@keboola/api-client 23.0.0 → 25.0.0

package/dist/domain/permissions/index.cjs

@@ -1,129 +1,10 @@
 'use strict';
 
-var chunkYXGBD4WP_cjs = require('../../chunk-YXGBD4WP.cjs');
 var chunkGF4XZK5N_cjs = require('../../chunk-GF4XZK5N.cjs');
+var chunk6YZQIMML_cjs = require('../../chunk-6YZQIMML.cjs');
+require('../../chunk-YXGBD4WP.cjs');
 
-// src/domain/permissions/errors.ts
-var PermissionDeniedError = class extends Error {
-  action;
-  reason;
-  subject;
-  constructor({ action, reason, subject }) {
-    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);
-    this.name = "PermissionDeniedError";
-    this.action = action;
-    this.reason = reason;
-    this.subject = subject;
-  }
-};
 
-// src/domain/permissions/admin.ts
-var role = (token) => token.admin.role;
-var isAdmin = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.Admin;
-var isAdminOrShare = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.Admin || role(token) === chunkYXGBD4WP_cjs.AdminRole.Share;
-var isProductionManager = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.ProductionManager;
-var isDeveloperOrReviewer = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.Developer || role(token) === chunkYXGBD4WP_cjs.AdminRole.Reviewer;
-var isReadOnlyRole = (token) => role(token) === chunkYXGBD4WP_cjs.AdminRole.ReadOnly;
-var isKnownAdminRole = (adminRole) => Object.values(chunkYXGBD4WP_cjs.AdminRole).includes(adminRole ?? "");
-var isKaiSettingsWriterRole = (adminRole) => {
-  switch (adminRole) {
-    case chunkYXGBD4WP_cjs.AdminRole.Admin:
-    case chunkYXGBD4WP_cjs.AdminRole.Share:
-      return true;
-    default:
-      return false;
-  }
-};
-var canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
-var assertCanWriteKaiSettings = (token) => {
-  if (!canWriteKaiSettings(token)) {
-    throw new PermissionDeniedError({
-      action: "write-kai-settings",
-      reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
-    });
-  }
-};
-var assertCanAdmin = (token) => {
-  if (!isAdmin(token)) {
-    throw new PermissionDeniedError({
-      action: "admin",
-      reason: `role '${role(token)}' is not admin`
-    });
-  }
-};
-var assertCanAdminOrShare = (token) => {
-  if (!isAdminOrShare(token)) {
-    throw new PermissionDeniedError({
-      action: "admin-or-share",
-      reason: `role '${role(token)}' is not admin or share`
-    });
-  }
-};
-var assertCanProductionManage = (token) => {
-  if (!isProductionManager(token)) {
-    throw new PermissionDeniedError({
-      action: "production-manage",
-      reason: `role '${role(token)}' is not productionManager`
-    });
-  }
-};
-var assertCanDevelopOrReview = (token) => {
-  if (!isDeveloperOrReviewer(token)) {
-    throw new PermissionDeniedError({
-      action: "develop-or-review",
-      reason: `role '${role(token)}' is not developer or reviewer`
-    });
-  }
-};
-
-// src/domain/permissions/configurations.ts
-var meetsBaseRule = (token, ctx) => ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);
-var baseDenialReason = (ctx) => ctx.isDevModeActive ? "dev branch requires developer or reviewer role" : "production requires productionManager role";
-var canCreateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
-var canCopyConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
-var canMigrateFromTemplate = (token, ctx) => meetsBaseRule(token, ctx);
-var canPurgeConfiguration = (token) => isAdmin(token);
-var canAssignFolder = (token, ctx) => meetsBaseRule(token, ctx);
-var assertCanCreateConfiguration = (token, ctx) => {
-  if (!canCreateConfiguration(token, ctx)) {
-    throw new PermissionDeniedError({
-      action: "create-configuration",
-      reason: baseDenialReason(ctx)
-    });
-  }
-};
-var assertCanCopyConfiguration = (token, ctx) => {
-  if (!canCopyConfiguration(token, ctx)) {
-    throw new PermissionDeniedError({
-      action: "copy-configuration",
-      reason: baseDenialReason(ctx)
-    });
-  }
-};
-var assertCanMigrateFromTemplate = (token, ctx) => {
-  if (!canMigrateFromTemplate(token, ctx)) {
-    throw new PermissionDeniedError({
-      action: "migrate-from-template",
-      reason: baseDenialReason(ctx)
-    });
-  }
-};
-var assertCanPurgeConfiguration = (token, ctx) => {
-  if (!canPurgeConfiguration(token)) {
-    throw new PermissionDeniedError({
-      action: "purge-configuration",
-      reason: "purge requires admin role"
-    });
-  }
-};
-var assertCanAssignFolder = (token, ctx) => {
-  if (!canAssignFolder(token, ctx)) {
-    throw new PermissionDeniedError({
-      action: "assign-folder",
-      reason: baseDenialReason(ctx)
-    });
-  }
-};
 
 Object.defineProperty(exports, "hasAdminFeature", {
   enumerable: true,
@@ -133,29 +14,109 @@ Object.defineProperty(exports, "hasFeature", {
   enumerable: true,
   get: function () { return chunkGF4XZK5N_cjs.hasFeature; }
 });
-exports.PermissionDeniedError = PermissionDeniedError;
-exports.assertCanAdmin = assertCanAdmin;
-exports.assertCanAdminOrShare = assertCanAdminOrShare;
-exports.assertCanAssignFolder = assertCanAssignFolder;
-exports.assertCanCopyConfiguration = assertCanCopyConfiguration;
-exports.assertCanCreateConfiguration = assertCanCreateConfiguration;
-exports.assertCanDevelopOrReview = assertCanDevelopOrReview;
-exports.assertCanMigrateFromTemplate = assertCanMigrateFromTemplate;
-exports.assertCanProductionManage = assertCanProductionManage;
-exports.assertCanPurgeConfiguration = assertCanPurgeConfiguration;
-exports.assertCanWriteKaiSettings = assertCanWriteKaiSettings;
-exports.canAssignFolder = canAssignFolder;
-exports.canCopyConfiguration = canCopyConfiguration;
-exports.canCreateConfiguration = canCreateConfiguration;
-exports.canMigrateFromTemplate = canMigrateFromTemplate;
-exports.canPurgeConfiguration = canPurgeConfiguration;
-exports.canWriteKaiSettings = canWriteKaiSettings;
-exports.isAdmin = isAdmin;
-exports.isAdminOrShare = isAdminOrShare;
-exports.isDeveloperOrReviewer = isDeveloperOrReviewer;
-exports.isKaiSettingsWriterRole = isKaiSettingsWriterRole;
-exports.isKnownAdminRole = isKnownAdminRole;
-exports.isProductionManager = isProductionManager;
-exports.isReadOnlyRole = isReadOnlyRole;
+Object.defineProperty(exports, "PermissionDeniedError", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.PermissionDeniedError; }
+});
+Object.defineProperty(exports, "assertCanAdmin", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanAdmin; }
+});
+Object.defineProperty(exports, "assertCanAdminOrShare", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanAdminOrShare; }
+});
+Object.defineProperty(exports, "assertCanAssignFolder", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanAssignFolder; }
+});
+Object.defineProperty(exports, "assertCanCopyConfiguration", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanCopyConfiguration; }
+});
+Object.defineProperty(exports, "assertCanCreateConfiguration", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanCreateConfiguration; }
+});
+Object.defineProperty(exports, "assertCanDevelopOrReview", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanDevelopOrReview; }
+});
+Object.defineProperty(exports, "assertCanMigrateFromTemplate", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanMigrateFromTemplate; }
+});
+Object.defineProperty(exports, "assertCanProductionManage", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanProductionManage; }
+});
+Object.defineProperty(exports, "assertCanPurgeConfiguration", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanPurgeConfiguration; }
+});
+Object.defineProperty(exports, "assertCanUpdateConfiguration", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanUpdateConfiguration; }
+});
+Object.defineProperty(exports, "assertCanWriteKaiSettings", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.assertCanWriteKaiSettings; }
+});
+Object.defineProperty(exports, "canAssignFolder", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.canAssignFolder; }
+});
+Object.defineProperty(exports, "canCopyConfiguration", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.canCopyConfiguration; }
+});
+Object.defineProperty(exports, "canCreateConfiguration", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.canCreateConfiguration; }
+});
+Object.defineProperty(exports, "canMigrateFromTemplate", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.canMigrateFromTemplate; }
+});
+Object.defineProperty(exports, "canPurgeConfiguration", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.canPurgeConfiguration; }
+});
+Object.defineProperty(exports, "canUpdateConfiguration", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.canUpdateConfiguration; }
+});
+Object.defineProperty(exports, "canWriteKaiSettings", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.canWriteKaiSettings; }
+});
+Object.defineProperty(exports, "isAdmin", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.isAdmin; }
+});
+Object.defineProperty(exports, "isAdminOrShare", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.isAdminOrShare; }
+});
+Object.defineProperty(exports, "isDeveloperOrReviewer", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.isDeveloperOrReviewer; }
+});
+Object.defineProperty(exports, "isKaiSettingsWriterRole", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.isKaiSettingsWriterRole; }
+});
+Object.defineProperty(exports, "isKnownAdminRole", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.isKnownAdminRole; }
+});
+Object.defineProperty(exports, "isProductionManager", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.isProductionManager; }
+});
+Object.defineProperty(exports, "isReadOnlyRole", {
+  enumerable: true,
+  get: function () { return chunk6YZQIMML_cjs.isReadOnlyRole; }
+});
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/domain/permissions/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRole"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAWnF,IAAM,gBAAA,GAAmB,CAAC,SAAA,KAC9B,MAAA,CAAO,OAAOA,2BAAS,CAAA,CAAe,QAAA,CAAS,SAAA,IAAa,EAAE;AAkB1D,IAAM,uBAAA,GAA0B,CAAC,SAAA,KAAkD;AACxF,EAAA,QAAQ,SAAA;AAAW,IACjB,KAAKA,2BAAA,CAAU,KAAA;AAAA,IACf,KAAKA,2BAAA,CAAU,KAAA;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACE,MAAA,OAAO,KAAA;AAAA;AAEb;AAQO,IAAM,mBAAA,GAAsB,CAAC,KAAA,KAClC,KAAA,CAAM,iBAAiB,uBAAA,CAAwB,KAAA,CAAM,OAAO,IAAI;AAE3D,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,MAAM,aAAA,GACV,CAAA,MAAA,EAAS,MAAM,KAAA,EAAO,IAAA,IAAQ,MAAM,CAAA,4BAAA,CAAA,GACpC;AAAA,KACL,CAAA;AAAA,EACH;AACF;AAEO,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;AChEA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.cjs"}

package/dist/domain/permissions/index.d.cts

@@ -1,7 +1,7 @@
-import { S as StorageToken } from '../../types-CfIKhNMg.cjs';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-CbJCjkdt.cjs';
+import { S as StorageToken } from '../../types-sVyfECai.cjs';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-CZPvcxRW.cjs';
 import '../../adminRoles-Cil1lavB.cjs';
-import '../../types-BbM5WDSR.cjs';
+import '../../types-gcShAmmi.cjs';
 
 /**
  * @module domain/permissions/errors
@@ -88,7 +88,7 @@ declare const assertCanDevelopOrReview: (token: StorageToken) => void;
  * @module domain/permissions/configurations
  *
  * Predicate pairs guarding the Core SDK configuration workflow methods
- * (create / copy / migrate-from-template / purge / assign-folder). Each
+ * (create / update / copy / migrate-from-template / purge / assign-folder). Each
  * predicate composes the baseline admin role predicates with the caller-
  * supplied dev-mode flag from `ctx`.
  *
@@ -136,14 +136,16 @@ type ConfigurationCtx = {
     isDevModeActive: boolean;
 };
 declare const canCreateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canUpdateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const canCopyConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const canMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const canAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const assertCanCreateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanUpdateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanCopyConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
 
-export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };
+export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };

package/dist/domain/permissions/index.d.ts

@@ -1,7 +1,7 @@
-import { S as StorageToken } from '../../types-CJ0RgA57.js';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-BV-vseKc.js';
+import { S as StorageToken } from '../../types-00IaLn3S.js';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-CXqPYo4T.js';
 import '../../adminRoles-Cil1lavB.js';
-import '../../types-BbM5WDSR.js';
+import '../../types-gcShAmmi.js';
 
 /**
  * @module domain/permissions/errors
@@ -88,7 +88,7 @@ declare const assertCanDevelopOrReview: (token: StorageToken) => void;
  * @module domain/permissions/configurations
  *
  * Predicate pairs guarding the Core SDK configuration workflow methods
- * (create / copy / migrate-from-template / purge / assign-folder). Each
+ * (create / update / copy / migrate-from-template / purge / assign-folder). Each
  * predicate composes the baseline admin role predicates with the caller-
  * supplied dev-mode flag from `ctx`.
  *
@@ -136,14 +136,16 @@ type ConfigurationCtx = {
     isDevModeActive: boolean;
 };
 declare const canCreateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
+declare const canUpdateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const canCopyConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const canMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const canAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => boolean;
 declare const assertCanCreateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
+declare const assertCanUpdateConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanCopyConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
 
-export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };
+export { type ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };

package/dist/domain/permissions/index.js

@@ -1,128 +1,5 @@
-import { AdminRole } from '../../chunk-552FC4ZV.js';
 export { hasAdminFeature, hasFeature } from '../../chunk-UABYNGBZ.js';
-
-// src/domain/permissions/errors.ts
-var PermissionDeniedError = class extends Error {
-  action;
-  reason;
-  subject;
-  constructor({ action, reason, subject }) {
-    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);
-    this.name = "PermissionDeniedError";
-    this.action = action;
-    this.reason = reason;
-    this.subject = subject;
-  }
-};
-
-// src/domain/permissions/admin.ts
-var role = (token) => token.admin.role;
-var isAdmin = (token) => role(token) === AdminRole.Admin;
-var isAdminOrShare = (token) => role(token) === AdminRole.Admin || role(token) === AdminRole.Share;
-var isProductionManager = (token) => role(token) === AdminRole.ProductionManager;
-var isDeveloperOrReviewer = (token) => role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;
-var isReadOnlyRole = (token) => role(token) === AdminRole.ReadOnly;
-var isKnownAdminRole = (adminRole) => Object.values(AdminRole).includes(adminRole ?? "");
-var isKaiSettingsWriterRole = (adminRole) => {
-  switch (adminRole) {
-    case AdminRole.Admin:
-    case AdminRole.Share:
-      return true;
-    default:
-      return false;
-  }
-};
-var canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
-var assertCanWriteKaiSettings = (token) => {
-  if (!canWriteKaiSettings(token)) {
-    throw new PermissionDeniedError({
-      action: "write-kai-settings",
-      reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
-    });
-  }
-};
-var assertCanAdmin = (token) => {
-  if (!isAdmin(token)) {
-    throw new PermissionDeniedError({
-      action: "admin",
-      reason: `role '${role(token)}' is not admin`
-    });
-  }
-};
-var assertCanAdminOrShare = (token) => {
-  if (!isAdminOrShare(token)) {
-    throw new PermissionDeniedError({
-      action: "admin-or-share",
-      reason: `role '${role(token)}' is not admin or share`
-    });
-  }
-};
-var assertCanProductionManage = (token) => {
-  if (!isProductionManager(token)) {
-    throw new PermissionDeniedError({
-      action: "production-manage",
-      reason: `role '${role(token)}' is not productionManager`
-    });
-  }
-};
-var assertCanDevelopOrReview = (token) => {
-  if (!isDeveloperOrReviewer(token)) {
-    throw new PermissionDeniedError({
-      action: "develop-or-review",
-      reason: `role '${role(token)}' is not developer or reviewer`
-    });
-  }
-};
-
-// src/domain/permissions/configurations.ts
-var meetsBaseRule = (token, ctx) => ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);
-var baseDenialReason = (ctx) => ctx.isDevModeActive ? "dev branch requires developer or reviewer role" : "production requires productionManager role";
-var canCreateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
-var canCopyConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
-var canMigrateFromTemplate = (token, ctx) => meetsBaseRule(token, ctx);
-var canPurgeConfiguration = (token) => isAdmin(token);
-var canAssignFolder = (token, ctx) => meetsBaseRule(token, ctx);
-var assertCanCreateConfiguration = (token, ctx) => {
-  if (!canCreateConfiguration(token, ctx)) {
-    throw new PermissionDeniedError({
-      action: "create-configuration",
-      reason: baseDenialReason(ctx)
-    });
-  }
-};
-var assertCanCopyConfiguration = (token, ctx) => {
-  if (!canCopyConfiguration(token, ctx)) {
-    throw new PermissionDeniedError({
-      action: "copy-configuration",
-      reason: baseDenialReason(ctx)
-    });
-  }
-};
-var assertCanMigrateFromTemplate = (token, ctx) => {
-  if (!canMigrateFromTemplate(token, ctx)) {
-    throw new PermissionDeniedError({
-      action: "migrate-from-template",
-      reason: baseDenialReason(ctx)
-    });
-  }
-};
-var assertCanPurgeConfiguration = (token, ctx) => {
-  if (!canPurgeConfiguration(token)) {
-    throw new PermissionDeniedError({
-      action: "purge-configuration",
-      reason: "purge requires admin role"
-    });
-  }
-};
-var assertCanAssignFolder = (token, ctx) => {
-  if (!canAssignFolder(token, ctx)) {
-    throw new PermissionDeniedError({
-      action: "assign-folder",
-      reason: baseDenialReason(ctx)
-    });
-  }
-};
-
-export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };
+export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole } from '../../chunk-PSR3N4NC.js';
+import '../../chunk-552FC4ZV.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/domain/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAE5D,IAAM,iBAAiB,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAWnF,IAAM,gBAAA,GAAmB,CAAC,SAAA,KAC9B,MAAA,CAAO,OAAO,SAAS,CAAA,CAAe,QAAA,CAAS,SAAA,IAAa,EAAE;AAkB1D,IAAM,uBAAA,GAA0B,CAAC,SAAA,KAAkD;AACxF,EAAA,QAAQ,SAAA;AAAW,IACjB,KAAK,SAAA,CAAU,KAAA;AAAA,IACf,KAAK,SAAA,CAAU,KAAA;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACE,MAAA,OAAO,KAAA;AAAA;AAEb;AAQO,IAAM,mBAAA,GAAsB,CAAC,KAAA,KAClC,KAAA,CAAM,iBAAiB,uBAAA,CAAwB,KAAA,CAAM,OAAO,IAAI;AAE3D,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,MAAM,aAAA,GACV,CAAA,MAAA,EAAS,MAAM,KAAA,EAAO,IAAA,IAAQ,MAAM,CAAA,4BAAA,CAAA,GACpC;AAAA,KACL,CAAA;AAAA,EACH;AACF;AAEO,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;AChEA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/editor/index.cjs

@@ -1,14 +1,14 @@
 'use strict';
 
-var chunkYQEBJG5H_cjs = require('../chunk-YQEBJG5H.cjs');
-require('../chunk-43CGBOVT.cjs');
-require('../chunk-DMNWPVVT.cjs');
+var chunkUWQUHP3T_cjs = require('../chunk-UWQUHP3T.cjs');
+require('../chunk-7RO6PKZ4.cjs');
+require('../chunk-MMOAH3EH.cjs');
 
 
 
 Object.defineProperty(exports, "createEditorClient", {
   enumerable: true,
-  get: function () { return chunkYQEBJG5H_cjs.createEditorClient; }
+  get: function () { return chunkUWQUHP3T_cjs.createEditorClient; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/editor/index.d.cts

@@ -1,6 +1,6 @@
-import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-CmdRXxqa.cjs';
-import { C as ClientInitOptions } from '../types-DqxZDbM1.cjs';
-import '../types-BbM5WDSR.cjs';
+import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-B-vmDlWB.cjs';
+import { C as ClientInitOptions } from '../types-UwuKN9Kx.cjs';
+import '../types-gcShAmmi.cjs';
 import 'qs';
 
 declare const createEditorClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {

package/dist/editor/index.d.ts

@@ -1,6 +1,6 @@
-import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-PG_v0QyH.js';
-import { C as ClientInitOptions } from '../types-DqxZDbM1.js';
-import '../types-BbM5WDSR.js';
+import { C as CreateSqlSessionBody, G as GetSqlSessionPath, a as GetSqlSessionsQuery, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, d as components, P as PostSqlRunQueryPath, e as PostSqlRunQueryBody, f as PostSqlTablePreviewPath, g as PostSqlTablePreviewBody, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, j as PostSqlSessionLoadPath, k as PostSqlSessionLoadBody, l as PostSqlSessionUnloadPath, m as PostSqlSessionUnloadBody } from '../types-DHXZZKb3.js';
+import { C as ClientInitOptions } from '../types-UwuKN9Kx.js';
+import '../types-gcShAmmi.js';
 import 'qs';
 
 declare const createEditorClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {

package/dist/editor/index.js

@@ -1,5 +1,5 @@
-export { createEditorClient } from '../chunk-L63UYWJG.js';
-import '../chunk-L4R66Q6S.js';
-import '../chunk-3B3GOGAL.js';
+export { createEditorClient } from '../chunk-77LILJYX.js';
+import '../chunk-EDX5D6UY.js';
+import '../chunk-XHDYLUM4.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/editor/types.d.cts

@@ -1,2 +1,2 @@
-import '../types-BbM5WDSR.cjs';
-export { C as CreateSqlSessionBody, G as GetSqlSessionPath, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, a as GetSqlSessionsQuery, e as PostSqlRunQueryBody, P as PostSqlRunQueryPath, k as PostSqlSessionLoadBody, j as PostSqlSessionLoadPath, m as PostSqlSessionUnloadBody, l as PostSqlSessionUnloadPath, g as PostSqlTablePreviewBody, f as PostSqlTablePreviewPath, S as Session, n as SessionSchema, o as SessionSchemaBucket, p as SessionSchemaColumn, q as SessionSchemaDatabase, r as SessionSchemaTable, s as SqlSession } from '../types-CmdRXxqa.cjs';
+import '../types-gcShAmmi.cjs';
+export { C as CreateSqlSessionBody, G as GetSqlSessionPath, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, a as GetSqlSessionsQuery, e as PostSqlRunQueryBody, P as PostSqlRunQueryPath, k as PostSqlSessionLoadBody, j as PostSqlSessionLoadPath, m as PostSqlSessionUnloadBody, l as PostSqlSessionUnloadPath, g as PostSqlTablePreviewBody, f as PostSqlTablePreviewPath, S as Session, n as SessionSchema, o as SessionSchemaBucket, p as SessionSchemaColumn, q as SessionSchemaDatabase, r as SessionSchemaTable, s as SqlSession } from '../types-B-vmDlWB.cjs';

package/dist/editor/types.d.ts

@@ -1,2 +1,2 @@
-import '../types-BbM5WDSR.js';
-export { C as CreateSqlSessionBody, G as GetSqlSessionPath, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, a as GetSqlSessionsQuery, e as PostSqlRunQueryBody, P as PostSqlRunQueryPath, k as PostSqlSessionLoadBody, j as PostSqlSessionLoadPath, m as PostSqlSessionUnloadBody, l as PostSqlSessionUnloadPath, g as PostSqlTablePreviewBody, f as PostSqlTablePreviewPath, S as Session, n as SessionSchema, o as SessionSchemaBucket, p as SessionSchemaColumn, q as SessionSchemaDatabase, r as SessionSchemaTable, s as SqlSession } from '../types-PG_v0QyH.js';
+import '../types-gcShAmmi.js';
+export { C as CreateSqlSessionBody, G as GetSqlSessionPath, b as GetSqlSessionSchemaPath, c as GetSqlSessionSchemaQuery, h as GetSqlSessionTableDdlPath, i as GetSqlSessionTableDdlQuery, a as GetSqlSessionsQuery, e as PostSqlRunQueryBody, P as PostSqlRunQueryPath, k as PostSqlSessionLoadBody, j as PostSqlSessionLoadPath, m as PostSqlSessionUnloadBody, l as PostSqlSessionUnloadPath, g as PostSqlTablePreviewBody, f as PostSqlTablePreviewPath, S as Session, n as SessionSchema, o as SessionSchemaBucket, p as SessionSchemaColumn, q as SessionSchemaDatabase, r as SessionSchemaTable, s as SqlSession } from '../types-DHXZZKb3.js';

package/dist/encryption/index.cjs

@@ -1,13 +1,13 @@
 'use strict';
 
-var chunkCCC6I32C_cjs = require('../chunk-CCC6I32C.cjs');
-require('../chunk-DMNWPVVT.cjs');
+var chunkBR6WZE3O_cjs = require('../chunk-BR6WZE3O.cjs');
+require('../chunk-MMOAH3EH.cjs');
 
 
 
 Object.defineProperty(exports, "createEncryptionClient", {
   enumerable: true,
-  get: function () { return chunkCCC6I32C_cjs.createEncryptionClient; }
+  get: function () { return chunkBR6WZE3O_cjs.createEncryptionClient; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map