@keboola/api-client 27.0.0 → 31.0.0

package/dist/configurations-CujCwDcB.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configurations-CujCwDcB.cjs","names":["isPlainObject","z","isPlainObject","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","snowflakeCommon","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","ComponentId"],"sources":["../src/utils/isEmptyDeep.ts","../src/utils/schemaGuidedMerge.ts","../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../src/sdks/configurations/schemas/common/dbConfig.ts","../src/sdks/configurations/schemas/common/dbConnection.ts","../src/sdks/configurations/schemas/common/forbidden.ts","../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../src/sdks/configurations/schemas/common/sslSchema.ts","../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../src/sdks/configurations/schemas/googleAdsSchema.ts","../src/sdks/configurations/schemas/schedulerSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../src/sdks/configurations/createRegistry/createRegistry.ts","../src/sdks/configurations/registry.ts","../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { isPlainObject } from './isPlainObject';\n\n/**\n * Is `value` \"deeply empty\" — i.e. carries no leaf data? `null`/`undefined`, `{}`, `[]`, and\n * nested structures whose every leaf is itself empty (e.g. `{ parameters: {} }`) are empty.\n * Any present primitive (string, number, boolean — including `''`) counts as content.\n *\n * Used to skip a pointless encryption round-trip when a validated configuration has nothing\n * to encrypt.\n */\nexport const isEmptyDeep = (value: unknown): boolean => {\n  if (value == null) return true;\n  if (Array.isArray(value)) return value.every(isEmptyDeep);\n  if (isPlainObject(value)) return Object.values(value).every(isEmptyDeep);\n  return false;\n};\n","import { z } from 'zod';\n\nimport { isPlainObject } from './isPlainObject';\n\n/** Strip optional/nullable/default wrappers to reach the structural schema node. */\nconst unwrap = (schema: z.core.$ZodType): z.core.$ZodType =>\n  schema instanceof z.ZodOptional ||\n  schema instanceof z.ZodNullable ||\n  schema instanceof z.ZodDefault\n    ? unwrap(schema.unwrap())\n    : schema;\n\n/**\n * Merge `patch` into `base`, guided by `schema`: descend only through object schemas, merging\n * key-by-key. At every non-object node — a `z.union` (e.g. Snowflake's password|keypair auth),\n * an array, or a primitive — the patch REPLACES the base wholesale. That replace is what lets an\n * update *delete* keys the additive `deepMerge` cannot: switching a credential union to the other\n * variant drops the abandoned variant's secret, because the entire union subtree is swapped.\n *\n * Consequence: a union (or array) subtree is all-or-nothing — the caller must send the complete\n * block, since a partial patch replaces (and so loses) the omitted siblings.\n *\n * Object keys present only in `base` (e.g. `storage`, `processors`, anything the schema omits) are\n * preserved at every level; `undefined` patch values are skipped. Assumes `patch` is already\n * schema-validated (so every object-valued patch key has a matching schema node). Pure — neither\n * argument is mutated.\n */\nexport const schemaGuidedMerge = <T extends Record<string, unknown>>(\n  schema: z.core.$ZodType,\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const node = unwrap(schema);\n  if (!(node instanceof z.ZodObject) || !isPlainObject(base)) return patch as T;\n\n  const out: Record<string, unknown> = { ...base };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const child = node.shape[key];\n    const current = out[key];\n    out[key] =\n      child && isPlainObject(current) && isPlainObject(value)\n        ? schemaGuidedMerge(child, current, value)\n        : value;\n  }\n\n  return out as T;\n};\n","import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials — host/port/user/#password/database + optional SSH tunnel, the\n * same `parameters.db` block the writers use. Tunnel support mirrors kbc-ui's `hasSshTunnel` /\n * `hasSsl` (`apps/kbc-ui/src/scripts/modules/ex-db-generic/helpers.ts`): most drivers accept an\n * SSH tunnel, only pgsql/mysql/mssql also accept SSL, and a handful accept neither. This shared\n * schema covers the generic SSH-only drivers: redshift, db2(-bata), mssql-cdata, impala,\n * hive(-csas, -csas-test). SSL-capable pgsql and the tunnel-less progress-db get their own\n * schema, as do drivers with extra/renamed fields.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { createDefaultBranch } from '../../domain/defaultBranch';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — schema-guided deep merge: object fields patch individually, while a\n *   credential union or array subtree is replaced wholesale (so switching auth variants deletes\n *   the abandoned secret). Untouched leaves and out-of-schema keys are preserved. Reads the\n *   current config first to merge onto.\n * - `'replace'` — store exactly what the caller sends (after validation + encryption); no read,\n *   no merge. Completeness is on the caller — any field or sibling key (e.g. `storage`) it omits\n *   is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,eAAe,UAA4B;CACtD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,MAAM,WAAW;CACxD,IAAIA,sBAAAA,cAAc,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,WAAW;CACvE,OAAO;AACT;;;;ACVA,MAAM,UAAU,WACd,kBAAkBC,IAAAA,EAAE,eACpB,kBAAkBA,IAAAA,EAAE,eACpB,kBAAkBA,IAAAA,EAAE,aAChB,OAAO,OAAO,OAAO,CAAC,IACtB;;;;;;;;;;;;;;;;AAiBN,MAAa,qBACX,QACA,MACA,UACM;CACN,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,EAAE,gBAAgBA,IAAAA,EAAE,cAAc,CAACC,sBAAAA,cAAc,IAAI,GAAG,OAAO;CAEnE,MAAM,MAA+B,EAAE,GAAG,KAAK;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OACF,SAASA,sBAAAA,cAAc,OAAO,KAAKA,sBAAAA,cAAc,KAAK,IAClD,kBAAkB,OAAO,SAAS,KAAK,IACvC;CACR;CAEA,OAAO;AACT;;;;;;;;ACxCA,MAAa,uBAAuBC,IAAAA,EAAE,OAAO,EAC3C,YAAYA,IAAAA,EAAE,OAAO,EACnB,IAAIA,IAAAA,EAAE,OAAO,EACX,aAAaA,IAAAA,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;;ACVD,MAAa,YAAkC,OAC7CC,IAAAA,EAAE,OAAO,EAAE,YAAYA,IAAAA,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;;ACI3C,MAAa,qBAAqBC,IAAAA,EAAE,OAAO;CACzC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;;ACLD,MAAa,YAAYC,IAAAA,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;;ACFhD,MAAa,2BAA2BC,IAAAA,EAAE,OAAO,EAC/C,WAAWA,IAAAA,EAAE,OAAO;CAClB,IAAIA,IAAAA,EAAE,OAAO;CACb,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;;ACVD,MAAa,kBAAkBC,IAAAA,EAAE,OAAO;CACtC,SAASA,IAAAA,EAAE,QAAQ;CACnB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAMA,IAAAA,EACH,OAAO;EACN,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;ACZD,MAAa,YAAYC,IAAAA,EAAE,OAAO;CAChC,SAASA,IAAAA,EAAE,QAAQ;CACnB,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;;ACAD,MAAM,gBAAgBC,IAAAA,EAAE,OAAO;CAC7B,aAAaA,IAAAA,EAAE,OAAO;CACtB,aAAaA,IAAAA,EAAE,OAAO;CACtB,iBAAiBA,IAAAA,EAAE,OAAO;CAC1B,WAAWA,IAAAA,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+BA,IAAAA,EAAE,OAAO,EACnD,YAAYA,IAAAA,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoBA,IAAAA,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuBA,IAAAA,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;;ACfD,MAAM,qBAAqBC,IAAAA,EACxB,OAAO;CACN,WAAWA,IAAAA,EAAE,QAAQ,aAAa;CAClC,aAAaA,IAAAA,EAAE,OAAO;CACtB,oBAAoBA,IAAAA,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAcA,IAAAA,EACjB,OAAO;CACN,WAAWA,IAAAA,EAAE,QAAQ,MAAM;CAC3B,WAAWA,IAAAA,EAAE,OAAO;CACpB,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgBA,IAAAA,EAC1B,OAAO,EACN,YAAYA,IAAAA,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;;AChCT,MAAa,oBAAoBC,IAAAA,EAC9B,OAAO,EACN,YAAYA,IAAAA,EACT,OAAO;CACN,cAAcA,IAAAA,EAAE,OAAO;CACvB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,gBAAgBA,IAAAA,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;;ACVT,MAAa,wBAAwBC,IAAAA,EAClC,OAAO,EACN,YAAYA,IAAAA,EACT,OAAO;CACN,cAAcA,IAAAA,EAAE,OAAO;CACvB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;ACZT,MAAM,gBAAgBC,IAAAA,EAAE,OAAO;CAC7B,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,gBAAgBA,IAAAA,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAUA,IAAAA,EAAE,OAAO;CACnB,sBAAsBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAcA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAeA,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAcA,IAAAA,EACxB,OAAO,EACN,YAAYA,IAAAA,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;;AC/BT,MAAa,eAAeC,IAAAA,EACzB,OAAO,EACN,YAAYA,IAAAA,EAAE,OAAO;CAAE,SAASA,IAAAA,EAAE,OAAO;CAAG,cAAcA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;;;;;ACDT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2BA,IAAAA,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAMC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAMC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACTA,MAAa,qBAAqB,SAChCC,IAAAA,EAAE,OAAO;CAAE,QAAQA,IAAAA,EAAE,OAAO;CAAG,MAAMA,IAAAA,EAAE,OAAO;CAAG,aAAaA,IAAAA,EAAE,OAAO;AAAE,CAAC,CAC5E;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAYC,IAAAA,EAAE,OAAO;CACrB,UAAUA,IAAAA,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;;ACDA,MAAMC,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,MAAM,CACND,kBAAgB,OAAO;CAAE,aAAaC,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5ED,kBAAgB,OAAO;CAAE,eAAeC,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;ACdA,MAAa,qBAAqB,SAChCC,IAAAA,EAAE,OAAO;CACP,WAAWA,IAAAA,EAAE,OAAO;CACpB,QAAQA,IAAAA,EAAE,OAAO;CACjB,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,oBAAoBA,IAAAA,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAYA,IAAAA,EAAE,OAAO;CACrB,SAASA,IAAAA,EAAE,OAAO;CAClB,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;;ACfA,MAAM,iBAAiBC,IAAAA,EAAE,OAAO;CAC9B,MAAMA,IAAAA,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAUA,IAAAA,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAcA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAWA,IAAAA,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAeA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgBA,IAAAA,EAAE,OAAO;CAC7B,OAAOA,IAAAA,EAAE,OAAO;CAChB,UAAUA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAASA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoBA,IAAAA,EAAE,OAAO;CACjC,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAaA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuBA,IAAAA,EAAE,OAAO,EAC3C,YAAYA,IAAAA,EAAE,OAAO;CACnB,SAASA,IAAAA,EAAE,OAAO;EAAE,KAAKA,IAAAA,EAAE,OAAO;EAAG,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAMA,IAAAA,EAAE,OAAO;EAAE,OAAOA,IAAAA,EAAE,OAAO;EAAG,aAAaA,IAAAA,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAUA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAWA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAYA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;;ACjED,MAAa,oBAAoBC,IAAAA,EAAE,OAAO;CACxC,eAAe;CACf,YAAYA,IAAAA,EAAE,OAAO;EACnB,YAAYA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC;EAC9B,sBAAsBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,oBAAoBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;;ACJD,MAAa,kBAAkBC,IAAAA,EAAE,OAAO;CACtC,UAAUA,IAAAA,EAAE,OAAO;EACjB,SAASA,IAAAA,EAAE,OAAO;EAGlB,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAOA,IAAAA,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQA,IAAAA,EAAE,OAAO;EACf,aAAaA,IAAAA,EAAE,OAAO;EACtB,iBAAiBA,IAAAA,EAAE,OAAO;EAC1B,MAAMA,IAAAA,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAAA,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAWC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;;ACGA,MAAM,aAAaC,IAAAA,EAAE,OAAO;CAC1B,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,QAAQA,IAAAA,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5BA,IAAAA,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,kBAAkBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkBA,IAAAA,EAAE,OAAO;CAAG,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;;ACjBA,MAAa,mBAAmB,SAC9BC,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;CACtB,UAAUA,IAAAA,EAAE,OAAO;CACnB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,uBAAuBA,IAAAA,EAAE,OAAO;CAChC,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgBC,IAAAA,EAAE,OAAO;CACzB,kBAAkBA,IAAAA,EAAE,OAAO;CAC3B,QAAQA,IAAAA,EAAE,OAAO;CACjB,WAAWA,IAAAA,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAASA,IAAAA,EAAE,OAAO;CAClB,gBAAgBA,IAAAA,EAAE,OAAO;AAC3B,CAAC,CACH;;;;ACNA,MAAa,kBAAkB,SAC7BC,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAaA,IAAAA,EAAE,OAAO;CACtB,UAAUA,IAAAA,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAeA,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkBC,IAAAA,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkBA,IAAAA,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAOA,IAAAA,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiBA,IAAAA,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAUA,IAAAA,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAIC,oBAAAA,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAIA,oBAAAA,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAIA,oBAAAA,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAIA,oBAAAA,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAIA,oBAAAA,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAIA,oBAAAA,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAIA,oBAAAA,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAIA,oBAAAA,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAIA,oBAAAA,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAIA,oBAAAA,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAIA,oBAAAA,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAIA,oBAAAA,YAAY,SAAS,YAAY,CAAC,CACtC,IAAIA,oBAAAA,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAIA,oBAAAA,YAAY,aAAa,WAAW,CAAC,CACzC,IAAIA,oBAAAA,YAAY,WAAW,aAAa,CAAC,CACzC,IAAIA,oBAAAA,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAIA,oBAAAA,YAAY,6BAA6B,qBAAqB;;;AClErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,uBAAA,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,uBAAA,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}

package/dist/configurations-DCOJONZZ.cjs

@@ -0,0 +1,313 @@
+const require_adminRoles = require("./adminRoles-CO7J5qAy.cjs");
+//#region src/domain/permissions/errors.ts
+/**
+* @module domain/permissions/errors
+*
+* Stable error contract for permission denials.
+*
+* `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The
+* three public fields are part of the SDK's published contract — consumers
+* (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`
+* and surface `reason` in UI, so renames here are breaking changes.
+*
+* PII boundary on `subject`:
+*   `subject` is optional and intended for debugging hints only — admin id,
+*   role name, configuration id, branch id, etc. It MUST NOT carry the full
+*   `StorageToken`, raw tokens, secrets, or any value that could be logged or
+*   surfaced to a user without further redaction.
+*/
+var PermissionDeniedError = class extends Error {
+	action;
+	reason;
+	subject;
+	constructor({ action, reason, subject }) {
+		super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);
+		this.name = "PermissionDeniedError";
+		this.action = action;
+		this.reason = reason;
+		this.subject = subject;
+	}
+};
+//#endregion
+//#region src/domain/permissions/admin.ts
+const role = (token) => token.admin.role;
+const isAdmin = (token) => role(token) === require_adminRoles.AdminRole.Admin;
+const isAdminOrShare = (token) => role(token) === require_adminRoles.AdminRole.Admin || role(token) === require_adminRoles.AdminRole.Share;
+const isProductionManager = (token) => role(token) === require_adminRoles.AdminRole.ProductionManager;
+const isDeveloperOrReviewer = (token) => role(token) === require_adminRoles.AdminRole.Developer || role(token) === require_adminRoles.AdminRole.Reviewer;
+const isReadOnlyRole = (token) => role(token) === require_adminRoles.AdminRole.ReadOnly;
+/**
+* Whether a role string is a member of `AdminRole` at all — distinct from
+* whether it may do any particular thing. A role failing this check is not
+* "denied", it's *unrecognized*: either Storage started returning a role this
+* client has never heard of, or something upstream is sending garbage. Callers
+* that deny-by-default on every predicate here (the common case) still want to
+* know about this distinction, because it never shows up as a failed request —
+* a caller should log it loudly rather than treat it as routine.
+*/
+const isKnownAdminRole = (adminRole) => Object.values(require_adminRoles.AdminRole).includes(adminRole ?? "");
+/**
+* Whether an admin role may write Kai's **project-wide** settings (custom
+* instructions injected into every project member's system prompt).
+*
+* `admin` and `share` only. The value is a shared prompt-injection surface, so
+* changing it counts as project administration rather than project work:
+* `productionManager` and `guest` are read-only for project management in kbc-ui,
+* and `developer`/`reviewer` are denied because `agent_settings` is keyed by
+* `project_id` alone — editing it "inside a dev branch" writes production-visible
+* global config.
+*
+* An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist
+* would admit each new one silently with no test failing. Takes the raw role
+* string so a caller holding an unparsed `tokens.verify()` response can use it
+* without fabricating a `StorageToken`. AI-3671.
+*/
+const isKaiSettingsWriterRole = (adminRole) => {
+	switch (adminRole) {
+		case require_adminRoles.AdminRole.Admin:
+		case require_adminRoles.AdminRole.Share: return true;
+		default: return false;
+	}
+};
+/**
+* Whether this token may write Kai's project-wide settings. A limited
+* (non-master) token never may: it carries no project role at all, and its
+* `admin` block is absent despite the hand-authored type declaring it required
+* (AI-3593) — hence the optional chain.
+*/
+const canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
+const assertCanWriteKaiSettings = (token) => {
+	if (!canWriteKaiSettings(token)) throw new PermissionDeniedError({
+		action: "write-kai-settings",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
+	});
+};
+const assertCanAdmin = (token) => {
+	if (!isAdmin(token)) throw new PermissionDeniedError({
+		action: "admin",
+		reason: `role '${role(token)}' is not admin`
+	});
+};
+const assertCanAdminOrShare = (token) => {
+	if (!isAdminOrShare(token)) throw new PermissionDeniedError({
+		action: "admin-or-share",
+		reason: `role '${role(token)}' is not admin or share`
+	});
+};
+const assertCanProductionManage = (token) => {
+	if (!isProductionManager(token)) throw new PermissionDeniedError({
+		action: "production-manage",
+		reason: `role '${role(token)}' is not productionManager`
+	});
+};
+const assertCanDevelopOrReview = (token) => {
+	if (!isDeveloperOrReviewer(token)) throw new PermissionDeniedError({
+		action: "develop-or-review",
+		reason: `role '${role(token)}' is not developer or reviewer`
+	});
+};
+//#endregion
+//#region src/domain/permissions/configurations.ts
+const meetsBaseRule = (token, ctx) => ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);
+const baseDenialReason = (ctx) => ctx.isDevModeActive ? "dev branch requires developer or reviewer role" : "production requires productionManager role";
+const canCreateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+const canUpdateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+const canCopyConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+const canMigrateFromTemplate = (token, ctx) => meetsBaseRule(token, ctx);
+const canPurgeConfiguration = (token) => isAdmin(token);
+const canAssignFolder = (token, ctx) => meetsBaseRule(token, ctx);
+const assertCanCreateConfiguration = (token, ctx) => {
+	if (!canCreateConfiguration(token, ctx)) throw new PermissionDeniedError({
+		action: "create-configuration",
+		reason: baseDenialReason(ctx)
+	});
+};
+const assertCanUpdateConfiguration = (token, ctx) => {
+	if (!canUpdateConfiguration(token, ctx)) throw new PermissionDeniedError({
+		action: "update-configuration",
+		reason: baseDenialReason(ctx)
+	});
+};
+const assertCanCopyConfiguration = (token, ctx) => {
+	if (!canCopyConfiguration(token, ctx)) throw new PermissionDeniedError({
+		action: "copy-configuration",
+		reason: baseDenialReason(ctx)
+	});
+};
+const assertCanMigrateFromTemplate = (token, ctx) => {
+	if (!canMigrateFromTemplate(token, ctx)) throw new PermissionDeniedError({
+		action: "migrate-from-template",
+		reason: baseDenialReason(ctx)
+	});
+};
+const assertCanPurgeConfiguration = (token, ctx) => {
+	if (!canPurgeConfiguration(token, ctx)) throw new PermissionDeniedError({
+		action: "purge-configuration",
+		reason: "purge requires admin role"
+	});
+};
+const assertCanAssignFolder = (token, ctx) => {
+	if (!canAssignFolder(token, ctx)) throw new PermissionDeniedError({
+		action: "assign-folder",
+		reason: baseDenialReason(ctx)
+	});
+};
+//#endregion
+Object.defineProperty(exports, "PermissionDeniedError", {
+	enumerable: true,
+	get: function() {
+		return PermissionDeniedError;
+	}
+});
+Object.defineProperty(exports, "assertCanAdmin", {
+	enumerable: true,
+	get: function() {
+		return assertCanAdmin;
+	}
+});
+Object.defineProperty(exports, "assertCanAdminOrShare", {
+	enumerable: true,
+	get: function() {
+		return assertCanAdminOrShare;
+	}
+});
+Object.defineProperty(exports, "assertCanAssignFolder", {
+	enumerable: true,
+	get: function() {
+		return assertCanAssignFolder;
+	}
+});
+Object.defineProperty(exports, "assertCanCopyConfiguration", {
+	enumerable: true,
+	get: function() {
+		return assertCanCopyConfiguration;
+	}
+});
+Object.defineProperty(exports, "assertCanCreateConfiguration", {
+	enumerable: true,
+	get: function() {
+		return assertCanCreateConfiguration;
+	}
+});
+Object.defineProperty(exports, "assertCanDevelopOrReview", {
+	enumerable: true,
+	get: function() {
+		return assertCanDevelopOrReview;
+	}
+});
+Object.defineProperty(exports, "assertCanMigrateFromTemplate", {
+	enumerable: true,
+	get: function() {
+		return assertCanMigrateFromTemplate;
+	}
+});
+Object.defineProperty(exports, "assertCanProductionManage", {
+	enumerable: true,
+	get: function() {
+		return assertCanProductionManage;
+	}
+});
+Object.defineProperty(exports, "assertCanPurgeConfiguration", {
+	enumerable: true,
+	get: function() {
+		return assertCanPurgeConfiguration;
+	}
+});
+Object.defineProperty(exports, "assertCanUpdateConfiguration", {
+	enumerable: true,
+	get: function() {
+		return assertCanUpdateConfiguration;
+	}
+});
+Object.defineProperty(exports, "assertCanWriteKaiSettings", {
+	enumerable: true,
+	get: function() {
+		return assertCanWriteKaiSettings;
+	}
+});
+Object.defineProperty(exports, "canAssignFolder", {
+	enumerable: true,
+	get: function() {
+		return canAssignFolder;
+	}
+});
+Object.defineProperty(exports, "canCopyConfiguration", {
+	enumerable: true,
+	get: function() {
+		return canCopyConfiguration;
+	}
+});
+Object.defineProperty(exports, "canCreateConfiguration", {
+	enumerable: true,
+	get: function() {
+		return canCreateConfiguration;
+	}
+});
+Object.defineProperty(exports, "canMigrateFromTemplate", {
+	enumerable: true,
+	get: function() {
+		return canMigrateFromTemplate;
+	}
+});
+Object.defineProperty(exports, "canPurgeConfiguration", {
+	enumerable: true,
+	get: function() {
+		return canPurgeConfiguration;
+	}
+});
+Object.defineProperty(exports, "canUpdateConfiguration", {
+	enumerable: true,
+	get: function() {
+		return canUpdateConfiguration;
+	}
+});
+Object.defineProperty(exports, "canWriteKaiSettings", {
+	enumerable: true,
+	get: function() {
+		return canWriteKaiSettings;
+	}
+});
+Object.defineProperty(exports, "isAdmin", {
+	enumerable: true,
+	get: function() {
+		return isAdmin;
+	}
+});
+Object.defineProperty(exports, "isAdminOrShare", {
+	enumerable: true,
+	get: function() {
+		return isAdminOrShare;
+	}
+});
+Object.defineProperty(exports, "isDeveloperOrReviewer", {
+	enumerable: true,
+	get: function() {
+		return isDeveloperOrReviewer;
+	}
+});
+Object.defineProperty(exports, "isKaiSettingsWriterRole", {
+	enumerable: true,
+	get: function() {
+		return isKaiSettingsWriterRole;
+	}
+});
+Object.defineProperty(exports, "isKnownAdminRole", {
+	enumerable: true,
+	get: function() {
+		return isKnownAdminRole;
+	}
+});
+Object.defineProperty(exports, "isProductionManager", {
+	enumerable: true,
+	get: function() {
+		return isProductionManager;
+	}
+});
+Object.defineProperty(exports, "isReadOnlyRole", {
+	enumerable: true,
+	get: function() {
+		return isReadOnlyRole;
+	}
+});
+
+//# sourceMappingURL=configurations-DCOJONZZ.cjs.map

package/dist/configurations-DCOJONZZ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configurations-DCOJONZZ.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACfA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;;;;;AAW1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;;;;;;;;;AAkBjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;;AAQA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;AAEA,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;AChEA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/configurations-iCbhe0tb.js

@@ -0,0 +1,158 @@
+import { t as AdminRole } from "./adminRoles-B40yBcmq.js";
+//#region src/domain/permissions/errors.ts
+/**
+* @module domain/permissions/errors
+*
+* Stable error contract for permission denials.
+*
+* `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The
+* three public fields are part of the SDK's published contract — consumers
+* (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`
+* and surface `reason` in UI, so renames here are breaking changes.
+*
+* PII boundary on `subject`:
+*   `subject` is optional and intended for debugging hints only — admin id,
+*   role name, configuration id, branch id, etc. It MUST NOT carry the full
+*   `StorageToken`, raw tokens, secrets, or any value that could be logged or
+*   surfaced to a user without further redaction.
+*/
+var PermissionDeniedError = class extends Error {
+	action;
+	reason;
+	subject;
+	constructor({ action, reason, subject }) {
+		super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);
+		this.name = "PermissionDeniedError";
+		this.action = action;
+		this.reason = reason;
+		this.subject = subject;
+	}
+};
+//#endregion
+//#region src/domain/permissions/admin.ts
+const role = (token) => token.admin.role;
+const isAdmin = (token) => role(token) === AdminRole.Admin;
+const isAdminOrShare = (token) => role(token) === AdminRole.Admin || role(token) === AdminRole.Share;
+const isProductionManager = (token) => role(token) === AdminRole.ProductionManager;
+const isDeveloperOrReviewer = (token) => role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;
+const isReadOnlyRole = (token) => role(token) === AdminRole.ReadOnly;
+/**
+* Whether a role string is a member of `AdminRole` at all — distinct from
+* whether it may do any particular thing. A role failing this check is not
+* "denied", it's *unrecognized*: either Storage started returning a role this
+* client has never heard of, or something upstream is sending garbage. Callers
+* that deny-by-default on every predicate here (the common case) still want to
+* know about this distinction, because it never shows up as a failed request —
+* a caller should log it loudly rather than treat it as routine.
+*/
+const isKnownAdminRole = (adminRole) => Object.values(AdminRole).includes(adminRole ?? "");
+/**
+* Whether an admin role may write Kai's **project-wide** settings (custom
+* instructions injected into every project member's system prompt).
+*
+* `admin` and `share` only. The value is a shared prompt-injection surface, so
+* changing it counts as project administration rather than project work:
+* `productionManager` and `guest` are read-only for project management in kbc-ui,
+* and `developer`/`reviewer` are denied because `agent_settings` is keyed by
+* `project_id` alone — editing it "inside a dev branch" writes production-visible
+* global config.
+*
+* An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist
+* would admit each new one silently with no test failing. Takes the raw role
+* string so a caller holding an unparsed `tokens.verify()` response can use it
+* without fabricating a `StorageToken`. AI-3671.
+*/
+const isKaiSettingsWriterRole = (adminRole) => {
+	switch (adminRole) {
+		case AdminRole.Admin:
+		case AdminRole.Share: return true;
+		default: return false;
+	}
+};
+/**
+* Whether this token may write Kai's project-wide settings. A limited
+* (non-master) token never may: it carries no project role at all, and its
+* `admin` block is absent despite the hand-authored type declaring it required
+* (AI-3593) — hence the optional chain.
+*/
+const canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
+const assertCanWriteKaiSettings = (token) => {
+	if (!canWriteKaiSettings(token)) throw new PermissionDeniedError({
+		action: "write-kai-settings",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
+	});
+};
+const assertCanAdmin = (token) => {
+	if (!isAdmin(token)) throw new PermissionDeniedError({
+		action: "admin",
+		reason: `role '${role(token)}' is not admin`
+	});
+};
+const assertCanAdminOrShare = (token) => {
+	if (!isAdminOrShare(token)) throw new PermissionDeniedError({
+		action: "admin-or-share",
+		reason: `role '${role(token)}' is not admin or share`
+	});
+};
+const assertCanProductionManage = (token) => {
+	if (!isProductionManager(token)) throw new PermissionDeniedError({
+		action: "production-manage",
+		reason: `role '${role(token)}' is not productionManager`
+	});
+};
+const assertCanDevelopOrReview = (token) => {
+	if (!isDeveloperOrReviewer(token)) throw new PermissionDeniedError({
+		action: "develop-or-review",
+		reason: `role '${role(token)}' is not developer or reviewer`
+	});
+};
+//#endregion
+//#region src/domain/permissions/configurations.ts
+const meetsBaseRule = (token, ctx) => ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);
+const baseDenialReason = (ctx) => ctx.isDevModeActive ? "dev branch requires developer or reviewer role" : "production requires productionManager role";
+const canCreateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+const canUpdateConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+const canCopyConfiguration = (token, ctx) => meetsBaseRule(token, ctx);
+const canMigrateFromTemplate = (token, ctx) => meetsBaseRule(token, ctx);
+const canPurgeConfiguration = (token) => isAdmin(token);
+const canAssignFolder = (token, ctx) => meetsBaseRule(token, ctx);
+const assertCanCreateConfiguration = (token, ctx) => {
+	if (!canCreateConfiguration(token, ctx)) throw new PermissionDeniedError({
+		action: "create-configuration",
+		reason: baseDenialReason(ctx)
+	});
+};
+const assertCanUpdateConfiguration = (token, ctx) => {
+	if (!canUpdateConfiguration(token, ctx)) throw new PermissionDeniedError({
+		action: "update-configuration",
+		reason: baseDenialReason(ctx)
+	});
+};
+const assertCanCopyConfiguration = (token, ctx) => {
+	if (!canCopyConfiguration(token, ctx)) throw new PermissionDeniedError({
+		action: "copy-configuration",
+		reason: baseDenialReason(ctx)
+	});
+};
+const assertCanMigrateFromTemplate = (token, ctx) => {
+	if (!canMigrateFromTemplate(token, ctx)) throw new PermissionDeniedError({
+		action: "migrate-from-template",
+		reason: baseDenialReason(ctx)
+	});
+};
+const assertCanPurgeConfiguration = (token, ctx) => {
+	if (!canPurgeConfiguration(token, ctx)) throw new PermissionDeniedError({
+		action: "purge-configuration",
+		reason: "purge requires admin role"
+	});
+};
+const assertCanAssignFolder = (token, ctx) => {
+	if (!canAssignFolder(token, ctx)) throw new PermissionDeniedError({
+		action: "assign-folder",
+		reason: baseDenialReason(ctx)
+	});
+};
+//#endregion
+export { isKnownAdminRole as C, PermissionDeniedError as E, isKaiSettingsWriterRole as S, isReadOnlyRole as T, assertCanWriteKaiSettings as _, assertCanPurgeConfiguration as a, isAdminOrShare as b, canCopyConfiguration as c, canPurgeConfiguration as d, canUpdateConfiguration as f, assertCanProductionManage as g, assertCanDevelopOrReview as h, assertCanMigrateFromTemplate as i, canCreateConfiguration as l, assertCanAdminOrShare as m, assertCanCopyConfiguration as n, assertCanUpdateConfiguration as o, assertCanAdmin as p, assertCanCreateConfiguration as r, canAssignFolder as s, assertCanAssignFolder as t, canMigrateFromTemplate as u, canWriteKaiSettings as v, isProductionManager as w, isDeveloperOrReviewer as x, isAdmin as y };
+
+//# sourceMappingURL=configurations-iCbhe0tb.js.map