@keboola/api-client 25.0.0 → 29.0.0

package/dist/configurations-Byt59bIa.js

@@ -0,0 +1,726 @@
+import { t as isPlainObject } from "./isPlainObject-LYW-03uB.js";
+import { o as assertCanUpdateConfiguration, r as assertCanCreateConfiguration } from "./configurations-iCbhe0tb.js";
+import { t as ComponentId } from "./componentId-vJz-kWs6.js";
+import { z } from "zod";
+//#region src/utils/isEmptyDeep.ts
+/**
+* Is `value` "deeply empty" — i.e. carries no leaf data? `null`/`undefined`, `{}`, `[]`, and
+* nested structures whose every leaf is itself empty (e.g. `{ parameters: {} }`) are empty.
+* Any present primitive (string, number, boolean — including `''`) counts as content.
+*
+* Used to skip a pointless encryption round-trip when a validated configuration has nothing
+* to encrypt.
+*/
+const isEmptyDeep = (value) => {
+	if (value == null) return true;
+	if (Array.isArray(value)) return value.every(isEmptyDeep);
+	if (isPlainObject(value)) return Object.values(value).every(isEmptyDeep);
+	return false;
+};
+//#endregion
+//#region src/utils/schemaGuidedMerge.ts
+/** Strip optional/nullable/default wrappers to reach the structural schema node. */
+const unwrap = (schema) => schema instanceof z.ZodOptional || schema instanceof z.ZodNullable || schema instanceof z.ZodDefault ? unwrap(schema.unwrap()) : schema;
+/**
+* Merge `patch` into `base`, guided by `schema`: descend only through object schemas, merging
+* key-by-key. At every non-object node — a `z.union` (e.g. Snowflake's password|keypair auth),
+* an array, or a primitive — the patch REPLACES the base wholesale. That replace is what lets an
+* update *delete* keys the additive `deepMerge` cannot: switching a credential union to the other
+* variant drops the abandoned variant's secret, because the entire union subtree is swapped.
+*
+* Consequence: a union (or array) subtree is all-or-nothing — the caller must send the complete
+* block, since a partial patch replaces (and so loses) the omitted siblings.
+*
+* Object keys present only in `base` (e.g. `storage`, `processors`, anything the schema omits) are
+* preserved at every level; `undefined` patch values are skipped. Assumes `patch` is already
+* schema-validated (so every object-valued patch key has a matching schema node). Pure — neither
+* argument is mutated.
+*/
+const schemaGuidedMerge = (schema, base, patch) => {
+	const node = unwrap(schema);
+	if (!(node instanceof z.ZodObject) || !isPlainObject(base)) return patch;
+	const out = { ...base };
+	for (const [key, value] of Object.entries(patch)) {
+		if (value === void 0) continue;
+		const child = node.shape[key];
+		const current = out[key];
+		out[key] = child && isPlainObject(current) && isPlainObject(value) ? schemaGuidedMerge(child, current, value) : value;
+	}
+	return out;
+};
+//#endregion
+//#region src/sdks/configurations/schemas/appDataGatewaySchema.ts
+/**
+* `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake
+* workspace, so the config carries no credentials: just the id of the workspace it runs
+* against, stored at `parameters.db.workspaceId`.
+*/
+const appDataGatewaySchema = z.object({ parameters: z.object({ db: z.object({ workspaceId: z.number() }) }) });
+//#endregion
+//#region src/sdks/configurations/schemas/common/dbConfig.ts
+/** Wrap a `parameters.db` credential schema into the full component config shape. */
+const dbConfig = (db) => z.object({ parameters: z.object({ db }) });
+//#endregion
+//#region src/sdks/configurations/schemas/common/dbConnection.ts
+/**
+* The credential fields shared by virtually every DB writer, stored at `parameters.db`.
+* Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and
+* override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use
+* the `#` prefix the encryption service recognizes.
+*/
+const dbConnectionSchema = z.object({
+	host: z.string().describe("Hostname"),
+	port: z.number().describe("Port"),
+	user: z.string().describe("Username"),
+	"#password": z.string().describe("Password"),
+	database: z.string().describe("Database Name")
+});
+//#endregion
+//#region src/sdks/configurations/schemas/common/forbidden.ts
+/**
+* Marks a field as "must be absent" in one arm of a mutually-exclusive union: `z.undefined()`
+* rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a
+* required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an
+* "exactly one of" union reject configs that set both keys — or neither — at runtime and in
+* the inferred type. Without it the arms would be open objects that silently strip the extra key.
+*/
+const forbidden = z.undefined().optional();
+//#endregion
+//#region src/sdks/configurations/schemas/common/oauthAuthorization.ts
+/**
+* The OAuth credential reference components store under a top-level `authorization` key. `id`
+* points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).
+* Shared by every OAuth-backed component (Google family, Facebook, …).
+*/
+const oauthAuthorizationSchema = z.object({ oauth_api: z.object({
+	id: z.string(),
+	version: z.number().optional()
+}) });
+//#endregion
+//#region src/sdks/configurations/schemas/common/sshTunnelSchema.ts
+const sshTunnelSchema = z.object({
+	enabled: z.boolean(),
+	sshHost: z.string().optional(),
+	user: z.string().optional(),
+	sshPort: z.number().optional(),
+	/** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */
+	passivePortRange: z.string().optional(),
+	keys: z.object({
+		public: z.string().optional(),
+		"#private": z.string().optional()
+	}).optional()
+});
+//#endregion
+//#region src/sdks/configurations/schemas/common/sslSchema.ts
+/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */
+const sslSchema = z.object({
+	enabled: z.boolean(),
+	cert: z.string().optional(),
+	"#key": z.string().optional(),
+	ca: z.string().optional(),
+	cipher: z.string().optional(),
+	verifyServerCert: z.boolean().optional()
+});
+//#endregion
+//#region src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts
+/**
+* `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a
+* key-pair (exactly one). The common fields are shared; each variant requires its own secret and
+* *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at
+* runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.
+*/
+const dwhMasterBase = z.object({
+	master_host: z.string(),
+	master_user: z.string(),
+	master_database: z.string(),
+	warehouse: z.string()
+});
+const appSnowflakeDwhManagerSchema = z.object({ parameters: z.union([dwhMasterBase.extend({
+	"#master_password": z.string(),
+	"#master_private_key": forbidden
+}), dwhMasterBase.extend({
+	"#master_private_key": z.string(),
+	"#master_password": forbidden
+})]) });
+//#endregion
+//#region src/sdks/configurations/schemas/ex/exAwsS3Schema.ts
+/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */
+const awsCredentialsAuth = z.object({
+	loginType: z.literal("credentials"),
+	accessKeyId: z.string(),
+	"#secretAccessKey": z.string(),
+	accountId: forbidden,
+	roleName: forbidden
+}).loose();
+/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */
+const awsRoleAuth = z.object({
+	loginType: z.literal("role"),
+	accountId: z.string(),
+	roleName: z.string(),
+	accessKeyId: forbidden,
+	"#secretAccessKey": forbidden
+}).loose();
+/**
+* `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the
+* discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config
+* mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.
+* The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)
+* pass through.
+*/
+const exAwsS3Schema = z.object({ parameters: z.union([awsCredentialsAuth, awsRoleAuth]) }).loose();
+//#endregion
+//#region src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts
+/**
+* `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:
+* the connection block is validated, but component-managed `parameters` and top-level keys
+* (`storage`, `processors`) pass through rather than being stripped on create/update.
+*/
+const exAzureBlobSchema = z.object({ parameters: z.object({
+	account_name: z.string(),
+	"#account_key": z.string(),
+	container_name: z.string()
+}).loose() }).loose();
+//#endregion
+//#region src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts
+/**
+* `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both
+* levels are `.loose()`: the connection block is validated, but component-managed `parameters` and
+* top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.
+*/
+const exAzureDataLakeSchema = z.object({ parameters: z.object({
+	account_name: z.string(),
+	"#account_key": z.string(),
+	file_system: z.string()
+}).loose() }).loose();
+//#endregion
+//#region src/sdks/configurations/schemas/ex/exFtpSchema.ts
+/** Connection fields shared by both auth variants. */
+const ftpConnection = z.object({
+	host: z.string(),
+	port: z.number(),
+	connectionType: z.enum([
+		"FTP",
+		"FTPS",
+		"SFTP"
+	]),
+	username: z.string(),
+	ignorePassiveAddress: z.boolean().optional(),
+	ssh: sshTunnelSchema.optional(),
+	path: z.string().optional(),
+	onlyNewFiles: z.boolean().optional()
+});
+/** Password auth — forbids the private key so the variants stay exclusive. */
+const ftpPasswordAuth = ftpConnection.extend({
+	"#password": z.string(),
+	"#privateKey": forbidden
+}).loose();
+/** Private-key auth — forbids the password so the variants stay exclusive. */
+const ftpPrivateKeyAuth = ftpConnection.extend({
+	"#privateKey": z.string(),
+	"#password": forbidden
+}).loose();
+/**
+* `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password
+* OR a private key (exactly one): each variant requires its secret and *forbids the other*
+* (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via
+* an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale
+* by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer
+* object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.
+*/
+const exFtpSchema = z.object({ parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]) }).loose();
+//#endregion
+//#region src/sdks/configurations/schemas/ex/exHttpSchema.ts
+/**
+* `keboola.ex-http` — only the connection block is stable here. The request/job definitions are
+* component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys
+* and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather
+* than being stripped on create/update.
+*/
+const exHttpSchema = z.object({ parameters: z.object({
+	baseUrl: z.string(),
+	maxRedirects: z.number().optional()
+}).loose() }).loose();
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts
+/**
+* Default extractor credentials — host/port/user/#password/database + optional SSH tunnel, the
+* same `parameters.db` block the writers use. Tunnel support mirrors kbc-ui's `hasSshTunnel` /
+* `hasSsl` (`apps/kbc-ui/src/scripts/modules/ex-db-generic/helpers.ts`): most drivers accept an
+* SSH tunnel, only pgsql/mysql/mssql also accept SSL, and a handful accept neither. This shared
+* schema covers the generic SSH-only drivers: redshift, db2(-bata), mssql-cdata, impala,
+* hive(-csas, -csas-test). SSL-capable pgsql and the tunnel-less progress-db get their own
+* schema, as do drivers with extra/renamed fields.
+*/
+const exDbDefaultSchema = dbConfig(dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts
+/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */
+const exDbPgsqlSchema = dbConfig(dbConnectionSchema.extend({
+	ssh: sshTunnelSchema.optional(),
+	ssl: sslSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts
+/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */
+const exDbProgressSchema = dbConfig(dbConnectionSchema);
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts
+/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */
+const exDbMysqlSchema = dbConfig(dbConnectionSchema.extend({
+	database: z.string().optional(),
+	transactionIsolationLevel: z.enum([
+		"REPEATABLE READ",
+		"READ COMMITTED",
+		"READ UNCOMMITTED",
+		"SERIALIZABLE"
+	]).optional(),
+	networkCompression: z.boolean().optional(),
+	ssh: sshTunnelSchema.optional(),
+	ssl: sslSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts
+/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */
+const exDbMssqlSchema = dbConfig(dbConnectionSchema.extend({
+	port: z.number().optional(),
+	ssh: sshTunnelSchema.optional(),
+	ssl: sslSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts
+/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */
+const exDbOracleSchema = dbConfig(dbConnectionSchema.omit({
+	host: true,
+	port: true,
+	database: true
+}).extend({
+	host: z.string().optional(),
+	port: z.number().optional(),
+	database: z.string().optional(),
+	tnsnames: z.string().optional(),
+	connectThrough: z.boolean().optional(),
+	ssh: sshTunnelSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts
+/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */
+const exDbFirebirdSchema = dbConfig(z.object({
+	dbname: z.string(),
+	user: z.string(),
+	"#password": z.string()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exTeradataSchema.ts
+/** `keboola.ex-teradata` — shared base with optional `database`. */
+const exTeradataSchema = dbConfig(dbConnectionSchema.extend({ database: z.string().optional() }));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts
+/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */
+const exDbInformixSchema = dbConfig(dbConnectionSchema.extend({
+	serverName: z.string(),
+	protocol: z.enum(["onsoctcp", "onsocssl"]),
+	dbLocale: z.string().optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts
+/**
+* `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common
+* fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires
+* its own secret and forbids the other, so a config carrying both — or neither — is rejected at
+* runtime and at the type level.
+*/
+const snowflakeCommon$1 = dbConnectionSchema.omit({ "#password": true }).extend({
+	schema: z.string().optional(),
+	warehouse: z.string().optional()
+});
+const exDbSnowflakeSchema = dbConfig(z.union([snowflakeCommon$1.extend({
+	"#password": z.string(),
+	"#privateKey": forbidden
+}), snowflakeCommon$1.extend({
+	"#privateKey": z.string(),
+	"#password": forbidden
+})]));
+//#endregion
+//#region src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts
+/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */
+const exDbNetsuiteSchema = dbConfig(z.object({
+	accountId: z.string(),
+	roleId: z.string(),
+	user: z.string(),
+	"#password": z.string()
+}));
+/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */
+const exKdsNetsuiteSchema = dbConfig(z.object({
+	host: z.string(),
+	port: z.number(),
+	server_data_source: z.enum(["NetSuite.com", "NetSuite2.com"]),
+	account_id: z.string(),
+	role_id: z.string(),
+	user: z.string(),
+	"#password": z.string()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/gooddataWriterSchema.ts
+/**
+* A single exported column. `type` is always present and drives which of the other fields the
+* UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for
+* LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and
+* `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a
+* given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter
+* (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).
+*/
+const gooddataColumn = z.object({
+	type: z.enum([
+		"ATTRIBUTE",
+		"CONNECTION_POINT",
+		"DATE",
+		"FACT",
+		"HYPERLINK",
+		"LABEL",
+		"REFERENCE",
+		"IGNORE"
+	]),
+	id: z.string().optional(),
+	title: z.string().optional(),
+	dataType: z.enum([
+		"BIGINT",
+		"DATE",
+		"DECIMAL",
+		"INT",
+		"VARCHAR"
+	]).optional(),
+	dataTypeSize: z.string().optional(),
+	reference: z.string().optional(),
+	schemaReference: z.string().optional(),
+	sortLabel: z.string().optional(),
+	sortOrder: z.enum(["ASC", "DESC"]).optional(),
+	format: z.string().optional(),
+	dateDimension: z.string().optional(),
+	identifier: z.string().optional(),
+	identifierLabel: z.string().optional(),
+	identifierSortLabel: z.string().optional()
+});
+/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an
+*  optional `disabled` flag toggled when export is switched off. */
+const gooddataTable = z.object({
+	title: z.string(),
+	disabled: z.boolean().optional(),
+	identifier: z.string().optional(),
+	columns: z.record(z.string(), gooddataColumn)
+});
+/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /
+*  a custom template id). */
+const gooddataDimension = z.object({
+	template: z.string(),
+	includeTime: z.boolean().optional(),
+	identifier: z.string().optional()
+});
+/**
+* `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:
+* `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are
+* optional — a fresh config has credentials before any table/dimension is mapped — and must be
+* declared: the registry validates create/update input with a deep-partial that strips keys
+* absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before
+* it's stored.
+*/
+const gooddataWriterSchema = z.object({ parameters: z.object({
+	project: z.object({
+		pid: z.string(),
+		backendUrl: z.string().optional()
+	}),
+	user: z.object({
+		login: z.string(),
+		"#password": z.string()
+	}),
+	loadOnly: z.boolean().optional(),
+	multiLoad: z.boolean().optional(),
+	tables: z.record(z.string(), gooddataTable).optional(),
+	dimensions: z.record(z.string(), gooddataDimension).optional()
+}) });
+//#endregion
+//#region src/sdks/configurations/schemas/googleAdsSchema.ts
+/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */
+const exGoogleAdsSchema = z.object({
+	authorization: oauthAuthorizationSchema,
+	parameters: z.object({
+		customerId: z.array(z.string()),
+		onlyEnabledCustomers: z.boolean().optional(),
+		getAccountChildren: z.boolean().optional()
+	})
+});
+//#endregion
+//#region src/sdks/configurations/schemas/schedulerSchema.ts
+/**
+* `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the
+* writer configs, scheduler state lives at the top level (no `parameters` wrapper):
+* `schedule` holds the cron expression + timezone + enabled/disabled state, `target`
+* identifies which component configuration to run.
+*/
+const schedulerSchema = z.object({
+	schedule: z.object({
+		cronTab: z.string(),
+		timezone: z.string().optional(),
+		state: z.enum(["enabled", "disabled"])
+	}),
+	target: z.object({
+		componentId: z.string(),
+		configurationId: z.string(),
+		mode: z.literal("run")
+	})
+});
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts
+/**
+* Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.
+* Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);
+* writers that add or rename fields get their own schema.
+*/
+const wrDbDefaultSchema = dbConfig(dbConnectionSchema.extend({
+	ssh: sshTunnelSchema.optional(),
+	ssl: sslSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts
+/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */
+const wrDbPgsqlSchema = dbConfig(dbConnectionSchema.extend({
+	schema: z.string(),
+	ssh: sshTunnelSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts
+/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */
+const wrDbOracleSchema = dbConfig(dbConnectionSchema.extend({
+	schema: z.string().optional(),
+	ssh: sshTunnelSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts
+/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */
+const wrSynapseSchema = dbConfig(dbConnectionSchema.extend({ schema: z.string().optional() }));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts
+/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */
+const wrRedshiftSchema = dbConfig(dbConnectionSchema.extend({
+	schema: z.string(),
+	ssh: sshTunnelSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts
+/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */
+const wrDbMssqlSchema = dbConfig(dbConnectionSchema.extend({
+	instance: z.string().optional(),
+	tdsVersion: z.enum([
+		"7.0",
+		"7.1",
+		"7.2",
+		"7.3",
+		"7.4"
+	]),
+	ssh: sshTunnelSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts
+/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */
+const wrDbImpalaSchema = dbConfig(dbConnectionSchema.extend({
+	auth_mech: z.number(),
+	ssh: sshTunnelSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts
+/**
+* `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token
+* (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's
+* `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the
+* `#password` requirement once a `#refresh_token` is present.
+*/
+const exasolBase = z.object({
+	host: z.string(),
+	port: z.number(),
+	user: z.string(),
+	schema: z.string()
+});
+const wrExasolSchema = dbConfig(z.union([exasolBase.extend({
+	"#password": z.string(),
+	"#refresh_token": z.string().optional()
+}), exasolBase.extend({
+	"#refresh_token": z.string(),
+	"#password": z.string().optional()
+})]));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts
+/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */
+const wrFireboltSchema = dbConfig(z.object({
+	user: z.string(),
+	"#password": z.string(),
+	database: z.string(),
+	aws_api_key_id: z.string(),
+	"#aws_api_key_secret": z.string(),
+	staging_bucket: z.string(),
+	engine_name: z.string().optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts
+/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */
+const wrHiveCsasSchema = dbConfig(dbConnectionSchema.extend({
+	kinitPrincipal: z.string(),
+	servicePrincipal: z.string(),
+	config: z.string(),
+	"#keytab": z.string(),
+	ssh: sshTunnelSchema.optional()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts
+/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */
+const wrThoughtspotSchema = dbConfig(dbConnectionSchema.extend({
+	schema: z.string().optional(),
+	sshUser: z.string(),
+	"#sshPassword": z.string()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts
+/** `keboola.wr-sisense` — uses `username` (not `user`). */
+const wrSisenseSchema = dbConfig(z.object({
+	host: z.string(),
+	port: z.number(),
+	username: z.string(),
+	"#password": z.string(),
+	database: z.string()
+}));
+//#endregion
+//#region src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts
+/**
+* `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common
+* fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own
+* secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —
+* is rejected at runtime and at the type level. Without the `forbidden` half, the variants
+* would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).
+*/
+const snowflakeCommon = dbConnectionSchema.omit({ "#password": true }).extend({
+	schema: z.string(),
+	warehouse: z.string().optional()
+});
+const wrDbSnowflakeSchema = dbConfig(z.union([snowflakeCommon.extend({
+	"#password": z.string(),
+	"#privateKey": forbidden
+}), snowflakeCommon.extend({
+	"#privateKey": z.string(),
+	"#password": forbidden
+})]));
+//#endregion
+//#region src/sdks/configurations/createRegistry/createRegistry.ts
+/** Deep-partial any schema: objects → keys optional (recursing), unions → each member
+*  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's
+*  password | key-pair auth) still produce a partial input schema. */
+const partialize = (schema) => {
+	if (schema instanceof z.ZodObject) return deepPartial(schema);
+	if (schema instanceof z.ZodUnion) {
+		const options = schema.options.map(partialize);
+		return z.union(options);
+	}
+	return schema;
+};
+const deepPartial = (schema) => {
+	const shape = {};
+	for (const [key, value] of Object.entries(schema.shape)) {
+		const field = value;
+		const inner = field instanceof z.ZodOptional ? field.unwrap() : field;
+		shape[key] = partialize(inner);
+	}
+	const partial = z.object(shape).partial();
+	return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;
+};
+const createRegistry = () => {
+	const map = /* @__PURE__ */ new Map();
+	const registry = {
+		add(componentId, schema) {
+			map.set(componentId, schema);
+			return registry;
+		},
+		get(componentId) {
+			const schema = map.get(componentId);
+			if (!schema) throw new Error(`No configuration registered for component "${componentId}".`);
+			return {
+				schema,
+				inputSchema: deepPartial(schema)
+			};
+		},
+		has: (componentId) => map.has(componentId)
+	};
+	return registry;
+};
+//#endregion
+//#region src/sdks/configurations/registry.ts
+const registry = createRegistry().add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema).add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema).add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema).add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema).add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema).add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema).add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema).add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema).add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema).add(ComponentId.WR_SYNAPSE, wrSynapseSchema).add(ComponentId.WR_REDSHIFT, wrRedshiftSchema).add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema).add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema).add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema).add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema).add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema).add(ComponentId.WR_EXASOL, wrExasolSchema).add(ComponentId.WR_FIREBOLT, wrFireboltSchema).add(ComponentId.WR_SISENSE, wrSisenseSchema).add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema).add(ComponentId.SCHEDULER, schedulerSchema).add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema).add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema).add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema).add(ComponentId.EX_DB_DB2, exDbDefaultSchema).add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema).add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema).add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema).add(ComponentId.EX_DB_HIVE, exDbDefaultSchema).add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema).add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema).add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema).add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema).add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema).add(ComponentId.EX_DB_ORACLE, exDbOracleSchema).add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema).add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema).add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema).add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema).add(ComponentId.EX_TERADATA, exTeradataSchema).add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema).add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema).add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema).add(ComponentId.EX_HTTP, exHttpSchema).add(ComponentId.EX_FTP, exFtpSchema).add(ComponentId.EX_FTP_CSAS, exFtpSchema).add(ComponentId.EX_AWS_S3, exAwsS3Schema).add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema).add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);
+//#endregion
+//#region src/sdks/configurations/configurationsSdk.ts
+const toConfigResult = (data, schema) => {
+	const result = schema.safeParse(data.configuration);
+	return {
+		data,
+		runnable: result.success,
+		error: result.error
+	};
+};
+const createConfigurationSdk = ({ storageClient, encryptionClient, context }) => {
+	const _encrypt = async (componentId, data) => {
+		if (isEmptyDeep(data)) return data;
+		return encryptionClient.encryptScopedSecrets({
+			scope: "ProjectSecure",
+			componentId,
+			projectId: context.project.sapiToken.owner.id,
+			data
+		});
+	};
+	const getConfiguration = async (path) => {
+		const data = await storageClient.configurations.getConfiguration(path);
+		const def = registry.get(path.componentId);
+		return toConfigResult(data, def.schema);
+	};
+	const createConfiguration = async (input) => {
+		const { componentId, branchId, configuration, ...rest } = input;
+		assertCanCreateConfiguration(context.project.sapiToken, { isDevModeActive: context.defaultBranch.isDev(branchId) });
+		const def = registry.get(componentId);
+		const validated = def.inputSchema.parse(configuration);
+		const encrypted = await _encrypt(componentId, validated);
+		const data = await storageClient.configurations.createConfiguration({
+			...rest,
+			branchId,
+			componentId,
+			configuration: encrypted
+		});
+		return toConfigResult(data, def.schema);
+	};
+	const updateConfiguration = async (input) => {
+		const { componentId, branchId, configId, configuration, mode = "merge", ...rest } = input;
+		assertCanUpdateConfiguration(context.project.sapiToken, { isDevModeActive: context.defaultBranch.isDev(branchId) });
+		const def = registry.get(componentId);
+		const validated = def.inputSchema.parse(configuration);
+		const encrypted = await _encrypt(componentId, validated);
+		let newConfiguration = encrypted;
+		if (mode === "merge") {
+			const original = await storageClient.configurations.getConfiguration({
+				componentId,
+				branchId,
+				configId
+			});
+			newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);
+		}
+		const { configuration: data } = await storageClient.configurations.updateConfiguration({
+			...rest,
+			branchId,
+			componentId,
+			configId,
+			configuration: newConfiguration
+		});
+		return toConfigResult(data, def.schema);
+	};
+	return {
+		getConfiguration,
+		createConfiguration,
+		updateConfiguration
+	};
+};
+//#endregion
+export { schemaGuidedMerge as n, isEmptyDeep as r, createConfigurationSdk as t };
+
+//# sourceMappingURL=configurations-Byt59bIa.js.map