@keboola/api-client 3.0.1 → 5.0.0

package/dist/domain/permissions/index.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var chunkGF4XZK5N_cjs = require('../../chunk-GF4XZK5N.cjs');
+var chunk4I6TJWBG_cjs = require('../../chunk-4I6TJWBG.cjs');
 
 // src/domain/permissions/errors.ts
 var PermissionDeniedError = class extends Error {
@@ -17,18 +18,11 @@ var PermissionDeniedError = class extends Error {
 };
 
 // src/domain/permissions/admin.ts
-var AdminRoles = {
-  ADMIN: "admin",
-  SHARE: "share",
-  PRODUCTION_MANAGER: "productionManager",
-  DEVELOPER: "developer",
-  REVIEWER: "reviewer"
-};
 var role = (token) => token.admin.role;
-var isAdmin = (token) => role(token) === AdminRoles.ADMIN;
-var isAdminOrShare = (token) => role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;
-var isProductionManager = (token) => role(token) === AdminRoles.PRODUCTION_MANAGER;
-var isDeveloperOrReviewer = (token) => role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;
+var isAdmin = (token) => role(token) === chunk4I6TJWBG_cjs.AdminRoles.ADMIN;
+var isAdminOrShare = (token) => role(token) === chunk4I6TJWBG_cjs.AdminRoles.ADMIN || role(token) === chunk4I6TJWBG_cjs.AdminRoles.SHARE;
+var isProductionManager = (token) => role(token) === chunk4I6TJWBG_cjs.AdminRoles.PRODUCTION_MANAGER;
+var isDeveloperOrReviewer = (token) => role(token) === chunk4I6TJWBG_cjs.AdminRoles.DEVELOPER || role(token) === chunk4I6TJWBG_cjs.AdminRoles.REVIEWER;
 var assertCanAdmin = (token) => {
   if (!isAdmin(token)) {
     throw new PermissionDeniedError({

package/dist/domain/permissions/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;AChBA,IAAM,UAAA,GAAa;AAAA,EACjB,KAAA,EAAO,OAAA;AAAA,EACP,KAAA,EAAO,OAAA;AAAA,EACP,kBAAA,EAAoB,mBAAA;AAAA,EACpB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU;AACZ,CAAA;AAEA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACXA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { PermissionDeniedError } from './errors';\n\nconst AdminRoles = {\n  ADMIN: 'admin',\n  SHARE: 'share',\n  PRODUCTION_MANAGER: 'productionManager',\n  DEVELOPER: 'developer',\n  REVIEWER: 'reviewer',\n} as const;\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRoles"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,4BAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,4BAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRoles } from '../../constants';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/domain/permissions/index.d.cts

@@ -1,5 +1,6 @@
-import { S as StorageToken } from '../../types-DYMMsuU0.cjs';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-CYhB6rYN.cjs';
+import { S as StorageToken } from '../../types-DcL25GqY.cjs';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-C4K5Dzoy.cjs';
+import '../../types-jKnx7Tm_.cjs';
 
 /**
  * @module domain/permissions/errors

package/dist/domain/permissions/index.d.ts

@@ -1,5 +1,6 @@
-import { S as StorageToken } from '../../types-DYMMsuU0.js';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-Bzslbq4u.js';
+import { S as StorageToken } from '../../types-Dfw6a58i.js';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-COwNmNoc.js';
+import '../../types-jKnx7Tm_.js';
 
 /**
  * @module domain/permissions/errors

package/dist/domain/permissions/index.js

@@ -1,4 +1,5 @@
 export { hasAdminFeature, hasFeature } from '../../chunk-UABYNGBZ.js';
+import { AdminRoles } from '../../chunk-FL54VJ35.js';
 
 // src/domain/permissions/errors.ts
 var PermissionDeniedError = class extends Error {
@@ -15,13 +16,6 @@ var PermissionDeniedError = class extends Error {
 };
 
 // src/domain/permissions/admin.ts
-var AdminRoles = {
-  ADMIN: "admin",
-  SHARE: "share",
-  PRODUCTION_MANAGER: "productionManager",
-  DEVELOPER: "developer",
-  REVIEWER: "reviewer"
-};
 var role = (token) => token.admin.role;
 var isAdmin = (token) => role(token) === AdminRoles.ADMIN;
 var isAdminOrShare = (token) => role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;

package/dist/domain/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;AChBA,IAAM,UAAA,GAAa;AAAA,EACjB,KAAA,EAAO,OAAA;AAAA,EACP,KAAA,EAAO,OAAA;AAAA,EACP,kBAAA,EAAoB,mBAAA;AAAA,EACpB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU;AACZ,CAAA;AAEA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACXA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { PermissionDeniedError } from './errors';\n\nconst AdminRoles = {\n  ADMIN: 'admin',\n  SHARE: 'share',\n  PRODUCTION_MANAGER: 'productionManager',\n  DEVELOPER: 'developer',\n  REVIEWER: 'reviewer',\n} as const;\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRoles } from '../../constants';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/domain/storageTable/index.cjs

@@ -1,267 +1,16 @@
 'use strict';
 
-var zod = require('zod');
+var chunkUUY6LQT6_cjs = require('../../chunk-UUY6LQT6.cjs');
 
-// src/domain/storageTable/constants.ts
-var BRANCH_PREFIX_REGEX = /^(\d+)-(.+)$/;
-var LEGACY_BUCKET_PREFIX = "c-";
-var NAME_CHARSET_REGEX = /^[a-zA-Z0-9_-]+$/;
-var NAME_MAX_LENGTH = 96;
-var stageSchema = zod.z.enum(["in", "out"]);
-var nameSchema = zod.z.string().min(1, `Invalid name segment: must not be empty`).max(NAME_MAX_LENGTH, `Invalid name segment: exceeds ${NAME_MAX_LENGTH} characters`).refine((n) => !n.startsWith("_"), `Invalid name segment: must not start with an underscore`).regex(NAME_CHARSET_REGEX, `Invalid name segment: contains invalid characters`);
-var tableIdSchema = zod.z.string().refine(
-  (id) => id.split(".").length === 3,
-  'Invalid table id: must be in "{stage}.{bucket}.{table}" form'
-).transform((id) => id.split(".")).pipe(zod.z.tuple([stageSchema, nameSchema, nameSchema]));
-var bucketIdSchema = zod.z.string().refine(
-  (id) => id.split(".").length === 2,
-  'Invalid bucket id: must be in "{stage}.{bucket}" form'
-).transform((id) => id.split(".")).pipe(zod.z.tuple([stageSchema, nameSchema]));
 
-// src/domain/storageTable/codec.ts
-var createBucketCodec = ({
-  useLegacyBucketPrefix,
-  hasProtectedDefaultBranch,
-  hasStorageBranches
-}) => {
-  const decode = (name) => {
-    const hasLegacyPrefix = useLegacyBucketPrefix && name.startsWith(LEGACY_BUCKET_PREFIX);
-    const stripped = hasLegacyPrefix ? name.slice(LEGACY_BUCKET_PREFIX.length) : name;
-    if (hasProtectedDefaultBranch || hasStorageBranches)
-      return {
-        kind: "storage-branch",
-        baseName: stripped,
-        hasLegacyPrefix
-      };
-    const branchMatch = BRANCH_PREFIX_REGEX.exec(stripped);
-    return {
-      kind: "legacy",
-      hasLegacyPrefix,
-      branchId: branchMatch?.[1] ?? null,
-      baseName: branchMatch?.[2] ?? stripped
-    };
-  };
-  const encode = (bucket) => {
-    const stageResult = stageSchema.safeParse(bucket.stage);
-    if (!stageResult.success) return { success: false, error: stageResult.error };
-    const prefix = bucket.hasLegacyPrefix ? LEGACY_BUCKET_PREFIX : "";
-    const baseNameResult = nameSchema.safeParse(bucket.baseName);
-    if (!baseNameResult.success) return { success: false, error: baseNameResult.error };
-    if (bucket.kind === "storage-branch") {
-      const prefixedName2 = `${prefix}${bucket.baseName}`;
-      return {
-        success: true,
-        data: {
-          kind: "storage-branch",
-          id: `${bucket.stage}.${prefixedName2}`,
-          prefixedName: prefixedName2
-        }
-      };
-    }
-    const branch = bucket.branchId ? `${bucket.branchId}-` : "";
-    const branchedName = `${branch}${bucket.baseName}`;
-    const prefixedName = `${prefix}${branchedName}`;
-    return {
-      success: true,
-      data: {
-        kind: "legacy",
-        id: `${bucket.stage}.${prefixedName}`,
-        prefixedName,
-        branchedName
-      }
-    };
-  };
-  return { decode, encode };
-};
 
-// src/domain/storageTable/model.ts
-var createTableModel = (options) => {
-  const codec = createBucketCodec(options);
-  const decodeTable = (stage, bucketName, tableName) => ({
-    name: tableName,
-    bucket: { ...codec.decode(bucketName), stage }
-  });
-  const serializeBucketDisplayName = (bucket) => {
-    const result = codec.encode(bucket);
-    if (!result.success) throw result.error;
-    return result.data.kind === "storage-branch" ? bucket.baseName : result.data.branchedName;
-  };
-  const serializeBucketName = (bucket) => {
-    const result = codec.encode(bucket);
-    if (!result.success) throw result.error;
-    return result.data.prefixedName;
-  };
-  const serializeBucketId = (bucket) => {
-    const result = codec.encode(bucket);
-    if (!result.success) throw result.error;
-    return result.data.id;
-  };
-  const serializeTableId = (table) => `${serializeBucketId(table.bucket)}.${nameSchema.parse(table.name)}`;
-  const safeSerializeBucketName = (bucket) => {
-    const result = codec.encode(bucket);
-    if (!result.success) return null;
-    return result.data.prefixedName;
-  };
-  const safeSerializeBucketId = (bucket) => {
-    const result = codec.encode(bucket);
-    if (!result.success) return null;
-    return result.data.id;
-  };
-  const safeSerializeTableId = (table) => {
-    const bucketId = safeSerializeBucketId(table.bucket);
-    const tableNameResult = nameSchema.safeParse(table.name);
-    if (!bucketId || !tableNameResult.success) return null;
-    return `${bucketId}.${tableNameResult.data}`;
-  };
-  const parse = (id) => {
-    const data = tableIdSchema.parse(id);
-    return decodeTable(...data);
-  };
-  const safeParse = (id) => {
-    const parseResult = tableIdSchema.safeParse(id);
-    if (!parseResult.success) return null;
-    return decodeTable(...parseResult.data);
-  };
-  const parseBucket = (id) => {
-    const [stage, bucketName] = bucketIdSchema.parse(id);
-    return { ...codec.decode(bucketName), stage };
-  };
-  const safeParseBucket = (id) => {
-    const parseResult = bucketIdSchema.safeParse(id);
-    if (!parseResult.success) return null;
-    const [stage, bucketName] = parseResult.data;
-    return { ...codec.decode(bucketName), stage };
-  };
-  const createBucket = (input) => {
-    const decoded = codec.decode(input.name);
-    if (decoded.kind === "storage-branch")
-      return { ...decoded, stage: input.stage, hasLegacyPrefix: options.useLegacyBucketPrefix };
-    return {
-      ...decoded,
-      stage: input.stage,
-      hasLegacyPrefix: options.useLegacyBucketPrefix,
-      branchId: input.branchId ?? decoded.branchId
-    };
-  };
-  const createTable = (input) => ({
-    name: input.tableName,
-    bucket: createBucket({ stage: input.stage, name: input.bucketName, branchId: input.branchId })
-  });
-  return {
-    parse,
-    safeParse,
-    parseBucket,
-    safeParseBucket,
-    createTable,
-    createBucket,
-    serializeTableId,
-    serializeBucketId,
-    serializeBucketName,
-    serializeBucketDisplayName,
-    safeSerializeTableId,
-    safeSerializeBucketId,
-    safeSerializeBucketName
-  };
-};
-
-// src/domain/storageTable/utils.ts
-var webalize = (str) => {
-  const out = str.normalize("NFD").replace(/\p{M}/gu, "").toLowerCase().replace(/[^a-z0-9\-_]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").replace(/^_+/, "").slice(0, NAME_MAX_LENGTH).replace(/-+$/g, "");
-  if (out.length === 0) {
-    throw new Error(`Cannot webalize "${str}" into a valid name segment`);
-  }
-  return out;
-};
-
-// src/domain/storageTable/createStorageTable.ts
-var createStorageTable = (flags) => {
-  const model = createTableModel(flags);
-  const branchIt = (bucket, branchId) => bucket.kind !== "legacy" ? bucket : { ...bucket, branchId };
-  const unbranchIt = (bucket, branchId) => bucket.kind !== "legacy" || bucket.branchId !== branchId ? bucket : { ...bucket, branchId: null };
-  const make = (bucket, tableName) => {
-    const self = {
-      bucket,
-      name: tableName,
-      isInBranch: (branchId) => bucket.kind === "legacy" && bucket.branchId === branchId,
-      addBranch: (branchId) => {
-        if (branchId.length === 0) throw new Error("branchId is required");
-        return make(branchIt(bucket, branchId), tableName);
-      },
-      removeBranch: (branchId) => {
-        if (branchId.length === 0) throw new Error("branchId is required");
-        return make(unbranchIt(bucket, branchId), tableName);
-      },
-      addTableName: (name) => {
-        if (name.length === 0) throw new Error("tableName is required");
-        return make(bucket, name);
-      },
-      getBucketName: () => model.serializeBucketName(bucket),
-      getBucketDisplayName: () => model.serializeBucketDisplayName(bucket),
-      getBucketBaseName: () => bucket.baseName,
-      getTableName: () => {
-        if (tableName === null)
-          throw new Error(
-            "getTableName() requires a table name \u2014 instance was built via createBucket"
-          );
-        return tableName;
-      },
-      getBucketId: () => model.serializeBucketId(bucket),
-      getTableId: () => model.serializeTableId({ bucket, name: tableName ?? "" }),
-      getSafeBucketId: () => model.safeSerializeBucketId(bucket),
-      getSafeTableId: () => model.safeSerializeTableId({ bucket, name: tableName ?? "" })
-    };
-    return self;
-  };
-  const parse = (id) => {
-    const table = model.parse(id);
-    return make(table.bucket, table.name);
-  };
-  const safeParse = (id) => {
-    const table = model.safeParse(id);
-    return table ? make(table.bucket, table.name) : null;
-  };
-  const parseBucket = (id) => make(model.parseBucket(id), null);
-  const safeParseBucket = (id) => {
-    const bucket = model.safeParseBucket(id);
-    return bucket ? make(bucket, null) : null;
-  };
-  const createTable = (input) => {
-    const { bucket, name } = model.createTable(input);
-    return make(bucket, name);
-  };
-  const createBucket = (input) => make(model.createBucket(input), null);
-  return {
-    // generic
-    parse,
-    safeParse,
-    parseBucket,
-    safeParseBucket,
-    createTable,
-    createBucket,
-    // Business
-    createDefaultCsvImportTable: (configId) => {
-      const bucketName = flags.useLegacyBucketPrefix ? "c-csv-import" : webalize(`keboola.csv-import-${configId}`);
-      const tableName = flags.useLegacyBucketPrefix ? configId : "data";
-      return createTable({
-        stage: "in",
-        tableName,
-        bucketName
-      });
-    },
-    createDefaultBucket: ({ stage, name }) => createBucket({ stage, name: webalize(name) }),
-    safeCreateDefaultBucket: ({ stage, name }) => {
-      try {
-        return createBucket({ stage, name: webalize(name) });
-      } catch {
-        return null;
-      }
-    },
-    createDefaultConfigBucket: ({ stage, componentId, configId }) => createBucket({ stage, name: webalize(`${componentId}-${configId}`) }),
-    createDefaultConfigTable: ({ stage, componentId, configId, tableName }) => createTable({ stage, bucketName: webalize(`${componentId}-${configId}`), tableName })
-  };
-};
-
-exports.createStorageTable = createStorageTable;
-exports.createTableModel = createTableModel;
+Object.defineProperty(exports, "createStorageTable", {
+  enumerable: true,
+  get: function () { return chunkUUY6LQT6_cjs.createStorageTable; }
+});
+Object.defineProperty(exports, "createTableModel", {
+  enumerable: true,
+  get: function () { return chunkUUY6LQT6_cjs.createTableModel; }
+});
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/domain/storageTable/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/storageTable/constants.ts","../../../src/domain/storageTable/schema.ts","../../../src/domain/storageTable/codec.ts","../../../src/domain/storageTable/model.ts","../../../src/domain/storageTable/utils.ts","../../../src/domain/storageTable/createStorageTable.ts"],"names":["z","prefixedName"],"mappings":";;;;;AACO,IAAM,mBAAA,GAAsB,cAAA;AAE5B,IAAM,oBAAA,GAAuB,IAAA;AAE7B,IAAM,kBAAA,GAAqB,kBAAA;AAE3B,IAAM,eAAA,GAAkB,EAAA;ACHxB,IAAM,cAAcA,KAAA,CAAE,IAAA,CAAK,CAAC,IAAA,EAAM,KAAK,CAAC,CAAA;AAExC,IAAM,UAAA,GAAaA,KAAA,CACvB,MAAA,EAAO,CACP,GAAA,CAAI,CAAA,EAAG,CAAA,uCAAA,CAAyC,CAAA,CAChD,GAAA,CAAI,eAAA,EAAiB,CAAA,8BAAA,EAAiC,eAAe,CAAA,WAAA,CAAa,EAClF,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG,CAAA,uDAAA,CAAyD,CAAA,CAC3F,KAAA,CAAM,kBAAA,EAAoB,CAAA,iDAAA,CAAmD,CAAA;AAEzE,IAAM,aAAA,GAAgBA,KAAA,CAC1B,MAAA,EAAO,CACP,MAAA;AAAA,EACC,CAAC,EAAA,KAAO,EAAA,CAAG,KAAA,CAAM,GAAG,EAAE,MAAA,KAAW,CAAA;AAAA,EACjC;AACF,CAAA,CACC,UAAU,CAAC,EAAA,KAAO,EAAA,CAAG,KAAA,CAAM,GAAG,CAA6B,CAAA,CAC3D,IAAA,CAAKA,KAAA,CAAE,MAAM,CAAC,WAAA,EAAa,UAAA,EAAY,UAAU,CAAC,CAAC,CAAA;AAE/C,IAAM,cAAA,GAAiBA,KAAA,CAC3B,MAAA,EAAO,CACP,MAAA;AAAA,EACC,CAAC,EAAA,KAAO,EAAA,CAAG,KAAA,CAAM,GAAG,EAAE,MAAA,KAAW,CAAA;AAAA,EACjC;AACF,CAAA,CACC,SAAA,CAAU,CAAC,EAAA,KAAO,EAAA,CAAG,MAAM,GAAG,CAAqB,CAAA,CACnD,IAAA,CAAKA,MAAE,KAAA,CAAM,CAAC,WAAA,EAAa,UAAU,CAAC,CAAC,CAAA;;;ACCnC,IAAM,oBAAoB,CAAC;AAAA,EAChC,qBAAA;AAAA,EACA,yBAAA;AAAA,EACA;AACF,CAAA,KAAoB;AAClB,EAAA,MAAM,MAAA,GAAS,CAAC,IAAA,KAAmC;AACjD,IAAA,MAAM,eAAA,GAAkB,qBAAA,IAAyB,IAAA,CAAK,UAAA,CAAW,oBAAoB,CAAA;AACrF,IAAA,MAAM,WAAW,eAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,oBAAA,CAAqB,MAAM,CAAA,GAAI,IAAA;AAI7E,IAAA,IAAI,yBAAA,IAA6B,kBAAA;AAC/B,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,gBAAA;AAAA,QACN,QAAA,EAAU,QAAA;AAAA,QACV;AAAA,OACF;AAEF,IAAA,MAAM,WAAA,GAAc,mBAAA,CAAoB,IAAA,CAAK,QAAQ,CAAA;AAErD,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,eAAA;AAAA,MACA,QAAA,EAAU,WAAA,GAAc,CAAC,CAAA,IAAK,IAAA;AAAA,MAC9B,QAAA,EAAU,WAAA,GAAc,CAAC,CAAA,IAAK;AAAA,KAChC;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,CACb,MAAA,KAC2F;AAC3F,IAAA,MAAM,WAAA,GAAc,WAAA,CAAY,SAAA,CAAU,MAAA,CAAO,KAAK,CAAA;AACtD,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,WAAA,CAAY,KAAA,EAAM;AAE5E,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,eAAA,GAAkB,oBAAA,GAAuB,EAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,UAAA,CAAW,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAC3D,IAAA,IAAI,CAAC,eAAe,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,CAAe,KAAA,EAAM;AAElF,IAAA,IAAI,MAAA,CAAO,SAAS,gBAAA,EAAkB;AACpC,MAAA,MAAMC,aAAAA,GAAe,CAAA,EAAG,MAAM,CAAA,EAAG,OAAO,QAAQ,CAAA,CAAA;AAEhD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,IAAA;AAAA,QACT,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,gBAAA;AAAA,UACN,EAAA,EAAI,CAAA,EAAG,MAAA,CAAO,KAAK,IAAIA,aAAY,CAAA,CAAA;AAAA,UACnC,YAAA,EAAAA;AAAA;AACF,OACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,MAAA,CAAO,QAAA,GAAW,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA,CAAA,GAAM,EAAA;AACzD,IAAA,MAAM,YAAA,GAAe,CAAA,EAAG,MAAM,CAAA,EAAG,OAAO,QAAQ,CAAA,CAAA;AAChD,IAAA,MAAM,YAAA,GAAe,CAAA,EAAG,MAAM,CAAA,EAAG,YAAY,CAAA,CAAA;AAE7C,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM,QAAA;AAAA,QACN,EAAA,EAAI,CAAA,EAAG,MAAA,CAAO,KAAK,IAAI,YAAY,CAAA,CAAA;AAAA,QACnC,YAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B,CAAA;;;ACnDO,IAAM,gBAAA,GAAmB,CAAC,OAAA,KAAsC;AACrE,EAAA,MAAM,KAAA,GAAQ,kBAAkB,OAAO,CAAA;AAEvC,EAAA,MAAM,WAAA,GAAc,CAAC,KAAA,EAAoB,UAAA,EAAoB,SAAA,MAA8B;AAAA,IACzF,IAAA,EAAM,SAAA;AAAA,IACN,QAAQ,EAAE,GAAG,MAAM,MAAA,CAAO,UAAU,GAAG,KAAA;AAAM,GAC/C,CAAA;AAEA,EAAA,MAAM,0BAAA,GAA6B,CAAC,MAAA,KAAmB;AACrD,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AAClC,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,MAAA,CAAO,KAAA;AAGlC,IAAA,OAAO,OAAO,IAAA,CAAK,IAAA,KAAS,mBAAmB,MAAA,CAAO,QAAA,GAAW,OAAO,IAAA,CAAK,YAAA;AAAA,EAC/E,CAAA;AAEA,EAAA,MAAM,mBAAA,GAAsB,CAAC,MAAA,KAAmB;AAC9C,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AAClC,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,MAAA,CAAO,KAAA;AAClC,IAAA,OAAO,OAAO,IAAA,CAAK,YAAA;AAAA,EACrB,CAAA;AAEA,EAAA,MAAM,iBAAA,GAAoB,CAAC,MAAA,KAA6B;AACtD,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AAClC,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,MAAA,CAAO,KAAA;AAClC,IAAA,OAAO,OAAO,IAAA,CAAK,EAAA;AAAA,EACrB,CAAA;AAEA,EAAA,MAAM,gBAAA,GAAmB,CAAC,KAAA,KACxB,CAAA,EAAG,iBAAA,CAAkB,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,UAAA,CAAW,KAAA,CAAM,KAAA,CAAM,IAAI,CAAC,CAAA,CAAA;AAGpE,EAAA,MAAM,uBAAA,GAA0B,CAAC,MAAA,KAAsC;AACrE,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AAClC,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,IAAA;AAC5B,IAAA,OAAO,OAAO,IAAA,CAAK,YAAA;AAAA,EACrB,CAAA;AAEA,EAAA,MAAM,qBAAA,GAAwB,CAAC,MAAA,KAAoC;AACjE,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AAClC,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,OAAO,IAAA;AAC5B,IAAA,OAAO,OAAO,IAAA,CAAK,EAAA;AAAA,EACrB,CAAA;AAEA,EAAA,MAAM,oBAAA,GAAuB,CAAC,KAAA,KAAiC;AAC7D,IAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,KAAA,CAAM,MAAM,CAAA;AACnD,IAAA,MAAM,eAAA,GAAkB,UAAA,CAAW,SAAA,CAAU,KAAA,CAAM,IAAI,CAAA;AACvD,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,eAAA,CAAgB,SAAS,OAAO,IAAA;AAClD,IAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,eAAA,CAAgB,IAAI,CAAA,CAAA;AAAA,EAC5C,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,KAAe;AAC5B,IAAA,MAAM,IAAA,GAAO,aAAA,CAAc,KAAA,CAAM,EAAE,CAAA;AACnC,IAAA,OAAO,WAAA,CAAY,GAAG,IAAI,CAAA;AAAA,EAC5B,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,CAAC,EAAA,KAA6B;AAC9C,IAAA,MAAM,WAAA,GAAc,aAAA,CAAc,SAAA,CAAU,EAAE,CAAA;AAC9C,IAAA,IAAI,CAAC,WAAA,CAAY,OAAA,EAAS,OAAO,IAAA;AACjC,IAAA,OAAO,WAAA,CAAY,GAAG,WAAA,CAAY,IAAI,CAAA;AAAA,EACxC,CAAA;AAEA,EAAA,MAAM,WAAA,GAAc,CAAC,EAAA,KAAuB;AAC1C,IAAA,MAAM,CAAC,KAAA,EAAO,UAAU,CAAA,GAAI,cAAA,CAAe,MAAM,EAAE,CAAA;AACnD,IAAA,OAAO,EAAE,GAAG,KAAA,CAAM,MAAA,CAAO,UAAU,GAAG,KAAA,EAAM;AAAA,EAC9C,CAAA;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,EAAA,KAA8B;AACrD,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,SAAA,CAAU,EAAE,CAAA;AAC/C,IAAA,IAAI,CAAC,WAAA,CAAY,OAAA,EAAS,OAAO,IAAA;AACjC,IAAA,MAAM,CAAC,KAAA,EAAO,UAAU,CAAA,GAAI,WAAA,CAAY,IAAA;AACxC,IAAA,OAAO,EAAE,GAAG,KAAA,CAAM,MAAA,CAAO,UAAU,GAAG,KAAA,EAAM;AAAA,EAC9C,CAAA;AAEA,EAAA,MAAM,YAAA,GAA+B,CAAC,KAAA,KAAU;AAG9C,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAGvC,IAAA,IAAI,QAAQ,IAAA,KAAS,gBAAA;AACnB,MAAA,OAAO,EAAE,GAAG,OAAA,EAAS,KAAA,EAAO,MAAM,KAAA,EAAO,eAAA,EAAiB,QAAQ,qBAAA,EAAsB;AAE1F,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,OAAO,KAAA,CAAM,KAAA;AAAA,MACb,iBAAiB,OAAA,CAAQ,qBAAA;AAAA,MACzB,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,OAAA,CAAQ;AAAA,KACtC;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,WAAA,GAA6B,CAAC,KAAA,MAAW;AAAA,IAC7C,MAAM,KAAA,CAAM,SAAA;AAAA,IACZ,MAAA,EAAQ,YAAA,CAAa,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM,KAAA,CAAM,UAAA,EAAY,QAAA,EAAU,KAAA,CAAM,QAAA,EAAU;AAAA,GAC/F,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,eAAA;AAAA,IAEA,WAAA;AAAA,IACA,YAAA;AAAA,IAEA,gBAAA;AAAA,IACA,iBAAA;AAAA,IACA,mBAAA;AAAA,IACA,0BAAA;AAAA,IAEA,oBAAA;AAAA,IACA,qBAAA;AAAA,IACA;AAAA,GACF;AACF;;;AC9JO,IAAM,QAAA,GAAW,CAAC,GAAA,KAAwB;AAC/C,EAAA,MAAM,GAAA,GAAM,GAAA,CACT,SAAA,CAAU,KAAK,EACf,OAAA,CAAQ,SAAA,EAAW,EAAE,CAAA,CACrB,WAAA,EAAY,CACZ,OAAA,CAAQ,eAAA,EAAiB,GAAG,CAAA,CAC5B,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,UAAA,EAAY,EAAE,EACtB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,CACjB,MAAM,CAAA,EAAG,eAAe,CAAA,CACxB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAErB,EAAA,IAAI,GAAA,CAAI,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACtE;AAEA,EAAA,OAAO,GAAA;AACT,CAAA;;;AC2CO,IAAM,kBAAA,GAAqB,CAAC,KAAA,KAAsC;AACvE,EAAA,MAAM,KAAA,GAAQ,iBAAiB,KAAK,CAAA;AAEpC,EAAA,MAAM,QAAA,GAAW,CAAC,MAAA,EAAgB,QAAA,KAChC,MAAA,CAAO,IAAA,KAAS,QAAA,GAAW,MAAA,GAAS,EAAE,GAAG,MAAA,EAAQ,QAAA,EAAS;AAE5D,EAAA,MAAM,UAAA,GAAa,CAAC,MAAA,EAAgB,QAAA,KAClC,OAAO,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,QAAA,KAAa,WAC5C,MAAA,GACA,EAAE,GAAG,MAAA,EAAQ,UAAU,IAAA,EAAK;AAElC,EAAA,MAAM,IAAA,GAAO,CAAC,MAAA,EAAgB,SAAA,KAAsD;AAClF,IAAA,MAAM,IAAA,GAA6B;AAAA,MACjC,MAAA;AAAA,MACA,IAAA,EAAM,SAAA;AAAA,MACN,YAAY,CAAC,QAAA,KAAa,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA;AAAA,MAC1E,SAAA,EAAW,CAAC,QAAA,KAAa;AACvB,QAAA,IAAI,SAAS,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,MAAM,sBAAsB,CAAA;AACjE,QAAA,OAAO,IAAA,CAAK,QAAA,CAAS,MAAA,EAAQ,QAAQ,GAAG,SAAS,CAAA;AAAA,MACnD,CAAA;AAAA,MACA,YAAA,EAAc,CAAC,QAAA,KAAa;AAC1B,QAAA,IAAI,SAAS,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,MAAM,sBAAsB,CAAA;AACjE,QAAA,OAAO,IAAA,CAAK,UAAA,CAAW,MAAA,EAAQ,QAAQ,GAAG,SAAS,CAAA;AAAA,MACrD,CAAA;AAAA,MACA,YAAA,EAAc,CAAC,IAAA,KAAS;AACtB,QAAA,IAAI,KAAK,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,MAAM,uBAAuB,CAAA;AAC9D,QAAA,OAAO,IAAA,CAAK,QAAQ,IAAI,CAAA;AAAA,MAC1B,CAAA;AAAA,MAEA,aAAA,EAAe,MAAM,KAAA,CAAM,mBAAA,CAAoB,MAAM,CAAA;AAAA,MACrD,oBAAA,EAAsB,MAAM,KAAA,CAAM,0BAAA,CAA2B,MAAM,CAAA;AAAA,MACnE,iBAAA,EAAmB,MAAM,MAAA,CAAO,QAAA;AAAA,MAChC,cAAc,MAAM;AAClB,QAAA,IAAI,SAAA,KAAc,IAAA;AAChB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR;AAAA,WACF;AACF,QAAA,OAAO,SAAA;AAAA,MACT,CAAA;AAAA,MAEA,WAAA,EAAa,MAAM,KAAA,CAAM,iBAAA,CAAkB,MAAM,CAAA;AAAA,MACjD,UAAA,EAAY,MAAM,KAAA,CAAM,gBAAA,CAAiB,EAAE,MAAA,EAAQ,IAAA,EAAM,SAAA,IAAa,EAAA,EAAI,CAAA;AAAA,MAE1E,eAAA,EAAiB,MAAM,KAAA,CAAM,qBAAA,CAAsB,MAAM,CAAA;AAAA,MACzD,cAAA,EAAgB,MAAM,KAAA,CAAM,oBAAA,CAAqB,EAAE,MAAA,EAAQ,IAAA,EAAM,SAAA,IAAa,EAAA,EAAI;AAAA,KACpF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,EAAA,KAAgB;AAC7B,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,EAAE,CAAA;AAC5B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAAA,EACtC,CAAA;AACA,EAAA,MAAM,SAAA,GAAY,CAAC,EAAA,KAAgB;AACjC,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,SAAA,CAAU,EAAE,CAAA;AAChC,IAAA,OAAO,QAAQ,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA,GAAI,IAAA;AAAA,EAClD,CAAA;AAEA,EAAA,MAAM,WAAA,GAAc,CAAC,EAAA,KAAiB,IAAA,CAAK,MAAM,WAAA,CAAY,EAAE,GAAG,IAAI,CAAA;AAEtE,EAAA,MAAM,eAAA,GAAkB,CAAC,EAAA,KAAiB;AACxC,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,eAAA,CAAgB,EAAE,CAAA;AACvC,IAAA,OAAO,MAAA,GAAS,IAAA,CAAK,MAAA,EAAQ,IAAI,CAAA,GAAI,IAAA;AAAA,EACvC,CAAA;AAEA,EAAA,MAAM,WAAA,GAAc,CAAC,KAAA,KAAwC;AAC3D,IAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,KAAA,CAAM,YAAY,KAAK,CAAA;AAChD,IAAA,OAAO,IAAA,CAAK,QAAQ,IAAI,CAAA;AAAA,EAC1B,CAAA;AAEA,EAAA,MAAM,YAAA,GAAe,CAAC,KAAA,KACpB,IAAA,CAAK,MAAM,YAAA,CAAa,KAAK,GAAG,IAAI,CAAA;AAEtC,EAAA,OAAO;AAAA;AAAA,IAEL,KAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,eAAA;AAAA,IACA,WAAA;AAAA,IACA,YAAA;AAAA;AAAA,IAGA,2BAAA,EAA6B,CAAC,QAAA,KAAqB;AACjD,MAAA,MAAM,aAAa,KAAA,CAAM,qBAAA,GACrB,iBACA,QAAA,CAAS,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAC7C,MAAA,MAAM,SAAA,GAAY,KAAA,CAAM,qBAAA,GAAwB,QAAA,GAAW,MAAA;AAE3D,MAAA,OAAO,WAAA,CAAY;AAAA,QACjB,KAAA,EAAO,IAAA;AAAA,QACP,SAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,mBAAA,EAAqB,CAAC,EAAE,KAAA,EAAO,IAAA,EAAK,KAAM,YAAA,CAAa,EAAE,KAAA,EAAO,IAAA,EAAM,QAAA,CAAS,IAAI,GAAG,CAAA;AAAA,IACtF,uBAAA,EAAyB,CAAC,EAAE,KAAA,EAAO,MAAK,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,OAAO,aAAa,EAAE,KAAA,EAAO,MAAM,QAAA,CAAS,IAAI,GAAG,CAAA;AAAA,MACrD,CAAA,CAAA,MAAQ;AAEN,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IACA,2BAA2B,CAAC,EAAE,OAAO,WAAA,EAAa,QAAA,OAChD,YAAA,CAAa,EAAE,KAAA,EAAO,IAAA,EAAM,SAAS,CAAA,EAAG,WAAW,IAAI,QAAQ,CAAA,CAAE,GAAG,CAAA;AAAA,IACtE,wBAAA,EAA0B,CAAC,EAAE,KAAA,EAAO,aAAa,QAAA,EAAU,SAAA,OACzD,WAAA,CAAY,EAAE,OAAO,UAAA,EAAY,QAAA,CAAS,GAAG,WAAW,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA,EAAG,WAAW;AAAA,GACxF;AACF","file":"index.cjs","sourcesContent":["/** Matches a numeric dev-branch prefix on a legacy-prefix-stripped bucket name. */\nexport const BRANCH_PREFIX_REGEX = /^(\\d+)-(.+)$/;\n/** Historical `c-` prefix Storage prepends to legacy bucket names. */\nexport const LEGACY_BUCKET_PREFIX = 'c-';\n/** Characters allowed in a bucket or table name segment. */\nexport const NAME_CHARSET_REGEX = /^[a-zA-Z0-9_-]+$/;\n/** Max length of a bucket or table name segment. */\nexport const NAME_MAX_LENGTH = 96;\n","import { z } from 'zod';\n\nimport { NAME_CHARSET_REGEX, NAME_MAX_LENGTH } from './constants';\n\nexport const stageSchema = z.enum(['in', 'out']);\n\nexport const nameSchema = z\n  .string()\n  .min(1, `Invalid name segment: must not be empty`)\n  .max(NAME_MAX_LENGTH, `Invalid name segment: exceeds ${NAME_MAX_LENGTH} characters`)\n  .refine((n) => !n.startsWith('_'), `Invalid name segment: must not start with an underscore`)\n  .regex(NAME_CHARSET_REGEX, `Invalid name segment: contains invalid characters`);\n\nexport const tableIdSchema = z\n  .string()\n  .refine(\n    (id) => id.split('.').length === 3,\n    'Invalid table id: must be in \"{stage}.{bucket}.{table}\" form',\n  )\n  .transform((id) => id.split('.') as [string, string, string])\n  .pipe(z.tuple([stageSchema, nameSchema, nameSchema]));\n\nexport const bucketIdSchema = z\n  .string()\n  .refine(\n    (id) => id.split('.').length === 2,\n    'Invalid bucket id: must be in \"{stage}.{bucket}\" form',\n  )\n  .transform((id) => id.split('.') as [string, string])\n  .pipe(z.tuple([stageSchema, nameSchema]));\n","import type z from 'zod';\n\nimport { BRANCH_PREFIX_REGEX, LEGACY_BUCKET_PREFIX } from './constants';\nimport { nameSchema, stageSchema } from './schema';\nimport type {\n  Bucket,\n  BucketId,\n  BucketName,\n  LegacyBucket,\n  ModelOptions,\n  ParsedBucket,\n  StorageBranchBucket,\n} from './types';\n\ntype EncodedBucket =\n  | {\n      kind: 'legacy';\n      id: BucketId;\n      /** baseName + `{branchId}-` prefix, without `c-`. User-facing. e.g. `123-main` */\n      branchedName: BucketName;\n      /** baseName + branch + `c-` prefix. On-disk (Storage `bucket.name`). e.g. `c-123-main` */\n      prefixedName: BucketName;\n    }\n  | {\n      kind: 'storage-branch';\n      id: BucketId;\n      /** baseName + `c-` prefix when hasLegacyPrefix. On-disk (Storage `bucket.name`). e.g. `c-main` */\n      prefixedName: BucketName;\n    };\n\nexport const createBucketCodec = ({\n  useLegacyBucketPrefix,\n  hasProtectedDefaultBranch,\n  hasStorageBranches,\n}: ModelOptions) => {\n  const decode = (name: BucketName): ParsedBucket => {\n    const hasLegacyPrefix = useLegacyBucketPrefix && name.startsWith(LEGACY_BUCKET_PREFIX);\n    const stripped = hasLegacyPrefix ? name.slice(LEGACY_BUCKET_PREFIX.length) : name;\n\n    // Native branched storage: branch is BE-side (no `{branchId}-` decoration), but the\n    // legacy `c-` prefix is still applied independently of the branch model.\n    if (hasProtectedDefaultBranch || hasStorageBranches)\n      return {\n        kind: 'storage-branch',\n        baseName: stripped,\n        hasLegacyPrefix,\n      } satisfies StorageBranchBucket;\n\n    const branchMatch = BRANCH_PREFIX_REGEX.exec(stripped);\n\n    return {\n      kind: 'legacy',\n      hasLegacyPrefix,\n      branchId: branchMatch?.[1] ?? null,\n      baseName: branchMatch?.[2] ?? stripped,\n    } satisfies LegacyBucket;\n  };\n\n  const encode = (\n    bucket: Bucket,\n  ): { success: true; data: EncodedBucket } | { success: false; error: z.ZodError<string> } => {\n    const stageResult = stageSchema.safeParse(bucket.stage);\n    if (!stageResult.success) return { success: false, error: stageResult.error };\n\n    const prefix = bucket.hasLegacyPrefix ? LEGACY_BUCKET_PREFIX : '';\n    const baseNameResult = nameSchema.safeParse(bucket.baseName);\n    if (!baseNameResult.success) return { success: false, error: baseNameResult.error };\n\n    if (bucket.kind === 'storage-branch') {\n      const prefixedName = `${prefix}${bucket.baseName}`;\n\n      return {\n        success: true,\n        data: {\n          kind: 'storage-branch',\n          id: `${bucket.stage}.${prefixedName}` satisfies BucketId,\n          prefixedName,\n        },\n      };\n    }\n\n    const branch = bucket.branchId ? `${bucket.branchId}-` : '';\n    const branchedName = `${branch}${bucket.baseName}`;\n    const prefixedName = `${prefix}${branchedName}`;\n\n    return {\n      success: true,\n      data: {\n        kind: 'legacy',\n        id: `${bucket.stage}.${prefixedName}` satisfies BucketId,\n        prefixedName,\n        branchedName,\n      },\n    };\n  };\n\n  return { decode, encode };\n};\n","import { createBucketCodec } from './codec';\nimport { bucketIdSchema, nameSchema, tableIdSchema } from './schema';\nimport type {\n  Bucket,\n  BucketId,\n  BucketName,\n  BucketStage,\n  ModelOptions,\n  Table,\n  TableId,\n  TableName,\n} from './types';\n\nexport type CreateBucketFn = (input: {\n  stage: BucketStage;\n  name: BucketName;\n  branchId?: string | null;\n}) => Bucket;\n\nexport type CreateTableFn = (input: {\n  stage: BucketStage;\n  tableName: TableName;\n  bucketName: BucketName;\n  branchId?: string | null;\n}) => Table;\n\nexport type TableModel = {\n  parse(id: string): Table;\n  parseBucket(id: string): Bucket;\n\n  safeParse(id: string): Table | null;\n  safeParseBucket(id: string): Bucket | null;\n\n  serializeTableId(table: Table): TableId;\n  serializeBucketId(bucket: Bucket): BucketId;\n  serializeBucketName(bucket: Bucket): BucketName;\n  serializeBucketDisplayName(bucket: Bucket): BucketName;\n\n  safeSerializeTableId(table: Table): TableId | null;\n  safeSerializeBucketId(bucket: Bucket): BucketId | null;\n  safeSerializeBucketName(bucket: Bucket): BucketName | null;\n\n  createTable: CreateTableFn;\n  createBucket: CreateBucketFn;\n};\n\nexport const createTableModel = (options: ModelOptions): TableModel => {\n  const codec = createBucketCodec(options);\n\n  const decodeTable = (stage: BucketStage, bucketName: string, tableName: string): Table => ({\n    name: tableName,\n    bucket: { ...codec.decode(bucketName), stage },\n  });\n\n  const serializeBucketDisplayName = (bucket: Bucket) => {\n    const result = codec.encode(bucket);\n    if (!result.success) throw result.error;\n    // Storage-branch display name is just the bare baseName (no branch decoration to apply);\n    // encode is still called so the empty-name guard throws consistently.\n    return result.data.kind === 'storage-branch' ? bucket.baseName : result.data.branchedName;\n  };\n\n  const serializeBucketName = (bucket: Bucket) => {\n    const result = codec.encode(bucket);\n    if (!result.success) throw result.error;\n    return result.data.prefixedName;\n  };\n\n  const serializeBucketId = (bucket: Bucket): BucketId => {\n    const result = codec.encode(bucket);\n    if (!result.success) throw result.error;\n    return result.data.id;\n  };\n\n  const serializeTableId = (table: Table): TableId =>\n    `${serializeBucketId(table.bucket)}.${nameSchema.parse(table.name)}`;\n\n  // Safe counterparts: return null instead of throwing when a required segment is empty.\n  const safeSerializeBucketName = (bucket: Bucket): BucketName | null => {\n    const result = codec.encode(bucket);\n    if (!result.success) return null;\n    return result.data.prefixedName;\n  };\n\n  const safeSerializeBucketId = (bucket: Bucket): BucketId | null => {\n    const result = codec.encode(bucket);\n    if (!result.success) return null;\n    return result.data.id;\n  };\n\n  const safeSerializeTableId = (table: Table): TableId | null => {\n    const bucketId = safeSerializeBucketId(table.bucket);\n    const tableNameResult = nameSchema.safeParse(table.name);\n    if (!bucketId || !tableNameResult.success) return null;\n    return `${bucketId}.${tableNameResult.data}`;\n  };\n\n  const parse = (id: string) => {\n    const data = tableIdSchema.parse(id);\n    return decodeTable(...data);\n  };\n\n  const safeParse = (id: string): Table | null => {\n    const parseResult = tableIdSchema.safeParse(id);\n    if (!parseResult.success) return null;\n    return decodeTable(...parseResult.data);\n  };\n\n  const parseBucket = (id: string): Bucket => {\n    const [stage, bucketName] = bucketIdSchema.parse(id);\n    return { ...codec.decode(bucketName), stage };\n  };\n\n  const safeParseBucket = (id: string): Bucket | null => {\n    const parseResult = bucketIdSchema.safeParse(id);\n    if (!parseResult.success) return null;\n    const [stage, bucketName] = parseResult.data;\n    return { ...codec.decode(bucketName), stage };\n  };\n\n  const createBucket: CreateBucketFn = (input) => {\n    // Normalize the input the same way decoding does (strips a `c-`/`{branchId}-`\n    // a caller may have passed), so `baseName` always holds the bare name.\n    const decoded = codec.decode(input.name);\n    // On create the prefix is decided by the project flag — not by whether the\n    // input happened to start with `c-`. This applies to both bucket models.\n    if (decoded.kind === 'storage-branch')\n      return { ...decoded, stage: input.stage, hasLegacyPrefix: options.useLegacyBucketPrefix };\n\n    return {\n      ...decoded,\n      stage: input.stage,\n      hasLegacyPrefix: options.useLegacyBucketPrefix,\n      branchId: input.branchId ?? decoded.branchId,\n    };\n  };\n\n  const createTable: CreateTableFn = (input) => ({\n    name: input.tableName,\n    bucket: createBucket({ stage: input.stage, name: input.bucketName, branchId: input.branchId }),\n  });\n\n  return {\n    parse,\n    safeParse,\n    parseBucket,\n    safeParseBucket,\n\n    createTable,\n    createBucket,\n\n    serializeTableId,\n    serializeBucketId,\n    serializeBucketName,\n    serializeBucketDisplayName,\n\n    safeSerializeTableId,\n    safeSerializeBucketId,\n    safeSerializeBucketName,\n  };\n};\n","import { NAME_MAX_LENGTH } from './constants';\n\nexport const webalize = (str: string): string => {\n  const out = str\n    .normalize('NFD')\n    .replace(/\\p{M}/gu, '') // strip diacritics after NFD decomposition: á→a, č→c, ý→y …\n    .toLowerCase()\n    .replace(/[^a-z0-9\\-_]/g, '-')\n    .replace(/-+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .replace(/^_+/, '')\n    .slice(0, NAME_MAX_LENGTH)\n    .replace(/-+$/g, '');\n\n  if (out.length === 0) {\n    throw new Error(`Cannot webalize \"${str}\" into a valid name segment`);\n  }\n\n  return out;\n};\n","import { type CreateBucketFn, type CreateTableFn, createTableModel } from './model';\nimport type {\n  Bucket,\n  BucketId,\n  BucketName,\n  BucketStage,\n  ModelOptions,\n  TableId,\n  TableName,\n} from './types';\nimport { webalize } from './utils';\n\nexport type StorageTableInstance = {\n  readonly bucket: Bucket;\n  readonly name: TableName | null;\n  isInBranch(branchId: string): boolean;\n  addBranch(branchId: string): StorageTableInstance;\n  removeBranch(branchId: string): StorageTableInstance;\n  /** A new instance with the table name set (or replaced). */\n  addTableName(tableName: TableName): StorageTableInstance;\n  getBucketName(): BucketName;\n  /** Bucket name as shown to users: dev-branch prefix kept, legacy `c-` prefix always dropped. */\n  getBucketDisplayName(): BucketName;\n  /** Bare bucket name: no `c-` prefix, no dev-branch prefix (legacy `baseName`, or the canonical storage-branch name). */\n  getBucketBaseName(): BucketName;\n  getBucketId(): BucketId;\n  getSafeBucketId(): BucketId | null;\n  /** @throws when there is no table name (the instance was built via `createBucket`). */\n  getTableName(): TableName;\n  /** @throws when there is no table name (the instance was built via `createBucket`). */\n  getTableId(): TableId;\n  /** Null when there is no table name (built via `createBucket`) or a segment is empty. */\n  getSafeTableId(): TableId | null;\n};\n\nexport type StorageTable = {\n  parse(id: string): StorageTableInstance;\n  safeParse(id: string): StorageTableInstance | null;\n  /** Decode a bucket id (`{stage}.{bucket}`) into a bucket-only instance. */\n  parseBucket(id: string): StorageTableInstance;\n  safeParseBucket(id: string): StorageTableInstance | null;\n  createTable(input: Parameters<CreateTableFn>[0]): StorageTableInstance;\n  createBucket(input: Parameters<CreateBucketFn>[0]): StorageTableInstance;\n\n  // Business\n  createDefaultBucket(input: { stage: BucketStage; name: string }): StorageTableInstance;\n  /** Like `createDefaultBucket`, but returns null instead of throwing when the name sanitizes to an empty/invalid segment. */\n  safeCreateDefaultBucket(input: { stage: BucketStage; name: string }): StorageTableInstance | null;\n  createDefaultConfigBucket(input: {\n    stage: BucketStage;\n    componentId: string;\n    configId: string;\n  }): StorageTableInstance;\n  createDefaultConfigTable(input: {\n    stage: BucketStage;\n    componentId: string;\n    configId: string;\n    tableName: string;\n  }): StorageTableInstance;\n  createDefaultCsvImportTable(configId: string): StorageTableInstance;\n};\n\nexport const createStorageTable = (flags: ModelOptions): StorageTable => {\n  const model = createTableModel(flags);\n\n  const branchIt = (bucket: Bucket, branchId: string): Bucket =>\n    bucket.kind !== 'legacy' ? bucket : { ...bucket, branchId };\n\n  const unbranchIt = (bucket: Bucket, branchId: string): Bucket =>\n    bucket.kind !== 'legacy' || bucket.branchId !== branchId\n      ? bucket\n      : { ...bucket, branchId: null };\n\n  const make = (bucket: Bucket, tableName: TableName | null): StorageTableInstance => {\n    const self: StorageTableInstance = {\n      bucket,\n      name: tableName,\n      isInBranch: (branchId) => bucket.kind === 'legacy' && bucket.branchId === branchId,\n      addBranch: (branchId) => {\n        if (branchId.length === 0) throw new Error('branchId is required');\n        return make(branchIt(bucket, branchId), tableName);\n      },\n      removeBranch: (branchId) => {\n        if (branchId.length === 0) throw new Error('branchId is required');\n        return make(unbranchIt(bucket, branchId), tableName);\n      },\n      addTableName: (name) => {\n        if (name.length === 0) throw new Error('tableName is required');\n        return make(bucket, name);\n      },\n\n      getBucketName: () => model.serializeBucketName(bucket),\n      getBucketDisplayName: () => model.serializeBucketDisplayName(bucket),\n      getBucketBaseName: () => bucket.baseName,\n      getTableName: () => {\n        if (tableName === null)\n          throw new Error(\n            'getTableName() requires a table name — instance was built via createBucket',\n          );\n        return tableName;\n      },\n\n      getBucketId: () => model.serializeBucketId(bucket),\n      getTableId: () => model.serializeTableId({ bucket, name: tableName ?? '' }),\n\n      getSafeBucketId: () => model.safeSerializeBucketId(bucket),\n      getSafeTableId: () => model.safeSerializeTableId({ bucket, name: tableName ?? '' }),\n    };\n\n    return self;\n  };\n\n  const parse = (id: TableId) => {\n    const table = model.parse(id);\n    return make(table.bucket, table.name);\n  };\n  const safeParse = (id: TableId) => {\n    const table = model.safeParse(id);\n    return table ? make(table.bucket, table.name) : null;\n  };\n\n  const parseBucket = (id: BucketId) => make(model.parseBucket(id), null);\n\n  const safeParseBucket = (id: BucketId) => {\n    const bucket = model.safeParseBucket(id);\n    return bucket ? make(bucket, null) : null;\n  };\n\n  const createTable = (input: Parameters<CreateTableFn>[0]) => {\n    const { bucket, name } = model.createTable(input);\n    return make(bucket, name);\n  };\n\n  const createBucket = (input: Parameters<CreateBucketFn>[0]): StorageTableInstance =>\n    make(model.createBucket(input), null);\n\n  return {\n    // generic\n    parse,\n    safeParse,\n    parseBucket,\n    safeParseBucket,\n    createTable,\n    createBucket,\n\n    // Business\n    createDefaultCsvImportTable: (configId: string) => {\n      const bucketName = flags.useLegacyBucketPrefix\n        ? 'c-csv-import'\n        : webalize(`keboola.csv-import-${configId}`);\n      const tableName = flags.useLegacyBucketPrefix ? configId : 'data';\n\n      return createTable({\n        stage: 'in',\n        tableName,\n        bucketName,\n      });\n    },\n    createDefaultBucket: ({ stage, name }) => createBucket({ stage, name: webalize(name) }),\n    safeCreateDefaultBucket: ({ stage, name }) => {\n      try {\n        return createBucket({ stage, name: webalize(name) });\n      } catch {\n        // webalize() throws when the input sanitizes to an empty name segment — surface as null per the safe-* contract\n        return null;\n      }\n    },\n    createDefaultConfigBucket: ({ stage, componentId, configId }) =>\n      createBucket({ stage, name: webalize(`${componentId}-${configId}`) }),\n    createDefaultConfigTable: ({ stage, componentId, configId, tableName }) =>\n      createTable({ stage, bucketName: webalize(`${componentId}-${configId}`), tableName }),\n  };\n};\n"]}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.cjs"}