,KAAA,CAAQ,CAAA,CAAA,MAAA,EAAQ;AACpC,CAAC;AAEM,IAAM,iBAAA,GAAsB,CAAA,CAAA,KAAA,CAAM,CAAC,kBAAA,EAAoB,kBAAkB,CAAC;ACxC1E,IAAM,qBAAuBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACzC,UAAYA,CAAA,CAAA,MAAA,EAAO;AAAA,EACnB,IAAA,EAAQA,CAAA,CAAA,IAAA,CAAK,CAAC,MAAA,EAAQ,eAAe,CAAC,CAAA;AAAA,EACtC,IAAA,EAAQA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU;AACpC,CAAC;AAEM,IAAM,yBAA2BA,CAAA,CAAA,MAAA,CAAO;AAAA,EAC7C,UAAYA,CAAA,CAAA,MAAA,EAAO;AAAA,EACnB,WAAaA,CAAA,CAAA,MAAA;AACf,CAAC;ACTM,IAAM,0BAA4BC,CAAA,CAAA,MAAA,CAAO;AAAA,EAC9C,OAASA,CAAA,CAAA,KAAA;AACX,CAAC;AAEM,IAAM,mBAAqBA,CAAA,CAAA,MAAA,CAAO;AAAA;AAAA,EAEvC,KAAA,EAASA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU,CAAA;AAAA,EACnC,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU,CAAA;AAAA;AAAA;AAAA,EAGzC,cAAA,EAAkBA,CAAA,CAAA,OAAA,EAAQ,CAAE,OAAA,CAAQ,IAAI;AAC1C,CAAC;AAEM,IAAM,oBAAsBA,CAAA,CAAA,MAAA,CAAO;AAAA,EACxC,eAAA,EAAmBA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU,CAAA;AAAA,EAC7C,WAAA,EAAeA,CAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,UAAU,CAAA;AAAA;AAAA;AAAA;AAAA,EAIzC,mBAAA,EAAuBA,CAAA,CAAA,OAAA,EAAQ,CAAE,OAAA,CAAQ,IAAI;AAC/C,CAAC;;;ACdM,IAAM,YAAA,GAAe,CAAC,MAAA,KAAmC;AAC9D,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAqC,MAAA,KAAyB;AAClF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,iBAAA,EAAmB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC1E,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAsC,MAAA,KAAyB;AACpF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,yBAAA,EAA2B,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAClF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,EAAuC,MAAA,KAAyB;AACtF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,uBAAA,EAAyB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAChF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAS;AACrC,CAAA;;;ACnBO,IAAM,WAAA,GAAc,CAAC,MAAA,KAAmC;AAC7D,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAiB,MAAA,KAAyB;AAC9D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,gBAAA,EAAkB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACzE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,YAAA,GAAe,OAAO,KAAA,EAAmB,MAAA,KAAyB;AACtE,IAAA,MAAM,EAAE,KAAA,EAAAC,MAAAA,EAAO,UAAS,GAAI,gBAAA,CAAiB,MAAM,KAAK,CAAA;AAExD,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,EAAE,SAAA,EAAW,YAAY,KAAA,EAAAA,MAAAA,EAAO,QAAA,EAAS,EAAgB,MAAM,CAAA;AAGzF,IAAA,OAAO,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAAA,EACrC,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,KAAA,EAAkB,MAAA,KAAyB;AACjE,IAAA,MAAM,EAAE,SAAA,EAAW,OAAA,EAAQ,GAAI,eAAA,CAAgB,MAAM,KAAK,CAAA;AAE1D,IAAA,MAAM,OAAO,MAAM,MAAA,CAAO,EAAE,SAAA,EAAW,OAAA,IAAwB,MAAM,CAAA;AACrE,IAAA,OAAO,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAAA,EACrC,CAAA;AAEA,EAAA,OAAO,EAAE,cAAc,QAAA,EAAS;AAClC,CAAA;;;ACvBO,IAAM,SAAA,GAAY,CAAC,MAAA,KAAmC;AAC3D,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAqB,MAAA,KAAyB;AACnE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACvE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,cAAA,GAAiB,OAAO,KAAA,EAAqB,MAAA,KAAyB;AAC1E,IAAA,MAAM,EAAE,QAAA,EAAU,IAAA,EAAM,MAAK,GAAI,kBAAA,CAAmB,MAAM,KAAK,CAAA;AAE/D,IAAA,OAAO,QAAQ,EAAE,QAAA,EAAU,IAAA,EAAM,IAAA,IAAyB,MAAM,CAAA;AAAA,EAClE,CAAA;AAEA,EAAA,MAAM,kBAAA,GAAqB,OAAO,KAAA,EAAyB,MAAA,KAAyB;AAClF,IAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAU,GAAI,sBAAA,CAAuB,MAAM,KAAK,CAAA;AAElE,IAAA,OAAO,QAAQ,EAAE,QAAA,EAAU,MAAM,UAAA,EAAY,SAAA,IAA8B,MAAM,CAAA;AAAA,EACnF,CAAA;AAEA,EAAA,MAAM,uBAAA,GAA0B,OAAO,MAAA,KAAyB;AAC9D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,6BAAA,EAA+B,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAChF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAKA,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,KAAA,EAAO,OAAO,MAAA,KAAyB;AACrC,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,mBAAA,EAAqB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AACtE,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,EAAQ,OAAO,KAAA,EAAuB,MAAA,KAAyB;AAC7D,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,0BAAA,EAA4B,EAAE,IAAA,EAAM,KAAA,EAAM,EAAG,EAAE,QAAQ,CAAA;AAC1F,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,OAAA,EAAS,OAAO,EAAA,EAA2B,MAAA,KAAyB;AAClE,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,wBAAA,EAA0B,EAAE,IAAA,EAAM,EAAE,EAAA,EAAG,EAAE,EAAG,EAAE,MAAA,EAAQ,CAAA;AAAA,IAC5E;AAAA,GACF;AAEA,EAAA,OAAO,EAAE,cAAA,EAAgB,kBAAA,EAAoB,uBAAA,EAAyB,IAAA,EAAK;AAC7E,CAAA;;;AC1CO,IAAM,cAAA,GAAiB,CAAC,MAAA,KAAmC;AAGhE,EAAA,MAAM,YAAA,GAAe,OAAO,KAAA,EAA0B,MAAA,KAAyB;AAC7E,IAAA,MAAM,IAAA,GAAO,uBAAA,CAAwB,KAAA,CAAM,KAAK,CAAA;AAChD,IAAA,MAAM,MAAA,CAAO,KAAK,iCAAA,EAAmC,EAAE,MAAK,EAAG,EAAE,QAAQ,CAAA;AAAA,EAC3E,CAAA;AAIA,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,EAAmB,MAAA,KAAyB;AAG/D,IAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,KAAA,CAAM,KAAK,CAAA;AACzC,IAAA,MAAM,MAAA,CAAO,KAAK,yBAAA,EAA2B,EAAE,MAAK,EAAG,EAAE,QAAQ,CAAA;AAAA,EACnE,CAAA;AAKA,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAA4B,MAAA,KAAyB;AACzE,IAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,KAAA,CAAM,KAAK,CAAA;AAC1C,IAAA,MAAM,MAAA,CAAO,KAAK,0BAAA,EAA4B,EAAE,MAAK,EAAG,EAAE,QAAQ,CAAA;AAAA,EACpE,CAAA;AAEA,EAAA,OAAO,EAAE,YAAA,EAAc,KAAA,EAAO,MAAA,EAAO;AACvC,CAAA;;;AC3BO,IAAM,SAAA,GAAY,CAAC,MAAA,KAAmC;AAC3D,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAyB;AAC7C,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,cAAA,EAAgB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAChE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAqB,MAAA,KAAyB;AAClE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACvE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,EAAwB,MAAA,KAAyB;AACvE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,uBAAA,EAAyB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAChF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,EAAA,EAAyB,MAAA,KAAyB;AACtE,IAAA,MAAM,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,EAAE,IAAA,EAAM,EAAE,EAAA,EAAG,EAAE,EAAG,EAAE,MAAA,EAAQ,CAAA;AAAA,EACvE,CAAA;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAO;AAC5C,CAAA;;;ACrBO,IAAM,UAAA,GAAa,CAAC,MAAA,KAAmC;AAC5D,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,EAAwB,MAAA,KAAyB;AACvE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,qBAAA,EAAuB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC9E,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,QAAA,EAAS;AACpB,CAAA;;;ACPO,IAAM,UAAA,GAAa,CAAC,MAAA,KAAmC;AAC5D,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAsB,MAAA,KAAyB;AACnE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,sBAAA,EAAwB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC/E,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,EAAyB,MAAA,KAAyB;AACxE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,wBAAA,EAA0B,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACjF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,QAAQ,QAAA,EAAS;AAC5B,CAAA;;;ACZO,IAAM,aAAA,GAAgB,CAAC,MAAA,KAAmC;AAC/D,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,KAAyB;AAC7C,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,mBAAA,EAAqB,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AACrE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,SAAA,EAA2C,MAAA,KAAyB;AACxF,IAAA,MAAM,MAAA,CAAO,MAAA,CAAO,+BAAA,EAAiC,EAAE,IAAA,EAAM,EAAE,SAAA,EAAU,EAAE,EAAG,EAAE,MAAA,EAAQ,CAAA;AAAA,EAC1F,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,KAAyB;AAChD,IAAA,MAAM,OAAO,MAAA,CAAO,mBAAA,EAAqB,EAAC,EAAG,EAAE,QAAQ,CAAA;AAAA,EACzD,CAAA;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAA,EAAU;AACrC,CAAA;;;ACfO,IAAM,UAAA,GAAa,CAAC,MAAA,KAAmC;AAC5D,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAgB,MAAA,KAAyB;AAC7D,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACxE,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,KAAyB;AAChD,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,yBAAA,EAA2B,EAAC,EAAG,EAAE,MAAA,EAAQ,CAAA;AAC5E,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,OAAO,EAAE,QAAQ,SAAA,EAAU;AAC7B,CAAA;;;ACXO,IAAM,WAAA,GAAc,CAAC,MAAA,KAAmC;AAC7D,EAAA,MAAM,OAAA,GAAU,OAAO,YAAA,EAAsB,MAAA,KAAyB;AACpE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA;AAAA,MAC5B,wBAAA;AAAA,MACA,EAAE,IAAA,EAAM,EAAE,YAAA,EAAa,EAAE;AAAA,MACzB,EAAE,MAAA;AAAO,KACX;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAOA,EAAA,MAAM,UAAA,GAAa,OAAO,KAAA,EAAgB,MAAA,KAAyB;AACjE,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,2BAAA;AAAA,MACA,EAAC;AAAA,MACD,EAAE,MAAA,EAAQ,OAAA,EAAS,KAAA,GAAQ,EAAE,CAAC,UAAA,CAAW,aAAa,GAAG,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,KAAO,MAAA;AAAU,KAC3F;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,EAAuB,MAAA,KAAyB;AACpE,IAAA,MAAM,MAAA,CAAO,KAAK,uBAAA,EAAyB,EAAE,MAAK,EAAG,EAAE,QAAQ,CAAA;AAAA,EACjE,CAAA;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,UAAA,EAAY,MAAA,EAAO;AACvC,CAAA;;;AChBO,IAAM,gBAAA,GAAmB,CAAC,EAAE,OAAA,EAAS,aAAY,KAA6B;AACnF,EAAA,MAAM,MAAA,GAAS,wBAAA,CAAgC,EAAE,OAAA,EAAS,aAAa,CAAA;AAEvE,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,YAAY,MAAM,CAAA;AAAA,IACzB,GAAA,EAAK,UAAU,MAAM,CAAA;AAAA,IACrB,QAAA,EAAU,eAAe,MAAM,CAAA;AAAA,IAC/B,IAAA,EAAM,WAAW,MAAM,CAAA;AAAA,IACvB,GAAA,EAAK,UAAU,MAAM,CAAA;AAAA,IACrB,MAAA,EAAQ,aAAa,MAAM,CAAA;AAAA,IAC3B,IAAA,EAAM,WAAW,MAAM,CAAA;AAAA,IACvB,IAAA,EAAM,WAAW,MAAM,CAAA;AAAA,IACvB,OAAA,EAAS,cAAc,MAAM,CAAA;AAAA,IAC7B,KAAA,EAAO,YAAY,MAAM;AAAA,GAC3B;AACF","file":"chunk-OUSPQ55W.js","sourcesContent":["import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n// MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import * as z from 'zod';\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum(['totp', 'recovery_code']),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  return { withPassword, withOidc };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput } from './schemas';\nimport { mfaCodeInputSchema, mfaWebauthnInputSchema } from './schemas';\nimport type { DisableTotpPath, TotpVerifyBody, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: 'webauthn', assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyBody, signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body: input }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { CreatePatBody, ExchangePatBody, RevokePatPath } from './types';\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (body: CreatePatBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body }, { signal });\n    return data;\n  };\n\n  const exchange = async (body?: ExchangePatBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat/exchange', { body }, { signal });\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo', { body }, { signal });\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({ baseUrl, middlewares });\n\n  return {\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n  };\n};\n"]}

package/dist/{chunk-4GUUSO5O.cjs → chunk-PPQF7LTS.cjs}

@@ -1,15 +1,15 @@
 'use strict';
 
 var chunkFMS5PNM2_cjs = require('./chunk-FMS5PNM2.cjs');
-var chunk43CGBOVT_cjs = require('./chunk-43CGBOVT.cjs');
-var chunkDMNWPVVT_cjs = require('./chunk-DMNWPVVT.cjs');
+var chunk7RO6PKZ4_cjs = require('./chunk-7RO6PKZ4.cjs');
+var chunkMMOAH3EH_cjs = require('./chunk-MMOAH3EH.cjs');
 
 // src/clients/notifications/notificationsClient.ts
 var createNotificationsClient = ({ baseUrl, middlewares, auth }) => {
-  const client = chunkDMNWPVVT_cjs.createOpenapiFetchClient({
+  const client = chunkMMOAH3EH_cjs.createOpenapiFetchClient({
     baseUrl,
     middlewares,
-    headers: chunk43CGBOVT_cjs.createAuthHeaders(auth)
+    headers: chunk7RO6PKZ4_cjs.createAuthHeaders(auth)
   });
   const getSubscriptions = async (query, signal) => {
     const { data } = await client.get("/project-subscriptions", { query }, { signal });
@@ -59,5 +59,5 @@ var createNotificationsClient = ({ baseUrl, middlewares, auth }) => {
 };
 
 exports.createNotificationsClient = createNotificationsClient;
-//# sourceMappingURL=chunk-4GUUSO5O.cjs.map
-//# sourceMappingURL=chunk-4GUUSO5O.cjs.map
+//# sourceMappingURL=chunk-PPQF7LTS.cjs.map
+//# sourceMappingURL=chunk-PPQF7LTS.cjs.map

package/dist/{chunk-4GUUSO5O.cjs.map → chunk-PPQF7LTS.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/clients/notifications/notificationsClient.ts"],"names":["createOpenapiFetchClient","createAuthHeaders","concurrent"],"mappings":";;;;;;;AAQO,IAAM,4BAA4B,CAAC,EAAE,OAAA,EAAS,WAAA,EAAa,MAAK,KAAyB;AAC9F,EAAA,MAAM,SAASA,0CAAA,CAAgC;AAAA,IAC7C,OAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAASC,oCAAkB,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,MAAM,gBAAA,GAAmB,OAAO,KAAA,EAAgC,MAAA,KAAyB;AACvF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,wBAAA,EAA0B,EAAE,KAAA,EAAM,EAAG,EAAE,MAAA,EAAQ,CAAA;AACjF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,OAAO,cAAA,EAAgC,MAAA,KAAyB;AACtF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,yCAAA;AAAA,MACA,EAAE,IAAA,EAAM,EAAE,cAAA,EAAe,EAAE;AAAA,MAC3B,EAAE,MAAA;AAAO,KACX;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,kBAAA,GAAqB,OAAO,IAAA,EAA8B,MAAA,KAAyB;AACvF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,wBAAA,EAA0B,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACjF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAOA,EAAA,MAAM,mBAAA,GAAsB,OAAO,MAAA,EAAkC,MAAA,KAAyB;AAC5F,IAAA,OAAOC,4BAAA,CAAW;AAAA,MAChB,KAAA,EAAO,MAAA;AAAA,MACP,OAAA,EAAS,CAAC,IAAA,KAAS,kBAAA,CAAmB,MAAM,MAAM,CAAA;AAAA,MAClD,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,MAAM,kBAAA,GAAqB,OACzB,cAAA,EACA,MAAA,KACkB;AAClB,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,yCAAA;AAAA,MACA,EAAE,IAAA,EAAM,EAAE,cAAA,EAAe,EAAE;AAAA,MAC3B,EAAE,MAAA;AAAO,KACX;AAAA,EACF,CAAA;AAGA,EAAA,MAAM,mBAAA,GAAsB,OAC1B,eAAA,EACA,MAAA,KACkB;AAClB,IAAA,MAAMA,4BAAA,CAAW;AAAA,MACf,KAAA,EAAO,eAAA;AAAA,MACP,OAAA,EAAS,CAAC,cAAA,KAAmB,kBAAA,CAAmB,gBAAgB,MAAM,CAAA;AAAA,MACtE,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,kBAAA;AAAA,IACA,mBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AACF","file":"chunk-4GUUSO5O.cjs","sourcesContent":["import { createOpenapiFetchClient } from '../../fetchClient';\nimport { concurrent } from '../../utils';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateSubscriptionBody, ListSubscriptionsQuery, SubscriptionId } from './types';\n\nexport const createNotificationsClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const getSubscriptions = async (query?: ListSubscriptionsQuery, signal?: AbortSignal) => {\n    const { data } = await client.get('/project-subscriptions', { query }, { signal });\n    return data;\n  };\n\n  const getSubscription = async (subscriptionId: SubscriptionId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/project-subscriptions/{subscriptionId}',\n      { path: { subscriptionId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createSubscription = async (body: CreateSubscriptionBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/project-subscriptions', { body }, { signal });\n    return data;\n  };\n\n  /**\n   * The service has no bulk create endpoint, so this fans out one request per subscription.\n   * `process` is wrapped rather than passed by reference: `concurrent` calls it with\n   * (item, index, arrayLength), and the index would land on `createSubscription`'s `signal`.\n   */\n  const createSubscriptions = async (bodies: CreateSubscriptionBody[], signal?: AbortSignal) => {\n    return concurrent({\n      items: bodies,\n      process: (body) => createSubscription(body, signal),\n      concurrency: 3,\n    });\n  };\n\n  const deleteSubscription = async (\n    subscriptionId: SubscriptionId,\n    signal?: AbortSignal,\n  ): Promise<void> => {\n    await client.delete(\n      '/project-subscriptions/{subscriptionId}',\n      { path: { subscriptionId } },\n      { signal },\n    );\n  };\n\n  /** Bulk counterpart to `deleteSubscription`; see `createSubscriptions` for the fan-out note. */\n  const deleteSubscriptions = async (\n    subscriptionIds: SubscriptionId[],\n    signal?: AbortSignal,\n  ): Promise<void> => {\n    await concurrent({\n      items: subscriptionIds,\n      process: (subscriptionId) => deleteSubscription(subscriptionId, signal),\n      concurrency: 3,\n    });\n  };\n\n  return {\n    getSubscriptions,\n    getSubscription,\n    createSubscription,\n    createSubscriptions,\n    deleteSubscription,\n    deleteSubscriptions,\n  };\n};\n"]}
+{"version":3,"sources":["../src/clients/notifications/notificationsClient.ts"],"names":["createOpenapiFetchClient","createAuthHeaders","concurrent"],"mappings":";;;;;;;AAQO,IAAM,4BAA4B,CAAC,EAAE,OAAA,EAAS,WAAA,EAAa,MAAK,KAAyB;AAC9F,EAAA,MAAM,SAASA,0CAAA,CAAgC;AAAA,IAC7C,OAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAASC,oCAAkB,IAAI;AAAA,GAChC,CAAA;AAED,EAAA,MAAM,gBAAA,GAAmB,OAAO,KAAA,EAAgC,MAAA,KAAyB;AACvF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,wBAAA,EAA0B,EAAE,KAAA,EAAM,EAAG,EAAE,MAAA,EAAQ,CAAA;AACjF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,OAAO,cAAA,EAAgC,MAAA,KAAyB;AACtF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,GAAA;AAAA,MAC5B,yCAAA;AAAA,MACA,EAAE,IAAA,EAAM,EAAE,cAAA,EAAe,EAAE;AAAA,MAC3B,EAAE,MAAA;AAAO,KACX;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,kBAAA,GAAqB,OAAO,IAAA,EAA8B,MAAA,KAAyB;AACvF,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,wBAAA,EAA0B,EAAE,IAAA,EAAK,EAAG,EAAE,MAAA,EAAQ,CAAA;AACjF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAOA,EAAA,MAAM,mBAAA,GAAsB,OAAO,MAAA,EAAkC,MAAA,KAAyB;AAC5F,IAAA,OAAOC,4BAAA,CAAW;AAAA,MAChB,KAAA,EAAO,MAAA;AAAA,MACP,OAAA,EAAS,CAAC,IAAA,KAAS,kBAAA,CAAmB,MAAM,MAAM,CAAA;AAAA,MAClD,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,MAAM,kBAAA,GAAqB,OACzB,cAAA,EACA,MAAA,KACkB;AAClB,IAAA,MAAM,MAAA,CAAO,MAAA;AAAA,MACX,yCAAA;AAAA,MACA,EAAE,IAAA,EAAM,EAAE,cAAA,EAAe,EAAE;AAAA,MAC3B,EAAE,MAAA;AAAO,KACX;AAAA,EACF,CAAA;AAGA,EAAA,MAAM,mBAAA,GAAsB,OAC1B,eAAA,EACA,MAAA,KACkB;AAClB,IAAA,MAAMA,4BAAA,CAAW;AAAA,MACf,KAAA,EAAO,eAAA;AAAA,MACP,OAAA,EAAS,CAAC,cAAA,KAAmB,kBAAA,CAAmB,gBAAgB,MAAM,CAAA;AAAA,MACtE,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,kBAAA;AAAA,IACA,mBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF;AACF","file":"chunk-PPQF7LTS.cjs","sourcesContent":["import { createOpenapiFetchClient } from '../../fetchClient';\nimport { concurrent } from '../../utils';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateSubscriptionBody, ListSubscriptionsQuery, SubscriptionId } from './types';\n\nexport const createNotificationsClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const getSubscriptions = async (query?: ListSubscriptionsQuery, signal?: AbortSignal) => {\n    const { data } = await client.get('/project-subscriptions', { query }, { signal });\n    return data;\n  };\n\n  const getSubscription = async (subscriptionId: SubscriptionId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/project-subscriptions/{subscriptionId}',\n      { path: { subscriptionId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createSubscription = async (body: CreateSubscriptionBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/project-subscriptions', { body }, { signal });\n    return data;\n  };\n\n  /**\n   * The service has no bulk create endpoint, so this fans out one request per subscription.\n   * `process` is wrapped rather than passed by reference: `concurrent` calls it with\n   * (item, index, arrayLength), and the index would land on `createSubscription`'s `signal`.\n   */\n  const createSubscriptions = async (bodies: CreateSubscriptionBody[], signal?: AbortSignal) => {\n    return concurrent({\n      items: bodies,\n      process: (body) => createSubscription(body, signal),\n      concurrency: 3,\n    });\n  };\n\n  const deleteSubscription = async (\n    subscriptionId: SubscriptionId,\n    signal?: AbortSignal,\n  ): Promise<void> => {\n    await client.delete(\n      '/project-subscriptions/{subscriptionId}',\n      { path: { subscriptionId } },\n      { signal },\n    );\n  };\n\n  /** Bulk counterpart to `deleteSubscription`; see `createSubscriptions` for the fan-out note. */\n  const deleteSubscriptions = async (\n    subscriptionIds: SubscriptionId[],\n    signal?: AbortSignal,\n  ): Promise<void> => {\n    await concurrent({\n      items: subscriptionIds,\n      process: (subscriptionId) => deleteSubscription(subscriptionId, signal),\n      concurrency: 3,\n    });\n  };\n\n  return {\n    getSubscriptions,\n    getSubscription,\n    createSubscription,\n    createSubscriptions,\n    deleteSubscription,\n    deleteSubscriptions,\n  };\n};\n"]}

package/dist/chunk-PSR3N4NC.js

@@ -0,0 +1,136 @@
+import { AdminRole } from './chunk-552FC4ZV.js';
+
+// src/domain/permissions/errors.ts
+var PermissionDeniedError = class extends Error {
+  action;
+  reason;
+  subject;
+  constructor({ action, reason, subject }) {
+    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);
+    this.name = "PermissionDeniedError";
+    this.action = action;
+    this.reason = reason;
+    this.subject = subject;
+  }
+};
+
+// src/domain/permissions/admin.ts
+var role = (token) => token.admin.role;
+var isAdmin = (token) => role(token) === AdminRole.Admin;
+var isAdminOrShare = (token) => role(token) === AdminRole.Admin || role(token) === AdminRole.Share;
+var isProductionManager = (token) => role(token) === AdminRole.ProductionManager;
+var isDeveloperOrReviewer = (token) => role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;
+var isReadOnlyRole = (token) => role(token) === AdminRole.ReadOnly;
+var isKnownAdminRole = (adminRole) => Object.values(AdminRole).includes(adminRole ?? "");
+var isKaiSettingsWriterRole = (adminRole) => {
+  switch (adminRole) {
+    case AdminRole.Admin:
+    case AdminRole.Share:
+      return true;
+    default:
+      return false;
+  }
+};
+var canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
+var assertCanWriteKaiSettings = (token) => {
+  if (!canWriteKaiSettings(token)) {
+    throw new PermissionDeniedError({
+      action: "write-kai-settings",
+      reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
+    });
+  }
+};
+var assertCanAdmin = (token) => {
+  if (!isAdmin(token)) {
+    throw new PermissionDeniedError({
+      action: "admin",
+      reason: `role '${role(token)}' is not admin`
+    });
+  }
+};
+var assertCanAdminOrShare = (token) => {
+  if (!isAdminOrShare(token)) {
+    throw new PermissionDeniedError({
+      action: "admin-or-share",
+      reason: `role '${role(token)}' is not admin or share`
+    });
+  }
+};
+var assertCanProductionManage = (token) => {
+  if (!isProductionManager(token)) {
+    throw new PermissionDeniedError({
+      action: "production-manage",
+      reason: `role '${role(token)}' is not productionManager`
+    });
+  }
+};
+var assertCanDevelopOrReview = (token) => {
+  if (!isDeveloperOrReviewer(token)) {
+    throw new PermissionDeniedError({
+      action: "develop-or-review",
+      reason: `role '${role(token)}' is not developer or reviewer`
+    });
+  }
+};
+
+// src/domain/permissions/configurations.ts
+var meetsBaseRule = (token, ctx) => ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);
+var baseDenialReason = (ctx) => ctx.isDevModeActive ? "dev branch requires developer or reviewer role" : "production requires productionManager role";
+var canCreateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+var canUpdateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+var canCopyConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+var canMigrateFromTemplate = (token, ctx) => meetsBaseRule(token, ctx);
+var canPurgeConfiguration = (token) => isAdmin(token);
+var canAssignFolder = (token, ctx) => meetsBaseRule(token, ctx);
+var assertCanCreateConfiguration = (token, ctx) => {
+  if (!canCreateConfiguration(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "create-configuration",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanUpdateConfiguration = (token, ctx) => {
+  if (!canUpdateConfiguration(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "update-configuration",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanCopyConfiguration = (token, ctx) => {
+  if (!canCopyConfiguration(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "copy-configuration",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanMigrateFromTemplate = (token, ctx) => {
+  if (!canMigrateFromTemplate(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "migrate-from-template",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+var assertCanPurgeConfiguration = (token, ctx) => {
+  if (!canPurgeConfiguration(token)) {
+    throw new PermissionDeniedError({
+      action: "purge-configuration",
+      reason: "purge requires admin role"
+    });
+  }
+};
+var assertCanAssignFolder = (token, ctx) => {
+  if (!canAssignFolder(token, ctx)) {
+    throw new PermissionDeniedError({
+      action: "assign-folder",
+      reason: baseDenialReason(ctx)
+    });
+  }
+};
+
+export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };
+//# sourceMappingURL=chunk-PSR3N4NC.js.map
+//# sourceMappingURL=chunk-PSR3N4NC.js.map

package/dist/chunk-PSR3N4NC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAWnF,IAAM,gBAAA,GAAmB,CAAC,SAAA,KAC9B,MAAA,CAAO,OAAO,SAAS,CAAA,CAAe,QAAA,CAAS,SAAA,IAAa,EAAE;AAkB1D,IAAM,uBAAA,GAA0B,CAAC,SAAA,KAAkD;AACxF,EAAA,QAAQ,SAAA;AAAW,IACjB,KAAK,SAAA,CAAU,KAAA;AAAA,IACf,KAAK,SAAA,CAAU,KAAA;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACE,MAAA,OAAO,KAAA;AAAA;AAEb;AAQO,IAAM,mBAAA,GAAsB,CAAC,KAAA,KAClC,KAAA,CAAM,iBAAiB,uBAAA,CAAwB,KAAA,CAAM,OAAO,IAAI;AAE3D,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,MAAM,aAAA,GACV,CAAA,MAAA,EAAS,MAAM,KAAA,EAAO,IAAA,IAAQ,MAAM,CAAA,4BAAA,CAAA,GACpC;AAAA,KACL,CAAA;AAAA,EACH;AACF;AAEO,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;AChEA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"chunk-PSR3N4NC.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/{chunk-4IEIVLYT.js → chunk-RVBGE2Z4.js}

@@ -1,4 +1,5 @@
-import { ComponentId } from './chunk-XMC355U2.js';
+import { assertCanCreateConfiguration, assertCanUpdateConfiguration } from './chunk-PSR3N4NC.js';
+import { ComponentId } from './chunk-KEFXOJD7.js';
 import { isPlainObject } from './chunk-MSI6FVGG.js';
 import { z } from 'zod';
 
@@ -419,6 +420,9 @@ var createConfigurationSdk = ({ storageClient, encryptionClient, context }) => {
   };
   const createConfiguration = async (input) => {
     const { componentId, branchId, configuration, ...rest } = input;
+    assertCanCreateConfiguration(context.project.sapiToken, {
+      isDevModeActive: context.defaultBranch.isDev(branchId)
+    });
     const def = registry.get(componentId);
     const validated = def.inputSchema.parse(configuration);
     const encrypted = await _encrypt(componentId, validated);
@@ -432,6 +436,9 @@ var createConfigurationSdk = ({ storageClient, encryptionClient, context }) => {
   };
   const updateConfiguration = async (input) => {
     const { componentId, branchId, configId, configuration, mode = "merge", ...rest } = input;
+    assertCanUpdateConfiguration(context.project.sapiToken, {
+      isDevModeActive: context.defaultBranch.isDev(branchId)
+    });
     const def = registry.get(componentId);
     const validated = def.inputSchema.parse(configuration);
     const encrypted = await _encrypt(componentId, validated);
@@ -457,5 +464,5 @@ var createConfigurationSdk = ({ storageClient, encryptionClient, context }) => {
 };
 
 export { createConfigurationSdk, isEmptyDeep, schemaGuidedMerge };
-//# sourceMappingURL=chunk-4IEIVLYT.js.map
-//# sourceMappingURL=chunk-4IEIVLYT.js.map
+//# sourceMappingURL=chunk-RVBGE2Z4.js.map
+//# sourceMappingURL=chunk-RVBGE2Z4.js.map