@keboola/api-client 31.0.0 → 33.0.0

package/dist/developerPortal/index.d.ts

@@ -1,3 +1,3 @@
-import { A as ResetPasswordConfirmInput, B as UserRequest, C as MfaConfirmInput, D as Profile, E as PaginationQuery, F as UpdateAppAsAdminInput, H as VendorListItem, I as UpdateAppInput, L as UpdateVendorAsAdminInput, M as ServiceIndex, N as SignUpInput, O as RefreshTokensResult, P as Stack, R as UpdateVendorInput, S as LoginSuccess, T as MfaSetupResult, U as Version, V as Vendor, _ as GetVendorUsersQuery, a as AppRepository, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, i as AppChange, j as ServiceAccount, k as RejectAppInput, l as CreateAppInput, m as DeveloperPortalError, n as AdminVendor, o as AppVendor, p as DeprecateAppInput, r as App, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput, v as IconUploadLink, w as MfaSetupInput, x as LoginResult, y as LoginChallenge, z as User } from "../types-BMsK6T5k.js";
-import { a as DeveloperPortalClient, c as createDeveloperPortalClient, i as isMfaChallengeResponse, n as authHeader, o as DeveloperPortalClientInitOptions, r as uploadAppIcon, s as DeveloperPortalFetchClient, t as DeveloperPortalTokens } from "../index-CYMAwD3E.js";
+import { A as ResetPasswordConfirmInput, B as UserRequest, C as MfaConfirmInput, D as Profile, E as PaginationQuery, F as UpdateAppAsAdminInput, H as VendorListItem, I as UpdateAppInput, L as UpdateVendorAsAdminInput, M as ServiceIndex, N as SignUpInput, O as RefreshTokensResult, P as Stack, R as UpdateVendorInput, S as LoginSuccess, T as MfaSetupResult, U as Version, V as Vendor, _ as GetVendorUsersQuery, a as AppRepository, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, i as AppChange, j as ServiceAccount, k as RejectAppInput, l as CreateAppInput, m as DeveloperPortalError, n as AdminVendor, o as AppVendor, p as DeprecateAppInput, r as App, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput, v as IconUploadLink, w as MfaSetupInput, x as LoginResult, y as LoginChallenge, z as User } from "../types-DHqIJKwx.js";
+import { a as DeveloperPortalClient, c as createDeveloperPortalClient, i as isMfaChallengeResponse, n as authHeader, o as DeveloperPortalClientInitOptions, r as uploadAppIcon, s as DeveloperPortalFetchClient, t as DeveloperPortalTokens } from "../index-ChMtULt4.js";
 export { type AdminPaginationQuery, type AdminVendor, type App, type AppChange, type AppRepository, type AppVendor, type ApproveVendorInput, type ConfirmAccountInput, type CreateAppInput, type CreateServiceAccountInput, type CreateVendorAsAdminInput, type CreateVendorInput, type DeprecateAppInput, DeveloperPortalClient, DeveloperPortalClientInitOptions, type DeveloperPortalError, DeveloperPortalFetchClient, type DeveloperPortalTokens, type GetAppsQuery, type GetChangesQuery, type GetVendorUsersQuery, type IconUploadLink, type LoginChallenge, type LoginInput, type LoginResult, type LoginSuccess, type MfaConfirmInput, type MfaSetupInput, type MfaSetupResult, type PaginationQuery, type Profile, type RefreshTokensResult, type RejectAppInput, type ResetPasswordConfirmInput, type ServiceAccount, type ServiceIndex, type SignUpInput, type Stack, type UpdateAppAsAdminInput, type UpdateAppInput, type UpdateVendorAsAdminInput, type UpdateVendorInput, type User, type UserRequest, type Vendor, type VendorListItem, type Version, authHeader, createDeveloperPortalClient, isMfaChallengeResponse, uploadAppIcon };

package/dist/developerPortal/index.js

@@ -1,2 +1,2 @@
-import { i as uploadAppIcon, n as isMfaChallengeResponse, r as authHeader, t as createDeveloperPortalClient } from "../developerPortalClient-5ABcxz1U.js";
+import { i as uploadAppIcon, n as isMfaChallengeResponse, r as authHeader, t as createDeveloperPortalClient } from "../developerPortalClient-jk46sjwP.js";
 export { authHeader, createDeveloperPortalClient, isMfaChallengeResponse, uploadAppIcon };

package/dist/developerPortal/types.d.cts

@@ -1,2 +1,2 @@
-import { A as ResetPasswordConfirmInput, B as UserRequest, C as MfaConfirmInput, D as Profile, E as PaginationQuery, F as UpdateAppAsAdminInput, H as VendorListItem, I as UpdateAppInput, L as UpdateVendorAsAdminInput, M as ServiceIndex, N as SignUpInput, O as RefreshTokensResult, P as Stack, R as UpdateVendorInput, S as LoginSuccess, T as MfaSetupResult, U as Version, V as Vendor, _ as GetVendorUsersQuery, a as AppRepository, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, i as AppChange, j as ServiceAccount, k as RejectAppInput, l as CreateAppInput, m as DeveloperPortalError, n as AdminVendor, o as AppVendor, p as DeprecateAppInput, r as App, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput, v as IconUploadLink, w as MfaSetupInput, x as LoginResult, y as LoginChallenge, z as User } from "../types-B2El99VY.cjs";
+import { A as ResetPasswordConfirmInput, B as UserRequest, C as MfaConfirmInput, D as Profile, E as PaginationQuery, F as UpdateAppAsAdminInput, H as VendorListItem, I as UpdateAppInput, L as UpdateVendorAsAdminInput, M as ServiceIndex, N as SignUpInput, O as RefreshTokensResult, P as Stack, R as UpdateVendorInput, S as LoginSuccess, T as MfaSetupResult, U as Version, V as Vendor, _ as GetVendorUsersQuery, a as AppRepository, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, i as AppChange, j as ServiceAccount, k as RejectAppInput, l as CreateAppInput, m as DeveloperPortalError, n as AdminVendor, o as AppVendor, p as DeprecateAppInput, r as App, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput, v as IconUploadLink, w as MfaSetupInput, x as LoginResult, y as LoginChallenge, z as User } from "../types-B6JJCta-.cjs";
 export { AdminPaginationQuery, AdminVendor, App, AppChange, AppRepository, AppVendor, ApproveVendorInput, ConfirmAccountInput, CreateAppInput, CreateServiceAccountInput, CreateVendorAsAdminInput, CreateVendorInput, DeprecateAppInput, DeveloperPortalError, GetAppsQuery, GetChangesQuery, GetVendorUsersQuery, IconUploadLink, LoginChallenge, LoginInput, LoginResult, LoginSuccess, MfaConfirmInput, MfaSetupInput, MfaSetupResult, PaginationQuery, Profile, RefreshTokensResult, RejectAppInput, ResetPasswordConfirmInput, ServiceAccount, ServiceIndex, SignUpInput, Stack, UpdateAppAsAdminInput, UpdateAppInput, UpdateVendorAsAdminInput, UpdateVendorInput, User, UserRequest, Vendor, VendorListItem, Version };

package/dist/developerPortal/types.d.ts

@@ -1,2 +1,2 @@
-import { A as ResetPasswordConfirmInput, B as UserRequest, C as MfaConfirmInput, D as Profile, E as PaginationQuery, F as UpdateAppAsAdminInput, H as VendorListItem, I as UpdateAppInput, L as UpdateVendorAsAdminInput, M as ServiceIndex, N as SignUpInput, O as RefreshTokensResult, P as Stack, R as UpdateVendorInput, S as LoginSuccess, T as MfaSetupResult, U as Version, V as Vendor, _ as GetVendorUsersQuery, a as AppRepository, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, i as AppChange, j as ServiceAccount, k as RejectAppInput, l as CreateAppInput, m as DeveloperPortalError, n as AdminVendor, o as AppVendor, p as DeprecateAppInput, r as App, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput, v as IconUploadLink, w as MfaSetupInput, x as LoginResult, y as LoginChallenge, z as User } from "../types-BMsK6T5k.js";
+import { A as ResetPasswordConfirmInput, B as UserRequest, C as MfaConfirmInput, D as Profile, E as PaginationQuery, F as UpdateAppAsAdminInput, H as VendorListItem, I as UpdateAppInput, L as UpdateVendorAsAdminInput, M as ServiceIndex, N as SignUpInput, O as RefreshTokensResult, P as Stack, R as UpdateVendorInput, S as LoginSuccess, T as MfaSetupResult, U as Version, V as Vendor, _ as GetVendorUsersQuery, a as AppRepository, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, i as AppChange, j as ServiceAccount, k as RejectAppInput, l as CreateAppInput, m as DeveloperPortalError, n as AdminVendor, o as AppVendor, p as DeprecateAppInput, r as App, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput, v as IconUploadLink, w as MfaSetupInput, x as LoginResult, y as LoginChallenge, z as User } from "../types-DHqIJKwx.js";
 export { AdminPaginationQuery, AdminVendor, App, AppChange, AppRepository, AppVendor, ApproveVendorInput, ConfirmAccountInput, CreateAppInput, CreateServiceAccountInput, CreateVendorAsAdminInput, CreateVendorInput, DeprecateAppInput, DeveloperPortalError, GetAppsQuery, GetChangesQuery, GetVendorUsersQuery, IconUploadLink, LoginChallenge, LoginInput, LoginResult, LoginSuccess, MfaConfirmInput, MfaSetupInput, MfaSetupResult, PaginationQuery, Profile, RefreshTokensResult, RejectAppInput, ResetPasswordConfirmInput, ServiceAccount, ServiceIndex, SignUpInput, Stack, UpdateAppAsAdminInput, UpdateAppInput, UpdateVendorAsAdminInput, UpdateVendorInput, User, UserRequest, Vendor, VendorListItem, Version };

package/dist/{developerPortalClient-B7lNR5q0.cjs → developerPortalClient-Db2XVB_o.cjs}

@@ -1,5 +1,5 @@
-const require_createFetchClient = require("./createFetchClient-B9Cv0W9f.cjs");
-const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-yirrW6Tg.cjs");
+const require_createFetchClient = require("./createFetchClient-DvZvD31l.cjs");
+const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-C57Ljzi6.cjs");
 //#region src/clients/developerPortal/admin/admin.ts
 /** Keboola staff only. Every method 403s for a non-admin token; the UI gates on `custom:isAdmin`. */
 const createAdmin = (client) => {
@@ -505,4 +505,4 @@ Object.defineProperty(exports, "uploadAppIcon", {
 	}
 });
 
-//# sourceMappingURL=developerPortalClient-B7lNR5q0.cjs.map
+//# sourceMappingURL=developerPortalClient-Db2XVB_o.cjs.map

package/dist/{developerPortalClient-B7lNR5q0.cjs.map → developerPortalClient-Db2XVB_o.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"developerPortalClient-B7lNR5q0.cjs","names":["HttpHeader","createOpenapiFetchClient"],"sources":["../src/clients/developerPortal/admin/admin.ts","../src/clients/developerPortal/apps/apps.ts","../src/clients/developerPortal/tokens.ts","../src/clients/developerPortal/auth/auth.ts","../src/clients/developerPortal/vendors/vendors.ts","../src/clients/developerPortal/developerPortalClient.ts"],"sourcesContent":["import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  AdminPaginationQuery,\n  ApproveVendorInput,\n  CreateVendorAsAdminInput,\n  GetChangesQuery,\n  PaginationQuery,\n  RejectAppInput,\n  UpdateAppAsAdminInput,\n  UpdateVendorAsAdminInput,\n} from '../types';\n\n/** Keboola staff only. Every method 403s for a non-admin token; the UI gates on `custom:isAdmin`. */\nexport const createAdmin = (client: DeveloperPortalFetchClient) => {\n  const getStacks = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/stacks', {}, { signal });\n    return data;\n  };\n\n  const getChanges = async (query: GetChangesQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/changes', { query }, { signal });\n    return data;\n  };\n\n  const getApps = async (query: AdminPaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/apps', { query }, { signal });\n    return data;\n  };\n\n  const getApp = async (id: string, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/apps/{id}', { path: { id } }, { signal });\n    return data;\n  };\n\n  const updateApp = async (id: string, body: UpdateAppAsAdminInput, signal?: AbortSignal) => {\n    const { data } = await client.patch('/admin/apps/{id}', { path: { id }, body }, { signal });\n    return data;\n  };\n\n  const publishApp = async (id: string, signal?: AbortSignal) => {\n    const { data } = await client.post('/admin/apps/{id}/publish', { path: { id } }, { signal });\n    return data;\n  };\n\n  const rejectApp = async (id: string, body: RejectAppInput, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/admin/apps/{id}/reject',\n      { path: { id }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getUsers = async (query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/users', { query }, { signal });\n    return data;\n  };\n\n  const deleteUser = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}', { path: { username } }, { signal });\n  };\n\n  /** Clears the user's MFA enrolment so they can re-enrol — the account-recovery path. */\n  const resetUserMfa = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}/mfa', { path: { username } }, { signal });\n  };\n\n  const addUserToVendor = async (username: string, vendor: string, signal?: AbortSignal) => {\n    await client.post(\n      '/admin/users/{username}/vendors/{vendor}',\n      { path: { username, vendor } },\n      { signal },\n    );\n  };\n\n  const removeUserFromVendor = async (username: string, vendor: string, signal?: AbortSignal) => {\n    await client.delete(\n      '/admin/users/{username}/vendors/{vendor}',\n      { path: { username, vendor } },\n      { signal },\n    );\n  };\n\n  const grantUserAdmin = async (username: string, signal?: AbortSignal) => {\n    await client.post('/admin/users/{username}/admin', { path: { username } }, { signal });\n  };\n\n  const revokeUserAdmin = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}/admin', { path: { username } }, { signal });\n  };\n\n  const getVendors = async (query: AdminPaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/vendors', { query }, { signal });\n    return data;\n  };\n\n  const createVendor = async (body: CreateVendorAsAdminInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/admin/vendors', { body }, { signal });\n    return data;\n  };\n\n  const updateVendor = async (\n    vendor: string,\n    body: UpdateVendorAsAdminInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.patch(\n      '/admin/vendors/{vendor}',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const deleteVendor = async (vendor: string, signal?: AbortSignal) => {\n    await client.delete('/admin/vendors/{vendor}', { path: { vendor } }, { signal });\n  };\n\n  /** Swaps a pending `_v`-prefixed id for the permanent one carried in the body. */\n  const approveVendor = async (vendor: string, body: ApproveVendorInput, signal?: AbortSignal) => {\n    await client.post('/admin/vendors/{vendor}/approve', { path: { vendor }, body }, { signal });\n  };\n\n  return {\n    getStacks,\n    getChanges,\n    getApps,\n    getApp,\n    updateApp,\n    publishApp,\n    rejectApp,\n    getUsers,\n    deleteUser,\n    resetUserMfa,\n    addUserToVendor,\n    removeUserFromVendor,\n    grantUserAdmin,\n    revokeUserAdmin,\n    getVendors,\n    createVendor,\n    updateVendor,\n    deleteVendor,\n    approveVendor,\n  };\n};\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  CreateAppInput,\n  DeprecateAppInput,\n  GetAppsQuery,\n  PaginationQuery,\n  UpdateAppInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** `GET /apps` and `GET /apps/{app}` are `security: []` in the spec. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const createApps = ({ client, publicClient }: Deps) => {\n  /** The public catalog: scoped server-side to published components. */\n  const getPublishedApps = async (query: GetAppsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/apps', { query }, { signal });\n    return data;\n  };\n\n  const getPublishedApp = async (app: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/apps/{app}', { path: { app } }, { signal });\n    return data;\n  };\n\n  const getApps = async (vendor: string, query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const getApp = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createApp = async (vendor: string, body: CreateAppInput, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const updateApp = async (\n    vendor: string,\n    app: string,\n    body: UpdateAppInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.patch(\n      '/vendors/{vendor}/apps/{app}',\n      { path: { vendor, app }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const deleteApp = async (vendor: string, app: string, signal?: AbortSignal) => {\n    await client.delete('/vendors/{vendor}/apps/{app}', { path: { vendor, app } }, { signal });\n  };\n\n  const requestAppPublishing = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/publish',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  const deprecateApp = async (\n    vendor: string,\n    app: string,\n    body: DeprecateAppInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/deprecate',\n      { path: { vendor, app }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getAppVersions = async (\n    vendor: string,\n    app: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/versions',\n      { path: { vendor, app }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const getAppVersion = async (\n    vendor: string,\n    app: string,\n    version: string,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/versions/{version}',\n      { path: { vendor, app, version } },\n      { signal },\n    );\n    return data;\n  };\n\n  const rollbackAppVersion = async (\n    vendor: string,\n    app: string,\n    version: string,\n    signal?: AbortSignal,\n  ) => {\n    await client.post(\n      '/vendors/{vendor}/apps/{app}/versions/{version}/rollback',\n      { path: { vendor, app, version } },\n      { signal },\n    );\n  };\n\n  const getAppRepository = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/repository',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  /** Requests a presigned S3 upload link; the upload itself is {@link uploadAppIcon}. */\n  const createAppIconUploadLink = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/icon',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  return {\n    getPublishedApps,\n    getPublishedApp,\n    getApps,\n    getApp,\n    createApp,\n    updateApp,\n    deleteApp,\n    requestAppPublishing,\n    deprecateApp,\n    getAppVersions,\n    getAppVersion,\n    rollbackAppVersion,\n    getAppRepository,\n    createAppIconUploadLink,\n  };\n};\n\n/**\n * Uploads the icon to the presigned URL from `createAppIconUploadLink`. Deliberately a bare `fetch`:\n * the URL carries its own signature in the query string, and sending our `Authorization` header to\n * S3 makes it reject the request.\n */\nexport const uploadAppIcon = async (\n  uploadUrl: string,\n  png: Blob,\n  signal?: AbortSignal,\n): Promise<void> => {\n  const response = await fetch(uploadUrl, {\n    method: 'PUT',\n    body: png,\n    headers: { 'Content-Type': 'image/png' },\n    signal,\n  });\n\n  if (!response.ok) {\n    throw new Error(`Icon upload failed: ${response.status} ${response.statusText}`);\n  }\n};\n","import { HttpHeader } from '../../fetchClient';\n\n/**\n * The Cognito token trio apps-api issues. `token` is the id token: stamped on almost every call, and\n * the header on both MFA calls. `refreshToken` authenticates `GET /auth/token`. `accessToken`\n * authenticates `POST /auth/logout` as a header, and both `POST /auth/mfa` and `/auth/mfa/confirm`\n * in the **body** — which is why those two stay off the refresh-and-replay path.\n */\nexport type DeveloperPortalTokens = {\n  token: string;\n  accessToken: string;\n  refreshToken: string;\n};\n\n/** Raw token, no `Bearer` prefix — see the spec's `bearerAuth` scheme (`type: apiKey`). */\nexport const authHeader = (token: string): Record<string, string> => ({\n  [HttpHeader.AUTHORIZATION]: token,\n});\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport { authHeader } from '../tokens';\nimport type {\n  ConfirmAccountInput,\n  LoginChallenge,\n  LoginInput,\n  LoginResult,\n  ResetPasswordConfirmInput,\n  SignUpInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** The spec's `security: []` operations, plus the four that bring their own token. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const isMfaChallengeResponse = (result: LoginResult): result is LoginChallenge =>\n  !('token' in result);\n\nexport const createAuth = ({ client, publicClient }: Deps) => {\n  const login = async (body: LoginInput, signal?: AbortSignal) => {\n    const { data } = await publicClient.post('/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const signUp = async (body: SignUpInput, signal?: AbortSignal) => {\n    await publicClient.post('/auth/signup', { body }, { signal });\n  };\n\n  const confirmAccount = async (body: ConfirmAccountInput, signal?: AbortSignal) => {\n    await publicClient.post('/auth/confirm', { body }, { signal });\n  };\n\n  /** Confirms via the emailed link's path segments, for a consumer echoing that link. */\n  const confirmAccountByCode = async (email: string, code: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/confirm/{email}/{code}', { path: { email, code } }, { signal });\n  };\n\n  /**\n   * Rotates the trio, authenticated with the **refresh** token, on the auth-free client so a\n   * rotation triggered by the auth middleware cannot recurse into it. The response carries no new\n   * refresh token, so the caller carries the one it has forward.\n   */\n  const refreshTokens = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get(\n      '/auth/token',\n      {},\n      { headers: authHeader(refreshToken), signal },\n    );\n    return data;\n  };\n\n  /** Authenticated with the **access** token. Clear local state regardless of the outcome. */\n  const logout = async (accessToken: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/logout', {}, { headers: authHeader(accessToken), signal });\n  };\n\n  const getProfile = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/auth/profile', {}, { signal });\n    return data;\n  };\n\n  const requestPasswordReset = async (email: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/forgot/{email}', { path: { email } }, { signal });\n  };\n\n  const confirmPasswordReset = async (\n    email: string,\n    body: ResetPasswordConfirmInput,\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.post('/auth/forgot/{email}/confirm', { path: { email }, body }, { signal });\n  };\n\n  // `setupMfa` and `confirmMfa` each take two of the three tokens: the auth token in the header, the\n  // access token in the body. Both sit on the auth-free client, which keeps them out of the\n  // middleware's refresh-and-replay: restamping a header cannot fix a stale token in a body.\n  const setupMfa = async (\n    { idToken, accessToken }: { idToken: string; accessToken: string },\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await publicClient.post(\n      '/auth/mfa',\n      { body: { accessToken } },\n      { headers: authHeader(idToken), signal },\n    );\n    return data;\n  };\n\n  const confirmMfa = async (\n    { idToken, accessToken, code }: { idToken: string; accessToken: string; code: string },\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.post(\n      '/auth/mfa/confirm',\n      { body: { accessToken, code } },\n      { headers: authHeader(idToken), signal },\n    );\n  };\n\n  return {\n    login,\n    signUp,\n    confirmAccount,\n    confirmAccountByCode,\n    refreshTokens,\n    logout,\n    getProfile,\n    requestPasswordReset,\n    confirmPasswordReset,\n    setupMfa,\n    confirmMfa,\n  };\n};\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  CreateServiceAccountInput,\n  CreateVendorInput,\n  GetVendorUsersQuery,\n  PaginationQuery,\n  UpdateVendorInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** `GET /vendors` and `GET /vendors/{vendor}` are `security: []` in the spec. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const createVendors = ({ client, publicClient }: Deps) => {\n  const getVendors = async (query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/vendors', { query }, { signal });\n    return data;\n  };\n\n  const getVendor = async (vendor: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/vendors/{vendor}', { path: { vendor } }, { signal });\n    return data;\n  };\n\n  /** Self-service registration. The vendor is pending, under a temporary `_v`-prefixed id. */\n  const createVendor = async (body: CreateVendorInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/vendors', { body }, { signal });\n    return data;\n  };\n\n  const updateVendor = async (vendor: string, body: UpdateVendorInput, signal?: AbortSignal) => {\n    const { data } = await client.patch(\n      '/vendors/{vendor}',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getVendorUsers = async (\n    vendor: string,\n    query: GetVendorUsersQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/users',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  /** Requests membership of a vendor for the signed-in user. */\n  const requestVendorMembership = async (vendor: string, signal?: AbortSignal) => {\n    await client.post('/vendors/{vendor}/users', { path: { vendor } }, { signal });\n  };\n\n  const approveVendorUser = async (vendor: string, username: string, signal?: AbortSignal) => {\n    await client.post(\n      '/vendors/{vendor}/users/{username}',\n      { path: { vendor, username } },\n      { signal },\n    );\n  };\n\n  const removeVendorUser = async (vendor: string, username: string, signal?: AbortSignal) => {\n    await client.delete(\n      '/vendors/{vendor}/users/{username}',\n      { path: { vendor, username } },\n      { signal },\n    );\n  };\n\n  const getVendorUserRequests = async (\n    vendor: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/user-requests',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const sendVendorInvitation = async (vendor: string, email: string, signal?: AbortSignal) => {\n    await client.post(\n      '/vendors/{vendor}/invitations/{email}',\n      { path: { vendor, email } },\n      { signal },\n    );\n  };\n\n  /** `security: []` — the invitee follows the emailed link before they have a session. */\n  const acceptVendorInvitation = async (\n    vendor: string,\n    email: string,\n    code: string,\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.get(\n      '/vendors/{vendor}/invitations/{email}/{code}',\n      { path: { vendor, email, code } },\n      { signal },\n    );\n  };\n\n  /** `service=1` filters the member list; there is no distinct endpoint. */\n  const getServiceAccounts = async (\n    vendor: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/users',\n      { path: { vendor }, query: { ...query, service: 1 } },\n      { signal },\n    );\n    return data;\n  };\n\n  /** The returned `password` is shown once and is not retrievable afterwards. */\n  const createServiceAccount = async (\n    vendor: string,\n    body: CreateServiceAccountInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/credentials',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  return {\n    getVendors,\n    getVendor,\n    createVendor,\n    updateVendor,\n    getVendorUsers,\n    requestVendorMembership,\n    approveVendorUser,\n    removeVendorUser,\n    getVendorUserRequests,\n    sendVendorInvitation,\n    acceptVendorInvitation,\n    getServiceAccounts,\n    createServiceAccount,\n  };\n};\n","import { createOpenapiFetchClient, type MiddlewareFn } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createAdmin } from './admin/admin';\nimport { createApps } from './apps/apps';\nimport { createAuth } from './auth/auth';\nimport { createVendors } from './vendors/vendors';\n\nexport type DeveloperPortalFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport type DeveloperPortalClientInitOptions = Omit<ClientInitOptions, 'auth' | 'middlewares'> & {\n  middlewares?: MiddlewareFn[];\n  /**\n   * Stamps the id token. A middleware rather than the `auth: AuthStrategy` other clients take, because\n   * apps-api's token rotates and a header baked in at construction would go stale. Supplied by\n   * `createDeveloperPortalSdk`; omit it for the spec's `security: []` operations.\n   */\n  authMiddleware?: MiddlewareFn;\n};\n\n/**\n * The Developer Portal (apps-api) client. Paths and types are generated from\n * `https://apps-api.keboola.com/docs/openapi.yaml` — see `redocly.yaml` and `pnpm gen:types`.\n *\n * Two fetch clients because the spec splits its operations: `security: []` ones must go out\n * unauthenticated, and four authenticate with the access or refresh token instead of the id token.\n */\nexport const createDeveloperPortalClient = ({\n  baseUrl,\n  middlewares = [],\n  authMiddleware,\n}: DeveloperPortalClientInitOptions) => {\n  const publicClient = createOpenapiFetchClient<paths>({ baseUrl, middlewares });\n  const client = authMiddleware\n    ? createOpenapiFetchClient<paths>({ baseUrl, middlewares: [authMiddleware, ...middlewares] })\n    : publicClient;\n\n  /** `GET /` — the spec's service index. */\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/', {}, { signal });\n    return data;\n  };\n\n  return {\n    healthCheck,\n    auth: createAuth({ client, publicClient }),\n    vendors: createVendors({ client, publicClient }),\n    apps: createApps({ client, publicClient }),\n    admin: createAdmin(client),\n  };\n};\n\nexport type DeveloperPortalClient = ReturnType<typeof createDeveloperPortalClient>;\n"],"mappings":";;;;AAaA,MAAa,eAAe,WAAuC;CACjE,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EACjE,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,kBAAkB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAA8B,CAAC,GAAG,WAAyB;EAChF,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,eAAe,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAY,WAAyB;EACzD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,IAAY,MAA6B,WAAyB;EACzF,MAAM,EAAE,SAAS,MAAM,OAAO,MAAM,oBAAoB;GAAE,MAAM,EAAE,GAAG;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;EAC1F,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,IAAY,WAAyB;EAC7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;EAC3F,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,IAAY,MAAsB,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,2BACA;GAAE,MAAM,EAAE,GAAG;GAAG;EAAK,GACrB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,UAAkB,WAAyB;EACnE,MAAM,OAAO,OAAO,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACnF;;CAGA,MAAM,eAAe,OAAO,UAAkB,WAAyB;EACrE,MAAM,OAAO,OAAO,+BAA+B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACvF;CAEA,MAAM,kBAAkB,OAAO,UAAkB,QAAgB,WAAyB;EACxF,MAAM,OAAO,KACX,4CACA,EAAE,MAAM;GAAE;GAAU;EAAO,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,uBAAuB,OAAO,UAAkB,QAAgB,WAAyB;EAC7F,MAAM,OAAO,OACX,4CACA,EAAE,MAAM;GAAE;GAAU;EAAO,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,iBAAiB,OAAO,UAAkB,WAAyB;EACvE,MAAM,OAAO,KAAK,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACvF;CAEA,MAAM,kBAAkB,OAAO,UAAkB,WAAyB;EACxE,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACzF;CAEA,MAAM,aAAa,OAAO,QAA8B,CAAC,GAAG,WAAyB;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,kBAAkB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,MAAgC,WAAyB;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OACnB,QACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,QAAgB,WAAyB;EACnE,MAAM,OAAO,OAAO,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;CACjF;;CAGA,MAAM,gBAAgB,OAAO,QAAgB,MAA0B,WAAyB;EAC9F,MAAM,OAAO,KAAK,mCAAmC;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;CAC7F;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACjIA,MAAa,cAAc,EAAE,QAAQ,mBAAyB;;CAE5D,MAAM,mBAAmB,OAAO,QAAsB,CAAC,GAAG,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,KAAa,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAAgB,QAAyB,CAAC,GAAG,WAAyB;EAC3F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,0BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,QAAgB,KAAa,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,MAAsB,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAChB,QACA,KACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,gCACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAK,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,KAAa,WAAyB;EAC7E,MAAM,OAAO,OAAO,gCAAgC,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GAAG,EAAE,OAAO,CAAC;CAC3F;CAEA,MAAM,uBAAuB,OAAO,QAAgB,KAAa,WAAyB;EACxF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,wCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,eAAe,OACnB,QACA,KACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0CACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAK,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,iBAAiB,OACrB,QACA,KACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,yCACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAM,GAC/B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OACpB,QACA,KACA,SACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,mDACA,EAAE,MAAM;GAAE;GAAQ;GAAK;EAAQ,EAAE,GACjC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,qBAAqB,OACzB,QACA,KACA,SACA,WACG;EACH,MAAM,OAAO,KACX,4DACA,EAAE,MAAM;GAAE;GAAQ;GAAK;EAAQ,EAAE,GACjC,EAAE,OAAO,CACX;CACF;CAEA,MAAM,mBAAmB,OAAO,QAAgB,KAAa,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2CACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,0BAA0B,OAAO,QAAgB,KAAa,WAAyB;EAC3F,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,qCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;AAOA,MAAa,gBAAgB,OAC3B,WACA,KACA,WACkB;CAClB,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,MAAM;EACN,SAAS,EAAE,gBAAgB,YAAY;EACvC;CACF,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,uBAAuB,SAAS,OAAO,GAAG,SAAS,YAAY;AAEnF;;;;AClLA,MAAa,cAAc,WAA2C,GACnEA,0BAAAA,WAAW,gBAAgB,MAC9B;;;ACAA,MAAa,0BAA0B,WACrC,EAAE,WAAW;AAEf,MAAa,cAAc,EAAE,QAAQ,mBAAyB;CAC5D,MAAM,QAAQ,OAAO,MAAkB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,aAAa,KAAK,eAAe,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAmB,WAAyB;EAChE,MAAM,aAAa,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC9D;CAEA,MAAM,iBAAiB,OAAO,MAA2B,WAAyB;EAChF,MAAM,aAAa,KAAK,iBAAiB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC/D;;CAGA,MAAM,uBAAuB,OAAO,OAAe,MAAc,WAAyB;EACxF,MAAM,aAAa,KAAK,gCAAgC,EAAE,MAAM;GAAE;GAAO;EAAK,EAAE,GAAG,EAAE,OAAO,CAAC;CAC/F;;;;;;CAOA,MAAM,gBAAgB,OAAO,cAAsB,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,aAAa,IAClC,eACA,CAAC,GACD;GAAE,SAAS,WAAW,YAAY;GAAG;EAAO,CAC9C;EACA,OAAO;CACT;;CAGA,MAAM,SAAS,OAAO,aAAqB,WAAyB;EAClE,MAAM,aAAa,KAAK,gBAAgB,CAAC,GAAG;GAAE,SAAS,WAAW,WAAW;GAAG;EAAO,CAAC;CAC1F;CAEA,MAAM,aAAa,OAAO,WAAyB;EACjD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EACjE,OAAO;CACT;CAEA,MAAM,uBAAuB,OAAO,OAAe,WAAyB;EAC1E,MAAM,aAAa,KAAK,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;CACjF;CAEA,MAAM,uBAAuB,OAC3B,OACA,MACA,WACG;EACH,MAAM,aAAa,KAAK,gCAAgC;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;CAC/F;CAKA,MAAM,WAAW,OACf,EAAE,SAAS,eACX,WACG;EACH,MAAM,EAAE,SAAS,MAAM,aAAa,KAClC,aACA,EAAE,MAAM,EAAE,YAAY,EAAE,GACxB;GAAE,SAAS,WAAW,OAAO;GAAG;EAAO,CACzC;EACA,OAAO;CACT;CAEA,MAAM,aAAa,OACjB,EAAE,SAAS,aAAa,QACxB,WACG;EACH,MAAM,aAAa,KACjB,qBACA,EAAE,MAAM;GAAE;GAAa;EAAK,EAAE,GAC9B;GAAE,SAAS,WAAW,OAAO;GAAG;EAAO,CACzC;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACnGA,MAAa,iBAAiB,EAAE,QAAQ,mBAAyB;CAC/D,MAAM,aAAa,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,WAAyB;EAChE,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;EAC7F,OAAO;CACT;;CAGA,MAAM,eAAe,OAAO,MAAyB,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,YAAY,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACnE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,QAAgB,MAAyB,WAAyB;EAC5F,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,qBACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,iBAAiB,OACrB,QACA,QAA6B,CAAC,GAC9B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,0BAA0B,OAAO,QAAgB,WAAyB;EAC9E,MAAM,OAAO,KAAK,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;CAC/E;CAEA,MAAM,oBAAoB,OAAO,QAAgB,UAAkB,WAAyB;EAC1F,MAAM,OAAO,KACX,sCACA,EAAE,MAAM;GAAE;GAAQ;EAAS,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,mBAAmB,OAAO,QAAgB,UAAkB,WAAyB;EACzF,MAAM,OAAO,OACX,sCACA,EAAE,MAAM;GAAE;GAAQ;EAAS,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,wBAAwB,OAC5B,QACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,mCACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,uBAAuB,OAAO,QAAgB,OAAe,WAAyB;EAC1F,MAAM,OAAO,KACX,yCACA,EAAE,MAAM;GAAE;GAAQ;EAAM,EAAE,GAC1B,EAAE,OAAO,CACX;CACF;;CAGA,MAAM,yBAAyB,OAC7B,QACA,OACA,MACA,WACG;EACH,MAAM,aAAa,IACjB,gDACA,EAAE,MAAM;GAAE;GAAQ;GAAO;EAAK,EAAE,GAChC,EAAE,OAAO,CACX;CACF;;CAGA,MAAM,qBAAqB,OACzB,QACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG,OAAO;IAAE,GAAG;IAAO,SAAS;GAAE;EAAE,GACpD,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,uBAAuB,OAC3B,QACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iCACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;;AC7HA,MAAa,+BAA+B,EAC1C,SACA,cAAc,CAAC,GACf,qBACsC;CACtC,MAAM,eAAeC,iCAAAA,yBAAgC;EAAE;EAAS;CAAY,CAAC;CAC7E,MAAM,SAAS,iBACXA,iCAAAA,yBAAgC;EAAE;EAAS,aAAa,CAAC,gBAAgB,GAAG,WAAW;CAAE,CAAC,IAC1F;;CAGJ,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAC3D,OAAO;CACT;CAEA,OAAO;EACL;EACA,MAAM,WAAW;GAAE;GAAQ;EAAa,CAAC;EACzC,SAAS,cAAc;GAAE;GAAQ;EAAa,CAAC;EAC/C,MAAM,WAAW;GAAE;GAAQ;EAAa,CAAC;EACzC,OAAO,YAAY,MAAM;CAC3B;AACF"}
+{"version":3,"file":"developerPortalClient-Db2XVB_o.cjs","names":["HttpHeader","createOpenapiFetchClient"],"sources":["../src/clients/developerPortal/admin/admin.ts","../src/clients/developerPortal/apps/apps.ts","../src/clients/developerPortal/tokens.ts","../src/clients/developerPortal/auth/auth.ts","../src/clients/developerPortal/vendors/vendors.ts","../src/clients/developerPortal/developerPortalClient.ts"],"sourcesContent":["import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  AdminPaginationQuery,\n  ApproveVendorInput,\n  CreateVendorAsAdminInput,\n  GetChangesQuery,\n  PaginationQuery,\n  RejectAppInput,\n  UpdateAppAsAdminInput,\n  UpdateVendorAsAdminInput,\n} from '../types';\n\n/** Keboola staff only. Every method 403s for a non-admin token; the UI gates on `custom:isAdmin`. */\nexport const createAdmin = (client: DeveloperPortalFetchClient) => {\n  const getStacks = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/stacks', {}, { signal });\n    return data;\n  };\n\n  const getChanges = async (query: GetChangesQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/changes', { query }, { signal });\n    return data;\n  };\n\n  const getApps = async (query: AdminPaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/apps', { query }, { signal });\n    return data;\n  };\n\n  const getApp = async (id: string, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/apps/{id}', { path: { id } }, { signal });\n    return data;\n  };\n\n  const updateApp = async (id: string, body: UpdateAppAsAdminInput, signal?: AbortSignal) => {\n    const { data } = await client.patch('/admin/apps/{id}', { path: { id }, body }, { signal });\n    return data;\n  };\n\n  const publishApp = async (id: string, signal?: AbortSignal) => {\n    const { data } = await client.post('/admin/apps/{id}/publish', { path: { id } }, { signal });\n    return data;\n  };\n\n  const rejectApp = async (id: string, body: RejectAppInput, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/admin/apps/{id}/reject',\n      { path: { id }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getUsers = async (query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/users', { query }, { signal });\n    return data;\n  };\n\n  const deleteUser = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}', { path: { username } }, { signal });\n  };\n\n  /** Clears the user's MFA enrolment so they can re-enrol — the account-recovery path. */\n  const resetUserMfa = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}/mfa', { path: { username } }, { signal });\n  };\n\n  const addUserToVendor = async (username: string, vendor: string, signal?: AbortSignal) => {\n    await client.post(\n      '/admin/users/{username}/vendors/{vendor}',\n      { path: { username, vendor } },\n      { signal },\n    );\n  };\n\n  const removeUserFromVendor = async (username: string, vendor: string, signal?: AbortSignal) => {\n    await client.delete(\n      '/admin/users/{username}/vendors/{vendor}',\n      { path: { username, vendor } },\n      { signal },\n    );\n  };\n\n  const grantUserAdmin = async (username: string, signal?: AbortSignal) => {\n    await client.post('/admin/users/{username}/admin', { path: { username } }, { signal });\n  };\n\n  const revokeUserAdmin = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}/admin', { path: { username } }, { signal });\n  };\n\n  const getVendors = async (query: AdminPaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/vendors', { query }, { signal });\n    return data;\n  };\n\n  const createVendor = async (body: CreateVendorAsAdminInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/admin/vendors', { body }, { signal });\n    return data;\n  };\n\n  const updateVendor = async (\n    vendor: string,\n    body: UpdateVendorAsAdminInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.patch(\n      '/admin/vendors/{vendor}',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const deleteVendor = async (vendor: string, signal?: AbortSignal) => {\n    await client.delete('/admin/vendors/{vendor}', { path: { vendor } }, { signal });\n  };\n\n  /** Swaps a pending `_v`-prefixed id for the permanent one carried in the body. */\n  const approveVendor = async (vendor: string, body: ApproveVendorInput, signal?: AbortSignal) => {\n    await client.post('/admin/vendors/{vendor}/approve', { path: { vendor }, body }, { signal });\n  };\n\n  return {\n    getStacks,\n    getChanges,\n    getApps,\n    getApp,\n    updateApp,\n    publishApp,\n    rejectApp,\n    getUsers,\n    deleteUser,\n    resetUserMfa,\n    addUserToVendor,\n    removeUserFromVendor,\n    grantUserAdmin,\n    revokeUserAdmin,\n    getVendors,\n    createVendor,\n    updateVendor,\n    deleteVendor,\n    approveVendor,\n  };\n};\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  CreateAppInput,\n  DeprecateAppInput,\n  GetAppsQuery,\n  PaginationQuery,\n  UpdateAppInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** `GET /apps` and `GET /apps/{app}` are `security: []` in the spec. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const createApps = ({ client, publicClient }: Deps) => {\n  /** The public catalog: scoped server-side to published components. */\n  const getPublishedApps = async (query: GetAppsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/apps', { query }, { signal });\n    return data;\n  };\n\n  const getPublishedApp = async (app: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/apps/{app}', { path: { app } }, { signal });\n    return data;\n  };\n\n  const getApps = async (vendor: string, query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const getApp = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createApp = async (vendor: string, body: CreateAppInput, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const updateApp = async (\n    vendor: string,\n    app: string,\n    body: UpdateAppInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.patch(\n      '/vendors/{vendor}/apps/{app}',\n      { path: { vendor, app }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const deleteApp = async (vendor: string, app: string, signal?: AbortSignal) => {\n    await client.delete('/vendors/{vendor}/apps/{app}', { path: { vendor, app } }, { signal });\n  };\n\n  const requestAppPublishing = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/publish',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  const deprecateApp = async (\n    vendor: string,\n    app: string,\n    body: DeprecateAppInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/deprecate',\n      { path: { vendor, app }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getAppVersions = async (\n    vendor: string,\n    app: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/versions',\n      { path: { vendor, app }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const getAppVersion = async (\n    vendor: string,\n    app: string,\n    version: string,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/versions/{version}',\n      { path: { vendor, app, version } },\n      { signal },\n    );\n    return data;\n  };\n\n  const rollbackAppVersion = async (\n    vendor: string,\n    app: string,\n    version: string,\n    signal?: AbortSignal,\n  ) => {\n    await client.post(\n      '/vendors/{vendor}/apps/{app}/versions/{version}/rollback',\n      { path: { vendor, app, version } },\n      { signal },\n    );\n  };\n\n  const getAppRepository = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/repository',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  /** Requests a presigned S3 upload link; the upload itself is {@link uploadAppIcon}. */\n  const createAppIconUploadLink = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/icon',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  return {\n    getPublishedApps,\n    getPublishedApp,\n    getApps,\n    getApp,\n    createApp,\n    updateApp,\n    deleteApp,\n    requestAppPublishing,\n    deprecateApp,\n    getAppVersions,\n    getAppVersion,\n    rollbackAppVersion,\n    getAppRepository,\n    createAppIconUploadLink,\n  };\n};\n\n/**\n * Uploads the icon to the presigned URL from `createAppIconUploadLink`. Deliberately a bare `fetch`:\n * the URL carries its own signature in the query string, and sending our `Authorization` header to\n * S3 makes it reject the request.\n */\nexport const uploadAppIcon = async (\n  uploadUrl: string,\n  png: Blob,\n  signal?: AbortSignal,\n): Promise<void> => {\n  const response = await fetch(uploadUrl, {\n    method: 'PUT',\n    body: png,\n    headers: { 'Content-Type': 'image/png' },\n    signal,\n  });\n\n  if (!response.ok) {\n    throw new Error(`Icon upload failed: ${response.status} ${response.statusText}`);\n  }\n};\n","import { HttpHeader } from '../../fetchClient';\n\n/**\n * The Cognito token trio apps-api issues. `token` is the id token: stamped on almost every call, and\n * the header on both MFA calls. `refreshToken` authenticates `GET /auth/token`. `accessToken`\n * authenticates `POST /auth/logout` as a header, and both `POST /auth/mfa` and `/auth/mfa/confirm`\n * in the **body** — which is why those two stay off the refresh-and-replay path.\n */\nexport type DeveloperPortalTokens = {\n  token: string;\n  accessToken: string;\n  refreshToken: string;\n};\n\n/** Raw token, no `Bearer` prefix — see the spec's `bearerAuth` scheme (`type: apiKey`). */\nexport const authHeader = (token: string): Record<string, string> => ({\n  [HttpHeader.AUTHORIZATION]: token,\n});\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport { authHeader } from '../tokens';\nimport type {\n  ConfirmAccountInput,\n  LoginChallenge,\n  LoginInput,\n  LoginResult,\n  ResetPasswordConfirmInput,\n  SignUpInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** The spec's `security: []` operations, plus the four that bring their own token. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const isMfaChallengeResponse = (result: LoginResult): result is LoginChallenge =>\n  !('token' in result);\n\nexport const createAuth = ({ client, publicClient }: Deps) => {\n  const login = async (body: LoginInput, signal?: AbortSignal) => {\n    const { data } = await publicClient.post('/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const signUp = async (body: SignUpInput, signal?: AbortSignal) => {\n    await publicClient.post('/auth/signup', { body }, { signal });\n  };\n\n  const confirmAccount = async (body: ConfirmAccountInput, signal?: AbortSignal) => {\n    await publicClient.post('/auth/confirm', { body }, { signal });\n  };\n\n  /** Confirms via the emailed link's path segments, for a consumer echoing that link. */\n  const confirmAccountByCode = async (email: string, code: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/confirm/{email}/{code}', { path: { email, code } }, { signal });\n  };\n\n  /**\n   * Rotates the trio, authenticated with the **refresh** token, on the auth-free client so a\n   * rotation triggered by the auth middleware cannot recurse into it. The response carries no new\n   * refresh token, so the caller carries the one it has forward.\n   */\n  const refreshTokens = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get(\n      '/auth/token',\n      {},\n      { headers: authHeader(refreshToken), signal },\n    );\n    return data;\n  };\n\n  /** Authenticated with the **access** token. Clear local state regardless of the outcome. */\n  const logout = async (accessToken: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/logout', {}, { headers: authHeader(accessToken), signal });\n  };\n\n  const getProfile = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/auth/profile', {}, { signal });\n    return data;\n  };\n\n  const requestPasswordReset = async (email: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/forgot/{email}', { path: { email } }, { signal });\n  };\n\n  const confirmPasswordReset = async (\n    email: string,\n    body: ResetPasswordConfirmInput,\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.post('/auth/forgot/{email}/confirm', { path: { email }, body }, { signal });\n  };\n\n  // `setupMfa` and `confirmMfa` each take two of the three tokens: the auth token in the header, the\n  // access token in the body. Both sit on the auth-free client, which keeps them out of the\n  // middleware's refresh-and-replay: restamping a header cannot fix a stale token in a body.\n  const setupMfa = async (\n    { idToken, accessToken }: { idToken: string; accessToken: string },\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await publicClient.post(\n      '/auth/mfa',\n      { body: { accessToken } },\n      { headers: authHeader(idToken), signal },\n    );\n    return data;\n  };\n\n  const confirmMfa = async (\n    { idToken, accessToken, code }: { idToken: string; accessToken: string; code: string },\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.post(\n      '/auth/mfa/confirm',\n      { body: { accessToken, code } },\n      { headers: authHeader(idToken), signal },\n    );\n  };\n\n  return {\n    login,\n    signUp,\n    confirmAccount,\n    confirmAccountByCode,\n    refreshTokens,\n    logout,\n    getProfile,\n    requestPasswordReset,\n    confirmPasswordReset,\n    setupMfa,\n    confirmMfa,\n  };\n};\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  CreateServiceAccountInput,\n  CreateVendorInput,\n  GetVendorUsersQuery,\n  PaginationQuery,\n  UpdateVendorInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** `GET /vendors` and `GET /vendors/{vendor}` are `security: []` in the spec. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const createVendors = ({ client, publicClient }: Deps) => {\n  const getVendors = async (query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/vendors', { query }, { signal });\n    return data;\n  };\n\n  const getVendor = async (vendor: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/vendors/{vendor}', { path: { vendor } }, { signal });\n    return data;\n  };\n\n  /** Self-service registration. The vendor is pending, under a temporary `_v`-prefixed id. */\n  const createVendor = async (body: CreateVendorInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/vendors', { body }, { signal });\n    return data;\n  };\n\n  const updateVendor = async (vendor: string, body: UpdateVendorInput, signal?: AbortSignal) => {\n    const { data } = await client.patch(\n      '/vendors/{vendor}',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getVendorUsers = async (\n    vendor: string,\n    query: GetVendorUsersQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/users',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  /** Requests membership of a vendor for the signed-in user. */\n  const requestVendorMembership = async (vendor: string, signal?: AbortSignal) => {\n    await client.post('/vendors/{vendor}/users', { path: { vendor } }, { signal });\n  };\n\n  const approveVendorUser = async (vendor: string, username: string, signal?: AbortSignal) => {\n    await client.post(\n      '/vendors/{vendor}/users/{username}',\n      { path: { vendor, username } },\n      { signal },\n    );\n  };\n\n  const removeVendorUser = async (vendor: string, username: string, signal?: AbortSignal) => {\n    await client.delete(\n      '/vendors/{vendor}/users/{username}',\n      { path: { vendor, username } },\n      { signal },\n    );\n  };\n\n  const getVendorUserRequests = async (\n    vendor: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/user-requests',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const sendVendorInvitation = async (vendor: string, email: string, signal?: AbortSignal) => {\n    await client.post(\n      '/vendors/{vendor}/invitations/{email}',\n      { path: { vendor, email } },\n      { signal },\n    );\n  };\n\n  /** `security: []` — the invitee follows the emailed link before they have a session. */\n  const acceptVendorInvitation = async (\n    vendor: string,\n    email: string,\n    code: string,\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.get(\n      '/vendors/{vendor}/invitations/{email}/{code}',\n      { path: { vendor, email, code } },\n      { signal },\n    );\n  };\n\n  /** `service=1` filters the member list; there is no distinct endpoint. */\n  const getServiceAccounts = async (\n    vendor: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/users',\n      { path: { vendor }, query: { ...query, service: 1 } },\n      { signal },\n    );\n    return data;\n  };\n\n  /** The returned `password` is shown once and is not retrievable afterwards. */\n  const createServiceAccount = async (\n    vendor: string,\n    body: CreateServiceAccountInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/credentials',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  return {\n    getVendors,\n    getVendor,\n    createVendor,\n    updateVendor,\n    getVendorUsers,\n    requestVendorMembership,\n    approveVendorUser,\n    removeVendorUser,\n    getVendorUserRequests,\n    sendVendorInvitation,\n    acceptVendorInvitation,\n    getServiceAccounts,\n    createServiceAccount,\n  };\n};\n","import { createOpenapiFetchClient, type MiddlewareFn } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createAdmin } from './admin/admin';\nimport { createApps } from './apps/apps';\nimport { createAuth } from './auth/auth';\nimport { createVendors } from './vendors/vendors';\n\nexport type DeveloperPortalFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport type DeveloperPortalClientInitOptions = Omit<ClientInitOptions, 'auth' | 'middlewares'> & {\n  middlewares?: MiddlewareFn[];\n  /**\n   * Stamps the id token. A middleware rather than the `auth: AuthStrategy` other clients take, because\n   * apps-api's token rotates and a header baked in at construction would go stale. Supplied by\n   * `createDeveloperPortalSdk`; omit it for the spec's `security: []` operations.\n   */\n  authMiddleware?: MiddlewareFn;\n};\n\n/**\n * The Developer Portal (apps-api) client. Paths and types are generated from\n * `https://apps-api.keboola.com/docs/openapi.yaml` — see `redocly.yaml` and `pnpm gen:types`.\n *\n * Two fetch clients because the spec splits its operations: `security: []` ones must go out\n * unauthenticated, and four authenticate with the access or refresh token instead of the id token.\n */\nexport const createDeveloperPortalClient = ({\n  baseUrl,\n  middlewares = [],\n  authMiddleware,\n}: DeveloperPortalClientInitOptions) => {\n  const publicClient = createOpenapiFetchClient<paths>({ baseUrl, middlewares });\n  const client = authMiddleware\n    ? createOpenapiFetchClient<paths>({ baseUrl, middlewares: [authMiddleware, ...middlewares] })\n    : publicClient;\n\n  /** `GET /` — the spec's service index. */\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/', {}, { signal });\n    return data;\n  };\n\n  return {\n    healthCheck,\n    auth: createAuth({ client, publicClient }),\n    vendors: createVendors({ client, publicClient }),\n    apps: createApps({ client, publicClient }),\n    admin: createAdmin(client),\n  };\n};\n\nexport type DeveloperPortalClient = ReturnType<typeof createDeveloperPortalClient>;\n"],"mappings":";;;;AAaA,MAAa,eAAe,WAAuC;CACjE,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EACjE,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,kBAAkB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAA8B,CAAC,GAAG,WAAyB;EAChF,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,eAAe,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAY,WAAyB;EACzD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,IAAY,MAA6B,WAAyB;EACzF,MAAM,EAAE,SAAS,MAAM,OAAO,MAAM,oBAAoB;GAAE,MAAM,EAAE,GAAG;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;EAC1F,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,IAAY,WAAyB;EAC7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;EAC3F,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,IAAY,MAAsB,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,2BACA;GAAE,MAAM,EAAE,GAAG;GAAG;EAAK,GACrB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,UAAkB,WAAyB;EACnE,MAAM,OAAO,OAAO,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACnF;;CAGA,MAAM,eAAe,OAAO,UAAkB,WAAyB;EACrE,MAAM,OAAO,OAAO,+BAA+B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACvF;CAEA,MAAM,kBAAkB,OAAO,UAAkB,QAAgB,WAAyB;EACxF,MAAM,OAAO,KACX,4CACA,EAAE,MAAM;GAAE;GAAU;EAAO,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,uBAAuB,OAAO,UAAkB,QAAgB,WAAyB;EAC7F,MAAM,OAAO,OACX,4CACA,EAAE,MAAM;GAAE;GAAU;EAAO,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,iBAAiB,OAAO,UAAkB,WAAyB;EACvE,MAAM,OAAO,KAAK,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACvF;CAEA,MAAM,kBAAkB,OAAO,UAAkB,WAAyB;EACxE,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACzF;CAEA,MAAM,aAAa,OAAO,QAA8B,CAAC,GAAG,WAAyB;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,kBAAkB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,MAAgC,WAAyB;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OACnB,QACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,QAAgB,WAAyB;EACnE,MAAM,OAAO,OAAO,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;CACjF;;CAGA,MAAM,gBAAgB,OAAO,QAAgB,MAA0B,WAAyB;EAC9F,MAAM,OAAO,KAAK,mCAAmC;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;CAC7F;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACjIA,MAAa,cAAc,EAAE,QAAQ,mBAAyB;;CAE5D,MAAM,mBAAmB,OAAO,QAAsB,CAAC,GAAG,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,KAAa,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAAgB,QAAyB,CAAC,GAAG,WAAyB;EAC3F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,0BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,QAAgB,KAAa,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,MAAsB,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAChB,QACA,KACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,gCACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAK,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,KAAa,WAAyB;EAC7E,MAAM,OAAO,OAAO,gCAAgC,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GAAG,EAAE,OAAO,CAAC;CAC3F;CAEA,MAAM,uBAAuB,OAAO,QAAgB,KAAa,WAAyB;EACxF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,wCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,eAAe,OACnB,QACA,KACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0CACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAK,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,iBAAiB,OACrB,QACA,KACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,yCACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAM,GAC/B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OACpB,QACA,KACA,SACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,mDACA,EAAE,MAAM;GAAE;GAAQ;GAAK;EAAQ,EAAE,GACjC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,qBAAqB,OACzB,QACA,KACA,SACA,WACG;EACH,MAAM,OAAO,KACX,4DACA,EAAE,MAAM;GAAE;GAAQ;GAAK;EAAQ,EAAE,GACjC,EAAE,OAAO,CACX;CACF;CAEA,MAAM,mBAAmB,OAAO,QAAgB,KAAa,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2CACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,0BAA0B,OAAO,QAAgB,KAAa,WAAyB;EAC3F,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,qCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;AAOA,MAAa,gBAAgB,OAC3B,WACA,KACA,WACkB;CAClB,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,MAAM;EACN,SAAS,EAAE,gBAAgB,YAAY;EACvC;CACF,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,uBAAuB,SAAS,OAAO,GAAG,SAAS,YAAY;AAEnF;;;;AClLA,MAAa,cAAc,WAA2C,GACnEA,0BAAAA,WAAW,gBAAgB,MAC9B;;;ACAA,MAAa,0BAA0B,WACrC,EAAE,WAAW;AAEf,MAAa,cAAc,EAAE,QAAQ,mBAAyB;CAC5D,MAAM,QAAQ,OAAO,MAAkB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,aAAa,KAAK,eAAe,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAmB,WAAyB;EAChE,MAAM,aAAa,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC9D;CAEA,MAAM,iBAAiB,OAAO,MAA2B,WAAyB;EAChF,MAAM,aAAa,KAAK,iBAAiB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC/D;;CAGA,MAAM,uBAAuB,OAAO,OAAe,MAAc,WAAyB;EACxF,MAAM,aAAa,KAAK,gCAAgC,EAAE,MAAM;GAAE;GAAO;EAAK,EAAE,GAAG,EAAE,OAAO,CAAC;CAC/F;;;;;;CAOA,MAAM,gBAAgB,OAAO,cAAsB,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,aAAa,IAClC,eACA,CAAC,GACD;GAAE,SAAS,WAAW,YAAY;GAAG;EAAO,CAC9C;EACA,OAAO;CACT;;CAGA,MAAM,SAAS,OAAO,aAAqB,WAAyB;EAClE,MAAM,aAAa,KAAK,gBAAgB,CAAC,GAAG;GAAE,SAAS,WAAW,WAAW;GAAG;EAAO,CAAC;CAC1F;CAEA,MAAM,aAAa,OAAO,WAAyB;EACjD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EACjE,OAAO;CACT;CAEA,MAAM,uBAAuB,OAAO,OAAe,WAAyB;EAC1E,MAAM,aAAa,KAAK,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;CACjF;CAEA,MAAM,uBAAuB,OAC3B,OACA,MACA,WACG;EACH,MAAM,aAAa,KAAK,gCAAgC;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;CAC/F;CAKA,MAAM,WAAW,OACf,EAAE,SAAS,eACX,WACG;EACH,MAAM,EAAE,SAAS,MAAM,aAAa,KAClC,aACA,EAAE,MAAM,EAAE,YAAY,EAAE,GACxB;GAAE,SAAS,WAAW,OAAO;GAAG;EAAO,CACzC;EACA,OAAO;CACT;CAEA,MAAM,aAAa,OACjB,EAAE,SAAS,aAAa,QACxB,WACG;EACH,MAAM,aAAa,KACjB,qBACA,EAAE,MAAM;GAAE;GAAa;EAAK,EAAE,GAC9B;GAAE,SAAS,WAAW,OAAO;GAAG;EAAO,CACzC;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACnGA,MAAa,iBAAiB,EAAE,QAAQ,mBAAyB;CAC/D,MAAM,aAAa,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,WAAyB;EAChE,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;EAC7F,OAAO;CACT;;CAGA,MAAM,eAAe,OAAO,MAAyB,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,YAAY,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACnE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,QAAgB,MAAyB,WAAyB;EAC5F,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,qBACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,iBAAiB,OACrB,QACA,QAA6B,CAAC,GAC9B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,0BAA0B,OAAO,QAAgB,WAAyB;EAC9E,MAAM,OAAO,KAAK,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;CAC/E;CAEA,MAAM,oBAAoB,OAAO,QAAgB,UAAkB,WAAyB;EAC1F,MAAM,OAAO,KACX,sCACA,EAAE,MAAM;GAAE;GAAQ;EAAS,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,mBAAmB,OAAO,QAAgB,UAAkB,WAAyB;EACzF,MAAM,OAAO,OACX,sCACA,EAAE,MAAM;GAAE;GAAQ;EAAS,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,wBAAwB,OAC5B,QACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,mCACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,uBAAuB,OAAO,QAAgB,OAAe,WAAyB;EAC1F,MAAM,OAAO,KACX,yCACA,EAAE,MAAM;GAAE;GAAQ;EAAM,EAAE,GAC1B,EAAE,OAAO,CACX;CACF;;CAGA,MAAM,yBAAyB,OAC7B,QACA,OACA,MACA,WACG;EACH,MAAM,aAAa,IACjB,gDACA,EAAE,MAAM;GAAE;GAAQ;GAAO;EAAK,EAAE,GAChC,EAAE,OAAO,CACX;CACF;;CAGA,MAAM,qBAAqB,OACzB,QACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG,OAAO;IAAE,GAAG;IAAO,SAAS;GAAE;EAAE,GACpD,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,uBAAuB,OAC3B,QACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iCACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;;AC7HA,MAAa,+BAA+B,EAC1C,SACA,cAAc,CAAC,GACf,qBACsC;CACtC,MAAM,eAAeC,iCAAAA,yBAAgC;EAAE;EAAS;CAAY,CAAC;CAC7E,MAAM,SAAS,iBACXA,iCAAAA,yBAAgC;EAAE;EAAS,aAAa,CAAC,gBAAgB,GAAG,WAAW;CAAE,CAAC,IAC1F;;CAGJ,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAC3D,OAAO;CACT;CAEA,OAAO;EACL;EACA,MAAM,WAAW;GAAE;GAAQ;EAAa,CAAC;EACzC,SAAS,cAAc;GAAE;GAAQ;EAAa,CAAC;EAC/C,MAAM,WAAW;GAAE;GAAQ;EAAa,CAAC;EACzC,OAAO,YAAY,MAAM;CAC3B;AACF"}

package/dist/{developerPortalClient-5ABcxz1U.js → developerPortalClient-jk46sjwP.js}

@@ -1,5 +1,5 @@
-import { o as HttpHeader } from "./createFetchClient-B1h3-p65.js";
-import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-0_oqhdPv.js";
+import { s as HttpHeader } from "./createFetchClient-DdyZMhxO.js";
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-E7OIVkYv.js";
 //#region src/clients/developerPortal/admin/admin.ts
 /** Keboola staff only. Every method 403s for a non-admin token; the UI gates on `custom:isAdmin`. */
 const createAdmin = (client) => {
@@ -482,4 +482,4 @@ const createDeveloperPortalClient = ({ baseUrl, middlewares = [], authMiddleware
 //#endregion
 export { uploadAppIcon as i, isMfaChallengeResponse as n, authHeader as r, createDeveloperPortalClient as t };
 
-//# sourceMappingURL=developerPortalClient-5ABcxz1U.js.map
+//# sourceMappingURL=developerPortalClient-jk46sjwP.js.map

package/dist/{developerPortalClient-5ABcxz1U.js.map → developerPortalClient-jk46sjwP.js.map}

@@ -1 +1 @@
-{"version":3,"file":"developerPortalClient-5ABcxz1U.js","names":[],"sources":["../src/clients/developerPortal/admin/admin.ts","../src/clients/developerPortal/apps/apps.ts","../src/clients/developerPortal/tokens.ts","../src/clients/developerPortal/auth/auth.ts","../src/clients/developerPortal/vendors/vendors.ts","../src/clients/developerPortal/developerPortalClient.ts"],"sourcesContent":["import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  AdminPaginationQuery,\n  ApproveVendorInput,\n  CreateVendorAsAdminInput,\n  GetChangesQuery,\n  PaginationQuery,\n  RejectAppInput,\n  UpdateAppAsAdminInput,\n  UpdateVendorAsAdminInput,\n} from '../types';\n\n/** Keboola staff only. Every method 403s for a non-admin token; the UI gates on `custom:isAdmin`. */\nexport const createAdmin = (client: DeveloperPortalFetchClient) => {\n  const getStacks = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/stacks', {}, { signal });\n    return data;\n  };\n\n  const getChanges = async (query: GetChangesQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/changes', { query }, { signal });\n    return data;\n  };\n\n  const getApps = async (query: AdminPaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/apps', { query }, { signal });\n    return data;\n  };\n\n  const getApp = async (id: string, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/apps/{id}', { path: { id } }, { signal });\n    return data;\n  };\n\n  const updateApp = async (id: string, body: UpdateAppAsAdminInput, signal?: AbortSignal) => {\n    const { data } = await client.patch('/admin/apps/{id}', { path: { id }, body }, { signal });\n    return data;\n  };\n\n  const publishApp = async (id: string, signal?: AbortSignal) => {\n    const { data } = await client.post('/admin/apps/{id}/publish', { path: { id } }, { signal });\n    return data;\n  };\n\n  const rejectApp = async (id: string, body: RejectAppInput, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/admin/apps/{id}/reject',\n      { path: { id }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getUsers = async (query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/users', { query }, { signal });\n    return data;\n  };\n\n  const deleteUser = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}', { path: { username } }, { signal });\n  };\n\n  /** Clears the user's MFA enrolment so they can re-enrol — the account-recovery path. */\n  const resetUserMfa = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}/mfa', { path: { username } }, { signal });\n  };\n\n  const addUserToVendor = async (username: string, vendor: string, signal?: AbortSignal) => {\n    await client.post(\n      '/admin/users/{username}/vendors/{vendor}',\n      { path: { username, vendor } },\n      { signal },\n    );\n  };\n\n  const removeUserFromVendor = async (username: string, vendor: string, signal?: AbortSignal) => {\n    await client.delete(\n      '/admin/users/{username}/vendors/{vendor}',\n      { path: { username, vendor } },\n      { signal },\n    );\n  };\n\n  const grantUserAdmin = async (username: string, signal?: AbortSignal) => {\n    await client.post('/admin/users/{username}/admin', { path: { username } }, { signal });\n  };\n\n  const revokeUserAdmin = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}/admin', { path: { username } }, { signal });\n  };\n\n  const getVendors = async (query: AdminPaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/vendors', { query }, { signal });\n    return data;\n  };\n\n  const createVendor = async (body: CreateVendorAsAdminInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/admin/vendors', { body }, { signal });\n    return data;\n  };\n\n  const updateVendor = async (\n    vendor: string,\n    body: UpdateVendorAsAdminInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.patch(\n      '/admin/vendors/{vendor}',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const deleteVendor = async (vendor: string, signal?: AbortSignal) => {\n    await client.delete('/admin/vendors/{vendor}', { path: { vendor } }, { signal });\n  };\n\n  /** Swaps a pending `_v`-prefixed id for the permanent one carried in the body. */\n  const approveVendor = async (vendor: string, body: ApproveVendorInput, signal?: AbortSignal) => {\n    await client.post('/admin/vendors/{vendor}/approve', { path: { vendor }, body }, { signal });\n  };\n\n  return {\n    getStacks,\n    getChanges,\n    getApps,\n    getApp,\n    updateApp,\n    publishApp,\n    rejectApp,\n    getUsers,\n    deleteUser,\n    resetUserMfa,\n    addUserToVendor,\n    removeUserFromVendor,\n    grantUserAdmin,\n    revokeUserAdmin,\n    getVendors,\n    createVendor,\n    updateVendor,\n    deleteVendor,\n    approveVendor,\n  };\n};\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  CreateAppInput,\n  DeprecateAppInput,\n  GetAppsQuery,\n  PaginationQuery,\n  UpdateAppInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** `GET /apps` and `GET /apps/{app}` are `security: []` in the spec. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const createApps = ({ client, publicClient }: Deps) => {\n  /** The public catalog: scoped server-side to published components. */\n  const getPublishedApps = async (query: GetAppsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/apps', { query }, { signal });\n    return data;\n  };\n\n  const getPublishedApp = async (app: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/apps/{app}', { path: { app } }, { signal });\n    return data;\n  };\n\n  const getApps = async (vendor: string, query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const getApp = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createApp = async (vendor: string, body: CreateAppInput, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const updateApp = async (\n    vendor: string,\n    app: string,\n    body: UpdateAppInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.patch(\n      '/vendors/{vendor}/apps/{app}',\n      { path: { vendor, app }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const deleteApp = async (vendor: string, app: string, signal?: AbortSignal) => {\n    await client.delete('/vendors/{vendor}/apps/{app}', { path: { vendor, app } }, { signal });\n  };\n\n  const requestAppPublishing = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/publish',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  const deprecateApp = async (\n    vendor: string,\n    app: string,\n    body: DeprecateAppInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/deprecate',\n      { path: { vendor, app }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getAppVersions = async (\n    vendor: string,\n    app: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/versions',\n      { path: { vendor, app }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const getAppVersion = async (\n    vendor: string,\n    app: string,\n    version: string,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/versions/{version}',\n      { path: { vendor, app, version } },\n      { signal },\n    );\n    return data;\n  };\n\n  const rollbackAppVersion = async (\n    vendor: string,\n    app: string,\n    version: string,\n    signal?: AbortSignal,\n  ) => {\n    await client.post(\n      '/vendors/{vendor}/apps/{app}/versions/{version}/rollback',\n      { path: { vendor, app, version } },\n      { signal },\n    );\n  };\n\n  const getAppRepository = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/repository',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  /** Requests a presigned S3 upload link; the upload itself is {@link uploadAppIcon}. */\n  const createAppIconUploadLink = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/icon',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  return {\n    getPublishedApps,\n    getPublishedApp,\n    getApps,\n    getApp,\n    createApp,\n    updateApp,\n    deleteApp,\n    requestAppPublishing,\n    deprecateApp,\n    getAppVersions,\n    getAppVersion,\n    rollbackAppVersion,\n    getAppRepository,\n    createAppIconUploadLink,\n  };\n};\n\n/**\n * Uploads the icon to the presigned URL from `createAppIconUploadLink`. Deliberately a bare `fetch`:\n * the URL carries its own signature in the query string, and sending our `Authorization` header to\n * S3 makes it reject the request.\n */\nexport const uploadAppIcon = async (\n  uploadUrl: string,\n  png: Blob,\n  signal?: AbortSignal,\n): Promise<void> => {\n  const response = await fetch(uploadUrl, {\n    method: 'PUT',\n    body: png,\n    headers: { 'Content-Type': 'image/png' },\n    signal,\n  });\n\n  if (!response.ok) {\n    throw new Error(`Icon upload failed: ${response.status} ${response.statusText}`);\n  }\n};\n","import { HttpHeader } from '../../fetchClient';\n\n/**\n * The Cognito token trio apps-api issues. `token` is the id token: stamped on almost every call, and\n * the header on both MFA calls. `refreshToken` authenticates `GET /auth/token`. `accessToken`\n * authenticates `POST /auth/logout` as a header, and both `POST /auth/mfa` and `/auth/mfa/confirm`\n * in the **body** — which is why those two stay off the refresh-and-replay path.\n */\nexport type DeveloperPortalTokens = {\n  token: string;\n  accessToken: string;\n  refreshToken: string;\n};\n\n/** Raw token, no `Bearer` prefix — see the spec's `bearerAuth` scheme (`type: apiKey`). */\nexport const authHeader = (token: string): Record<string, string> => ({\n  [HttpHeader.AUTHORIZATION]: token,\n});\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport { authHeader } from '../tokens';\nimport type {\n  ConfirmAccountInput,\n  LoginChallenge,\n  LoginInput,\n  LoginResult,\n  ResetPasswordConfirmInput,\n  SignUpInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** The spec's `security: []` operations, plus the four that bring their own token. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const isMfaChallengeResponse = (result: LoginResult): result is LoginChallenge =>\n  !('token' in result);\n\nexport const createAuth = ({ client, publicClient }: Deps) => {\n  const login = async (body: LoginInput, signal?: AbortSignal) => {\n    const { data } = await publicClient.post('/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const signUp = async (body: SignUpInput, signal?: AbortSignal) => {\n    await publicClient.post('/auth/signup', { body }, { signal });\n  };\n\n  const confirmAccount = async (body: ConfirmAccountInput, signal?: AbortSignal) => {\n    await publicClient.post('/auth/confirm', { body }, { signal });\n  };\n\n  /** Confirms via the emailed link's path segments, for a consumer echoing that link. */\n  const confirmAccountByCode = async (email: string, code: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/confirm/{email}/{code}', { path: { email, code } }, { signal });\n  };\n\n  /**\n   * Rotates the trio, authenticated with the **refresh** token, on the auth-free client so a\n   * rotation triggered by the auth middleware cannot recurse into it. The response carries no new\n   * refresh token, so the caller carries the one it has forward.\n   */\n  const refreshTokens = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get(\n      '/auth/token',\n      {},\n      { headers: authHeader(refreshToken), signal },\n    );\n    return data;\n  };\n\n  /** Authenticated with the **access** token. Clear local state regardless of the outcome. */\n  const logout = async (accessToken: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/logout', {}, { headers: authHeader(accessToken), signal });\n  };\n\n  const getProfile = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/auth/profile', {}, { signal });\n    return data;\n  };\n\n  const requestPasswordReset = async (email: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/forgot/{email}', { path: { email } }, { signal });\n  };\n\n  const confirmPasswordReset = async (\n    email: string,\n    body: ResetPasswordConfirmInput,\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.post('/auth/forgot/{email}/confirm', { path: { email }, body }, { signal });\n  };\n\n  // `setupMfa` and `confirmMfa` each take two of the three tokens: the auth token in the header, the\n  // access token in the body. Both sit on the auth-free client, which keeps them out of the\n  // middleware's refresh-and-replay: restamping a header cannot fix a stale token in a body.\n  const setupMfa = async (\n    { idToken, accessToken }: { idToken: string; accessToken: string },\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await publicClient.post(\n      '/auth/mfa',\n      { body: { accessToken } },\n      { headers: authHeader(idToken), signal },\n    );\n    return data;\n  };\n\n  const confirmMfa = async (\n    { idToken, accessToken, code }: { idToken: string; accessToken: string; code: string },\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.post(\n      '/auth/mfa/confirm',\n      { body: { accessToken, code } },\n      { headers: authHeader(idToken), signal },\n    );\n  };\n\n  return {\n    login,\n    signUp,\n    confirmAccount,\n    confirmAccountByCode,\n    refreshTokens,\n    logout,\n    getProfile,\n    requestPasswordReset,\n    confirmPasswordReset,\n    setupMfa,\n    confirmMfa,\n  };\n};\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  CreateServiceAccountInput,\n  CreateVendorInput,\n  GetVendorUsersQuery,\n  PaginationQuery,\n  UpdateVendorInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** `GET /vendors` and `GET /vendors/{vendor}` are `security: []` in the spec. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const createVendors = ({ client, publicClient }: Deps) => {\n  const getVendors = async (query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/vendors', { query }, { signal });\n    return data;\n  };\n\n  const getVendor = async (vendor: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/vendors/{vendor}', { path: { vendor } }, { signal });\n    return data;\n  };\n\n  /** Self-service registration. The vendor is pending, under a temporary `_v`-prefixed id. */\n  const createVendor = async (body: CreateVendorInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/vendors', { body }, { signal });\n    return data;\n  };\n\n  const updateVendor = async (vendor: string, body: UpdateVendorInput, signal?: AbortSignal) => {\n    const { data } = await client.patch(\n      '/vendors/{vendor}',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getVendorUsers = async (\n    vendor: string,\n    query: GetVendorUsersQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/users',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  /** Requests membership of a vendor for the signed-in user. */\n  const requestVendorMembership = async (vendor: string, signal?: AbortSignal) => {\n    await client.post('/vendors/{vendor}/users', { path: { vendor } }, { signal });\n  };\n\n  const approveVendorUser = async (vendor: string, username: string, signal?: AbortSignal) => {\n    await client.post(\n      '/vendors/{vendor}/users/{username}',\n      { path: { vendor, username } },\n      { signal },\n    );\n  };\n\n  const removeVendorUser = async (vendor: string, username: string, signal?: AbortSignal) => {\n    await client.delete(\n      '/vendors/{vendor}/users/{username}',\n      { path: { vendor, username } },\n      { signal },\n    );\n  };\n\n  const getVendorUserRequests = async (\n    vendor: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/user-requests',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const sendVendorInvitation = async (vendor: string, email: string, signal?: AbortSignal) => {\n    await client.post(\n      '/vendors/{vendor}/invitations/{email}',\n      { path: { vendor, email } },\n      { signal },\n    );\n  };\n\n  /** `security: []` — the invitee follows the emailed link before they have a session. */\n  const acceptVendorInvitation = async (\n    vendor: string,\n    email: string,\n    code: string,\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.get(\n      '/vendors/{vendor}/invitations/{email}/{code}',\n      { path: { vendor, email, code } },\n      { signal },\n    );\n  };\n\n  /** `service=1` filters the member list; there is no distinct endpoint. */\n  const getServiceAccounts = async (\n    vendor: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/users',\n      { path: { vendor }, query: { ...query, service: 1 } },\n      { signal },\n    );\n    return data;\n  };\n\n  /** The returned `password` is shown once and is not retrievable afterwards. */\n  const createServiceAccount = async (\n    vendor: string,\n    body: CreateServiceAccountInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/credentials',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  return {\n    getVendors,\n    getVendor,\n    createVendor,\n    updateVendor,\n    getVendorUsers,\n    requestVendorMembership,\n    approveVendorUser,\n    removeVendorUser,\n    getVendorUserRequests,\n    sendVendorInvitation,\n    acceptVendorInvitation,\n    getServiceAccounts,\n    createServiceAccount,\n  };\n};\n","import { createOpenapiFetchClient, type MiddlewareFn } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createAdmin } from './admin/admin';\nimport { createApps } from './apps/apps';\nimport { createAuth } from './auth/auth';\nimport { createVendors } from './vendors/vendors';\n\nexport type DeveloperPortalFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport type DeveloperPortalClientInitOptions = Omit<ClientInitOptions, 'auth' | 'middlewares'> & {\n  middlewares?: MiddlewareFn[];\n  /**\n   * Stamps the id token. A middleware rather than the `auth: AuthStrategy` other clients take, because\n   * apps-api's token rotates and a header baked in at construction would go stale. Supplied by\n   * `createDeveloperPortalSdk`; omit it for the spec's `security: []` operations.\n   */\n  authMiddleware?: MiddlewareFn;\n};\n\n/**\n * The Developer Portal (apps-api) client. Paths and types are generated from\n * `https://apps-api.keboola.com/docs/openapi.yaml` — see `redocly.yaml` and `pnpm gen:types`.\n *\n * Two fetch clients because the spec splits its operations: `security: []` ones must go out\n * unauthenticated, and four authenticate with the access or refresh token instead of the id token.\n */\nexport const createDeveloperPortalClient = ({\n  baseUrl,\n  middlewares = [],\n  authMiddleware,\n}: DeveloperPortalClientInitOptions) => {\n  const publicClient = createOpenapiFetchClient<paths>({ baseUrl, middlewares });\n  const client = authMiddleware\n    ? createOpenapiFetchClient<paths>({ baseUrl, middlewares: [authMiddleware, ...middlewares] })\n    : publicClient;\n\n  /** `GET /` — the spec's service index. */\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/', {}, { signal });\n    return data;\n  };\n\n  return {\n    healthCheck,\n    auth: createAuth({ client, publicClient }),\n    vendors: createVendors({ client, publicClient }),\n    apps: createApps({ client, publicClient }),\n    admin: createAdmin(client),\n  };\n};\n\nexport type DeveloperPortalClient = ReturnType<typeof createDeveloperPortalClient>;\n"],"mappings":";;;;AAaA,MAAa,eAAe,WAAuC;CACjE,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EACjE,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,kBAAkB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAA8B,CAAC,GAAG,WAAyB;EAChF,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,eAAe,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAY,WAAyB;EACzD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,IAAY,MAA6B,WAAyB;EACzF,MAAM,EAAE,SAAS,MAAM,OAAO,MAAM,oBAAoB;GAAE,MAAM,EAAE,GAAG;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;EAC1F,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,IAAY,WAAyB;EAC7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;EAC3F,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,IAAY,MAAsB,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,2BACA;GAAE,MAAM,EAAE,GAAG;GAAG;EAAK,GACrB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,UAAkB,WAAyB;EACnE,MAAM,OAAO,OAAO,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACnF;;CAGA,MAAM,eAAe,OAAO,UAAkB,WAAyB;EACrE,MAAM,OAAO,OAAO,+BAA+B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACvF;CAEA,MAAM,kBAAkB,OAAO,UAAkB,QAAgB,WAAyB;EACxF,MAAM,OAAO,KACX,4CACA,EAAE,MAAM;GAAE;GAAU;EAAO,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,uBAAuB,OAAO,UAAkB,QAAgB,WAAyB;EAC7F,MAAM,OAAO,OACX,4CACA,EAAE,MAAM;GAAE;GAAU;EAAO,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,iBAAiB,OAAO,UAAkB,WAAyB;EACvE,MAAM,OAAO,KAAK,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACvF;CAEA,MAAM,kBAAkB,OAAO,UAAkB,WAAyB;EACxE,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACzF;CAEA,MAAM,aAAa,OAAO,QAA8B,CAAC,GAAG,WAAyB;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,kBAAkB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,MAAgC,WAAyB;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OACnB,QACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,QAAgB,WAAyB;EACnE,MAAM,OAAO,OAAO,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;CACjF;;CAGA,MAAM,gBAAgB,OAAO,QAAgB,MAA0B,WAAyB;EAC9F,MAAM,OAAO,KAAK,mCAAmC;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;CAC7F;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACjIA,MAAa,cAAc,EAAE,QAAQ,mBAAyB;;CAE5D,MAAM,mBAAmB,OAAO,QAAsB,CAAC,GAAG,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,KAAa,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAAgB,QAAyB,CAAC,GAAG,WAAyB;EAC3F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,0BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,QAAgB,KAAa,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,MAAsB,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAChB,QACA,KACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,gCACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAK,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,KAAa,WAAyB;EAC7E,MAAM,OAAO,OAAO,gCAAgC,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GAAG,EAAE,OAAO,CAAC;CAC3F;CAEA,MAAM,uBAAuB,OAAO,QAAgB,KAAa,WAAyB;EACxF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,wCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,eAAe,OACnB,QACA,KACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0CACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAK,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,iBAAiB,OACrB,QACA,KACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,yCACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAM,GAC/B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OACpB,QACA,KACA,SACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,mDACA,EAAE,MAAM;GAAE;GAAQ;GAAK;EAAQ,EAAE,GACjC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,qBAAqB,OACzB,QACA,KACA,SACA,WACG;EACH,MAAM,OAAO,KACX,4DACA,EAAE,MAAM;GAAE;GAAQ;GAAK;EAAQ,EAAE,GACjC,EAAE,OAAO,CACX;CACF;CAEA,MAAM,mBAAmB,OAAO,QAAgB,KAAa,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2CACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,0BAA0B,OAAO,QAAgB,KAAa,WAAyB;EAC3F,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,qCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;AAOA,MAAa,gBAAgB,OAC3B,WACA,KACA,WACkB;CAClB,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,MAAM;EACN,SAAS,EAAE,gBAAgB,YAAY;EACvC;CACF,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,uBAAuB,SAAS,OAAO,GAAG,SAAS,YAAY;AAEnF;;;;AClLA,MAAa,cAAc,WAA2C,GACnE,WAAW,gBAAgB,MAC9B;;;ACAA,MAAa,0BAA0B,WACrC,EAAE,WAAW;AAEf,MAAa,cAAc,EAAE,QAAQ,mBAAyB;CAC5D,MAAM,QAAQ,OAAO,MAAkB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,aAAa,KAAK,eAAe,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAmB,WAAyB;EAChE,MAAM,aAAa,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC9D;CAEA,MAAM,iBAAiB,OAAO,MAA2B,WAAyB;EAChF,MAAM,aAAa,KAAK,iBAAiB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC/D;;CAGA,MAAM,uBAAuB,OAAO,OAAe,MAAc,WAAyB;EACxF,MAAM,aAAa,KAAK,gCAAgC,EAAE,MAAM;GAAE;GAAO;EAAK,EAAE,GAAG,EAAE,OAAO,CAAC;CAC/F;;;;;;CAOA,MAAM,gBAAgB,OAAO,cAAsB,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,aAAa,IAClC,eACA,CAAC,GACD;GAAE,SAAS,WAAW,YAAY;GAAG;EAAO,CAC9C;EACA,OAAO;CACT;;CAGA,MAAM,SAAS,OAAO,aAAqB,WAAyB;EAClE,MAAM,aAAa,KAAK,gBAAgB,CAAC,GAAG;GAAE,SAAS,WAAW,WAAW;GAAG;EAAO,CAAC;CAC1F;CAEA,MAAM,aAAa,OAAO,WAAyB;EACjD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EACjE,OAAO;CACT;CAEA,MAAM,uBAAuB,OAAO,OAAe,WAAyB;EAC1E,MAAM,aAAa,KAAK,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;CACjF;CAEA,MAAM,uBAAuB,OAC3B,OACA,MACA,WACG;EACH,MAAM,aAAa,KAAK,gCAAgC;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;CAC/F;CAKA,MAAM,WAAW,OACf,EAAE,SAAS,eACX,WACG;EACH,MAAM,EAAE,SAAS,MAAM,aAAa,KAClC,aACA,EAAE,MAAM,EAAE,YAAY,EAAE,GACxB;GAAE,SAAS,WAAW,OAAO;GAAG;EAAO,CACzC;EACA,OAAO;CACT;CAEA,MAAM,aAAa,OACjB,EAAE,SAAS,aAAa,QACxB,WACG;EACH,MAAM,aAAa,KACjB,qBACA,EAAE,MAAM;GAAE;GAAa;EAAK,EAAE,GAC9B;GAAE,SAAS,WAAW,OAAO;GAAG;EAAO,CACzC;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACnGA,MAAa,iBAAiB,EAAE,QAAQ,mBAAyB;CAC/D,MAAM,aAAa,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,WAAyB;EAChE,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;EAC7F,OAAO;CACT;;CAGA,MAAM,eAAe,OAAO,MAAyB,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,YAAY,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACnE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,QAAgB,MAAyB,WAAyB;EAC5F,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,qBACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,iBAAiB,OACrB,QACA,QAA6B,CAAC,GAC9B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,0BAA0B,OAAO,QAAgB,WAAyB;EAC9E,MAAM,OAAO,KAAK,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;CAC/E;CAEA,MAAM,oBAAoB,OAAO,QAAgB,UAAkB,WAAyB;EAC1F,MAAM,OAAO,KACX,sCACA,EAAE,MAAM;GAAE;GAAQ;EAAS,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,mBAAmB,OAAO,QAAgB,UAAkB,WAAyB;EACzF,MAAM,OAAO,OACX,sCACA,EAAE,MAAM;GAAE;GAAQ;EAAS,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,wBAAwB,OAC5B,QACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,mCACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,uBAAuB,OAAO,QAAgB,OAAe,WAAyB;EAC1F,MAAM,OAAO,KACX,yCACA,EAAE,MAAM;GAAE;GAAQ;EAAM,EAAE,GAC1B,EAAE,OAAO,CACX;CACF;;CAGA,MAAM,yBAAyB,OAC7B,QACA,OACA,MACA,WACG;EACH,MAAM,aAAa,IACjB,gDACA,EAAE,MAAM;GAAE;GAAQ;GAAO;EAAK,EAAE,GAChC,EAAE,OAAO,CACX;CACF;;CAGA,MAAM,qBAAqB,OACzB,QACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG,OAAO;IAAE,GAAG;IAAO,SAAS;GAAE;EAAE,GACpD,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,uBAAuB,OAC3B,QACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iCACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;;AC7HA,MAAa,+BAA+B,EAC1C,SACA,cAAc,CAAC,GACf,qBACsC;CACtC,MAAM,eAAe,yBAAgC;EAAE;EAAS;CAAY,CAAC;CAC7E,MAAM,SAAS,iBACX,yBAAgC;EAAE;EAAS,aAAa,CAAC,gBAAgB,GAAG,WAAW;CAAE,CAAC,IAC1F;;CAGJ,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAC3D,OAAO;CACT;CAEA,OAAO;EACL;EACA,MAAM,WAAW;GAAE;GAAQ;EAAa,CAAC;EACzC,SAAS,cAAc;GAAE;GAAQ;EAAa,CAAC;EAC/C,MAAM,WAAW;GAAE;GAAQ;EAAa,CAAC;EACzC,OAAO,YAAY,MAAM;CAC3B;AACF"}
+{"version":3,"file":"developerPortalClient-jk46sjwP.js","names":[],"sources":["../src/clients/developerPortal/admin/admin.ts","../src/clients/developerPortal/apps/apps.ts","../src/clients/developerPortal/tokens.ts","../src/clients/developerPortal/auth/auth.ts","../src/clients/developerPortal/vendors/vendors.ts","../src/clients/developerPortal/developerPortalClient.ts"],"sourcesContent":["import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  AdminPaginationQuery,\n  ApproveVendorInput,\n  CreateVendorAsAdminInput,\n  GetChangesQuery,\n  PaginationQuery,\n  RejectAppInput,\n  UpdateAppAsAdminInput,\n  UpdateVendorAsAdminInput,\n} from '../types';\n\n/** Keboola staff only. Every method 403s for a non-admin token; the UI gates on `custom:isAdmin`. */\nexport const createAdmin = (client: DeveloperPortalFetchClient) => {\n  const getStacks = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/stacks', {}, { signal });\n    return data;\n  };\n\n  const getChanges = async (query: GetChangesQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/changes', { query }, { signal });\n    return data;\n  };\n\n  const getApps = async (query: AdminPaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/apps', { query }, { signal });\n    return data;\n  };\n\n  const getApp = async (id: string, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/apps/{id}', { path: { id } }, { signal });\n    return data;\n  };\n\n  const updateApp = async (id: string, body: UpdateAppAsAdminInput, signal?: AbortSignal) => {\n    const { data } = await client.patch('/admin/apps/{id}', { path: { id }, body }, { signal });\n    return data;\n  };\n\n  const publishApp = async (id: string, signal?: AbortSignal) => {\n    const { data } = await client.post('/admin/apps/{id}/publish', { path: { id } }, { signal });\n    return data;\n  };\n\n  const rejectApp = async (id: string, body: RejectAppInput, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/admin/apps/{id}/reject',\n      { path: { id }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getUsers = async (query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/users', { query }, { signal });\n    return data;\n  };\n\n  const deleteUser = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}', { path: { username } }, { signal });\n  };\n\n  /** Clears the user's MFA enrolment so they can re-enrol — the account-recovery path. */\n  const resetUserMfa = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}/mfa', { path: { username } }, { signal });\n  };\n\n  const addUserToVendor = async (username: string, vendor: string, signal?: AbortSignal) => {\n    await client.post(\n      '/admin/users/{username}/vendors/{vendor}',\n      { path: { username, vendor } },\n      { signal },\n    );\n  };\n\n  const removeUserFromVendor = async (username: string, vendor: string, signal?: AbortSignal) => {\n    await client.delete(\n      '/admin/users/{username}/vendors/{vendor}',\n      { path: { username, vendor } },\n      { signal },\n    );\n  };\n\n  const grantUserAdmin = async (username: string, signal?: AbortSignal) => {\n    await client.post('/admin/users/{username}/admin', { path: { username } }, { signal });\n  };\n\n  const revokeUserAdmin = async (username: string, signal?: AbortSignal) => {\n    await client.delete('/admin/users/{username}/admin', { path: { username } }, { signal });\n  };\n\n  const getVendors = async (query: AdminPaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/admin/vendors', { query }, { signal });\n    return data;\n  };\n\n  const createVendor = async (body: CreateVendorAsAdminInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/admin/vendors', { body }, { signal });\n    return data;\n  };\n\n  const updateVendor = async (\n    vendor: string,\n    body: UpdateVendorAsAdminInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.patch(\n      '/admin/vendors/{vendor}',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const deleteVendor = async (vendor: string, signal?: AbortSignal) => {\n    await client.delete('/admin/vendors/{vendor}', { path: { vendor } }, { signal });\n  };\n\n  /** Swaps a pending `_v`-prefixed id for the permanent one carried in the body. */\n  const approveVendor = async (vendor: string, body: ApproveVendorInput, signal?: AbortSignal) => {\n    await client.post('/admin/vendors/{vendor}/approve', { path: { vendor }, body }, { signal });\n  };\n\n  return {\n    getStacks,\n    getChanges,\n    getApps,\n    getApp,\n    updateApp,\n    publishApp,\n    rejectApp,\n    getUsers,\n    deleteUser,\n    resetUserMfa,\n    addUserToVendor,\n    removeUserFromVendor,\n    grantUserAdmin,\n    revokeUserAdmin,\n    getVendors,\n    createVendor,\n    updateVendor,\n    deleteVendor,\n    approveVendor,\n  };\n};\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  CreateAppInput,\n  DeprecateAppInput,\n  GetAppsQuery,\n  PaginationQuery,\n  UpdateAppInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** `GET /apps` and `GET /apps/{app}` are `security: []` in the spec. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const createApps = ({ client, publicClient }: Deps) => {\n  /** The public catalog: scoped server-side to published components. */\n  const getPublishedApps = async (query: GetAppsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/apps', { query }, { signal });\n    return data;\n  };\n\n  const getPublishedApp = async (app: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/apps/{app}', { path: { app } }, { signal });\n    return data;\n  };\n\n  const getApps = async (vendor: string, query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const getApp = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createApp = async (vendor: string, body: CreateAppInput, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const updateApp = async (\n    vendor: string,\n    app: string,\n    body: UpdateAppInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.patch(\n      '/vendors/{vendor}/apps/{app}',\n      { path: { vendor, app }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const deleteApp = async (vendor: string, app: string, signal?: AbortSignal) => {\n    await client.delete('/vendors/{vendor}/apps/{app}', { path: { vendor, app } }, { signal });\n  };\n\n  const requestAppPublishing = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/publish',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  const deprecateApp = async (\n    vendor: string,\n    app: string,\n    body: DeprecateAppInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/deprecate',\n      { path: { vendor, app }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getAppVersions = async (\n    vendor: string,\n    app: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/versions',\n      { path: { vendor, app }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const getAppVersion = async (\n    vendor: string,\n    app: string,\n    version: string,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/versions/{version}',\n      { path: { vendor, app, version } },\n      { signal },\n    );\n    return data;\n  };\n\n  const rollbackAppVersion = async (\n    vendor: string,\n    app: string,\n    version: string,\n    signal?: AbortSignal,\n  ) => {\n    await client.post(\n      '/vendors/{vendor}/apps/{app}/versions/{version}/rollback',\n      { path: { vendor, app, version } },\n      { signal },\n    );\n  };\n\n  const getAppRepository = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/apps/{app}/repository',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  /** Requests a presigned S3 upload link; the upload itself is {@link uploadAppIcon}. */\n  const createAppIconUploadLink = async (vendor: string, app: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/apps/{app}/icon',\n      { path: { vendor, app } },\n      { signal },\n    );\n    return data;\n  };\n\n  return {\n    getPublishedApps,\n    getPublishedApp,\n    getApps,\n    getApp,\n    createApp,\n    updateApp,\n    deleteApp,\n    requestAppPublishing,\n    deprecateApp,\n    getAppVersions,\n    getAppVersion,\n    rollbackAppVersion,\n    getAppRepository,\n    createAppIconUploadLink,\n  };\n};\n\n/**\n * Uploads the icon to the presigned URL from `createAppIconUploadLink`. Deliberately a bare `fetch`:\n * the URL carries its own signature in the query string, and sending our `Authorization` header to\n * S3 makes it reject the request.\n */\nexport const uploadAppIcon = async (\n  uploadUrl: string,\n  png: Blob,\n  signal?: AbortSignal,\n): Promise<void> => {\n  const response = await fetch(uploadUrl, {\n    method: 'PUT',\n    body: png,\n    headers: { 'Content-Type': 'image/png' },\n    signal,\n  });\n\n  if (!response.ok) {\n    throw new Error(`Icon upload failed: ${response.status} ${response.statusText}`);\n  }\n};\n","import { HttpHeader } from '../../fetchClient';\n\n/**\n * The Cognito token trio apps-api issues. `token` is the id token: stamped on almost every call, and\n * the header on both MFA calls. `refreshToken` authenticates `GET /auth/token`. `accessToken`\n * authenticates `POST /auth/logout` as a header, and both `POST /auth/mfa` and `/auth/mfa/confirm`\n * in the **body** — which is why those two stay off the refresh-and-replay path.\n */\nexport type DeveloperPortalTokens = {\n  token: string;\n  accessToken: string;\n  refreshToken: string;\n};\n\n/** Raw token, no `Bearer` prefix — see the spec's `bearerAuth` scheme (`type: apiKey`). */\nexport const authHeader = (token: string): Record<string, string> => ({\n  [HttpHeader.AUTHORIZATION]: token,\n});\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport { authHeader } from '../tokens';\nimport type {\n  ConfirmAccountInput,\n  LoginChallenge,\n  LoginInput,\n  LoginResult,\n  ResetPasswordConfirmInput,\n  SignUpInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** The spec's `security: []` operations, plus the four that bring their own token. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const isMfaChallengeResponse = (result: LoginResult): result is LoginChallenge =>\n  !('token' in result);\n\nexport const createAuth = ({ client, publicClient }: Deps) => {\n  const login = async (body: LoginInput, signal?: AbortSignal) => {\n    const { data } = await publicClient.post('/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const signUp = async (body: SignUpInput, signal?: AbortSignal) => {\n    await publicClient.post('/auth/signup', { body }, { signal });\n  };\n\n  const confirmAccount = async (body: ConfirmAccountInput, signal?: AbortSignal) => {\n    await publicClient.post('/auth/confirm', { body }, { signal });\n  };\n\n  /** Confirms via the emailed link's path segments, for a consumer echoing that link. */\n  const confirmAccountByCode = async (email: string, code: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/confirm/{email}/{code}', { path: { email, code } }, { signal });\n  };\n\n  /**\n   * Rotates the trio, authenticated with the **refresh** token, on the auth-free client so a\n   * rotation triggered by the auth middleware cannot recurse into it. The response carries no new\n   * refresh token, so the caller carries the one it has forward.\n   */\n  const refreshTokens = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get(\n      '/auth/token',\n      {},\n      { headers: authHeader(refreshToken), signal },\n    );\n    return data;\n  };\n\n  /** Authenticated with the **access** token. Clear local state regardless of the outcome. */\n  const logout = async (accessToken: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/logout', {}, { headers: authHeader(accessToken), signal });\n  };\n\n  const getProfile = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/auth/profile', {}, { signal });\n    return data;\n  };\n\n  const requestPasswordReset = async (email: string, signal?: AbortSignal) => {\n    await publicClient.post('/auth/forgot/{email}', { path: { email } }, { signal });\n  };\n\n  const confirmPasswordReset = async (\n    email: string,\n    body: ResetPasswordConfirmInput,\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.post('/auth/forgot/{email}/confirm', { path: { email }, body }, { signal });\n  };\n\n  // `setupMfa` and `confirmMfa` each take two of the three tokens: the auth token in the header, the\n  // access token in the body. Both sit on the auth-free client, which keeps them out of the\n  // middleware's refresh-and-replay: restamping a header cannot fix a stale token in a body.\n  const setupMfa = async (\n    { idToken, accessToken }: { idToken: string; accessToken: string },\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await publicClient.post(\n      '/auth/mfa',\n      { body: { accessToken } },\n      { headers: authHeader(idToken), signal },\n    );\n    return data;\n  };\n\n  const confirmMfa = async (\n    { idToken, accessToken, code }: { idToken: string; accessToken: string; code: string },\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.post(\n      '/auth/mfa/confirm',\n      { body: { accessToken, code } },\n      { headers: authHeader(idToken), signal },\n    );\n  };\n\n  return {\n    login,\n    signUp,\n    confirmAccount,\n    confirmAccountByCode,\n    refreshTokens,\n    logout,\n    getProfile,\n    requestPasswordReset,\n    confirmPasswordReset,\n    setupMfa,\n    confirmMfa,\n  };\n};\n","import type { DeveloperPortalFetchClient } from '../developerPortalClient';\nimport type {\n  CreateServiceAccountInput,\n  CreateVendorInput,\n  GetVendorUsersQuery,\n  PaginationQuery,\n  UpdateVendorInput,\n} from '../types';\n\ntype Deps = {\n  client: DeveloperPortalFetchClient;\n  /** `GET /vendors` and `GET /vendors/{vendor}` are `security: []` in the spec. */\n  publicClient: DeveloperPortalFetchClient;\n};\n\nexport const createVendors = ({ client, publicClient }: Deps) => {\n  const getVendors = async (query: PaginationQuery = {}, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/vendors', { query }, { signal });\n    return data;\n  };\n\n  const getVendor = async (vendor: string, signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/vendors/{vendor}', { path: { vendor } }, { signal });\n    return data;\n  };\n\n  /** Self-service registration. The vendor is pending, under a temporary `_v`-prefixed id. */\n  const createVendor = async (body: CreateVendorInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/vendors', { body }, { signal });\n    return data;\n  };\n\n  const updateVendor = async (vendor: string, body: UpdateVendorInput, signal?: AbortSignal) => {\n    const { data } = await client.patch(\n      '/vendors/{vendor}',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  const getVendorUsers = async (\n    vendor: string,\n    query: GetVendorUsersQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/users',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  /** Requests membership of a vendor for the signed-in user. */\n  const requestVendorMembership = async (vendor: string, signal?: AbortSignal) => {\n    await client.post('/vendors/{vendor}/users', { path: { vendor } }, { signal });\n  };\n\n  const approveVendorUser = async (vendor: string, username: string, signal?: AbortSignal) => {\n    await client.post(\n      '/vendors/{vendor}/users/{username}',\n      { path: { vendor, username } },\n      { signal },\n    );\n  };\n\n  const removeVendorUser = async (vendor: string, username: string, signal?: AbortSignal) => {\n    await client.delete(\n      '/vendors/{vendor}/users/{username}',\n      { path: { vendor, username } },\n      { signal },\n    );\n  };\n\n  const getVendorUserRequests = async (\n    vendor: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/user-requests',\n      { path: { vendor }, query },\n      { signal },\n    );\n    return data;\n  };\n\n  const sendVendorInvitation = async (vendor: string, email: string, signal?: AbortSignal) => {\n    await client.post(\n      '/vendors/{vendor}/invitations/{email}',\n      { path: { vendor, email } },\n      { signal },\n    );\n  };\n\n  /** `security: []` — the invitee follows the emailed link before they have a session. */\n  const acceptVendorInvitation = async (\n    vendor: string,\n    email: string,\n    code: string,\n    signal?: AbortSignal,\n  ) => {\n    await publicClient.get(\n      '/vendors/{vendor}/invitations/{email}/{code}',\n      { path: { vendor, email, code } },\n      { signal },\n    );\n  };\n\n  /** `service=1` filters the member list; there is no distinct endpoint. */\n  const getServiceAccounts = async (\n    vendor: string,\n    query: PaginationQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/vendors/{vendor}/users',\n      { path: { vendor }, query: { ...query, service: 1 } },\n      { signal },\n    );\n    return data;\n  };\n\n  /** The returned `password` is shown once and is not retrievable afterwards. */\n  const createServiceAccount = async (\n    vendor: string,\n    body: CreateServiceAccountInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/vendors/{vendor}/credentials',\n      { path: { vendor }, body },\n      { signal },\n    );\n    return data;\n  };\n\n  return {\n    getVendors,\n    getVendor,\n    createVendor,\n    updateVendor,\n    getVendorUsers,\n    requestVendorMembership,\n    approveVendorUser,\n    removeVendorUser,\n    getVendorUserRequests,\n    sendVendorInvitation,\n    acceptVendorInvitation,\n    getServiceAccounts,\n    createServiceAccount,\n  };\n};\n","import { createOpenapiFetchClient, type MiddlewareFn } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createAdmin } from './admin/admin';\nimport { createApps } from './apps/apps';\nimport { createAuth } from './auth/auth';\nimport { createVendors } from './vendors/vendors';\n\nexport type DeveloperPortalFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport type DeveloperPortalClientInitOptions = Omit<ClientInitOptions, 'auth' | 'middlewares'> & {\n  middlewares?: MiddlewareFn[];\n  /**\n   * Stamps the id token. A middleware rather than the `auth: AuthStrategy` other clients take, because\n   * apps-api's token rotates and a header baked in at construction would go stale. Supplied by\n   * `createDeveloperPortalSdk`; omit it for the spec's `security: []` operations.\n   */\n  authMiddleware?: MiddlewareFn;\n};\n\n/**\n * The Developer Portal (apps-api) client. Paths and types are generated from\n * `https://apps-api.keboola.com/docs/openapi.yaml` — see `redocly.yaml` and `pnpm gen:types`.\n *\n * Two fetch clients because the spec splits its operations: `security: []` ones must go out\n * unauthenticated, and four authenticate with the access or refresh token instead of the id token.\n */\nexport const createDeveloperPortalClient = ({\n  baseUrl,\n  middlewares = [],\n  authMiddleware,\n}: DeveloperPortalClientInitOptions) => {\n  const publicClient = createOpenapiFetchClient<paths>({ baseUrl, middlewares });\n  const client = authMiddleware\n    ? createOpenapiFetchClient<paths>({ baseUrl, middlewares: [authMiddleware, ...middlewares] })\n    : publicClient;\n\n  /** `GET /` — the spec's service index. */\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await publicClient.get('/', {}, { signal });\n    return data;\n  };\n\n  return {\n    healthCheck,\n    auth: createAuth({ client, publicClient }),\n    vendors: createVendors({ client, publicClient }),\n    apps: createApps({ client, publicClient }),\n    admin: createAdmin(client),\n  };\n};\n\nexport type DeveloperPortalClient = ReturnType<typeof createDeveloperPortalClient>;\n"],"mappings":";;;;AAaA,MAAa,eAAe,WAAuC;CACjE,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EACjE,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,kBAAkB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAA8B,CAAC,GAAG,WAAyB;EAChF,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,eAAe,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAY,WAAyB;EACzD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,IAAY,MAA6B,WAAyB;EACzF,MAAM,EAAE,SAAS,MAAM,OAAO,MAAM,oBAAoB;GAAE,MAAM,EAAE,GAAG;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;EAC1F,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,IAAY,WAAyB;EAC7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;EAC3F,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,IAAY,MAAsB,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,2BACA;GAAE,MAAM,EAAE,GAAG;GAAG;EAAK,GACrB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,UAAkB,WAAyB;EACnE,MAAM,OAAO,OAAO,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACnF;;CAGA,MAAM,eAAe,OAAO,UAAkB,WAAyB;EACrE,MAAM,OAAO,OAAO,+BAA+B,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACvF;CAEA,MAAM,kBAAkB,OAAO,UAAkB,QAAgB,WAAyB;EACxF,MAAM,OAAO,KACX,4CACA,EAAE,MAAM;GAAE;GAAU;EAAO,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,uBAAuB,OAAO,UAAkB,QAAgB,WAAyB;EAC7F,MAAM,OAAO,OACX,4CACA,EAAE,MAAM;GAAE;GAAU;EAAO,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,iBAAiB,OAAO,UAAkB,WAAyB;EACvE,MAAM,OAAO,KAAK,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACvF;CAEA,MAAM,kBAAkB,OAAO,UAAkB,WAAyB;EACxE,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;CACzF;CAEA,MAAM,aAAa,OAAO,QAA8B,CAAC,GAAG,WAAyB;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,kBAAkB,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,MAAgC,WAAyB;EACnF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OACnB,QACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,QAAgB,WAAyB;EACnE,MAAM,OAAO,OAAO,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;CACjF;;CAGA,MAAM,gBAAgB,OAAO,QAAgB,MAA0B,WAAyB;EAC9F,MAAM,OAAO,KAAK,mCAAmC;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;CAC7F;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACjIA,MAAa,cAAc,EAAE,QAAQ,mBAAyB;;CAE5D,MAAM,mBAAmB,OAAO,QAAsB,CAAC,GAAG,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,KAAa,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAAgB,QAAyB,CAAC,GAAG,WAAyB;EAC3F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,0BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,QAAgB,KAAa,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,MAAsB,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAChB,QACA,KACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,gCACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAK,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,KAAa,WAAyB;EAC7E,MAAM,OAAO,OAAO,gCAAgC,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GAAG,EAAE,OAAO,CAAC;CAC3F;CAEA,MAAM,uBAAuB,OAAO,QAAgB,KAAa,WAAyB;EACxF,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,wCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,eAAe,OACnB,QACA,KACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0CACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAK,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,iBAAiB,OACrB,QACA,KACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,yCACA;GAAE,MAAM;IAAE;IAAQ;GAAI;GAAG;EAAM,GAC/B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OACpB,QACA,KACA,SACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,mDACA,EAAE,MAAM;GAAE;GAAQ;GAAK;EAAQ,EAAE,GACjC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,qBAAqB,OACzB,QACA,KACA,SACA,WACG;EACH,MAAM,OAAO,KACX,4DACA,EAAE,MAAM;GAAE;GAAQ;GAAK;EAAQ,EAAE,GACjC,EAAE,OAAO,CACX;CACF;CAEA,MAAM,mBAAmB,OAAO,QAAgB,KAAa,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2CACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,0BAA0B,OAAO,QAAgB,KAAa,WAAyB;EAC3F,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,qCACA,EAAE,MAAM;GAAE;GAAQ;EAAI,EAAE,GACxB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;AAOA,MAAa,gBAAgB,OAC3B,WACA,KACA,WACkB;CAClB,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,MAAM;EACN,SAAS,EAAE,gBAAgB,YAAY;EACvC;CACF,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,uBAAuB,SAAS,OAAO,GAAG,SAAS,YAAY;AAEnF;;;;AClLA,MAAa,cAAc,WAA2C,GACnE,WAAW,gBAAgB,MAC9B;;;ACAA,MAAa,0BAA0B,WACrC,EAAE,WAAW;AAEf,MAAa,cAAc,EAAE,QAAQ,mBAAyB;CAC5D,MAAM,QAAQ,OAAO,MAAkB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,aAAa,KAAK,eAAe,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAmB,WAAyB;EAChE,MAAM,aAAa,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC9D;CAEA,MAAM,iBAAiB,OAAO,MAA2B,WAAyB;EAChF,MAAM,aAAa,KAAK,iBAAiB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC/D;;CAGA,MAAM,uBAAuB,OAAO,OAAe,MAAc,WAAyB;EACxF,MAAM,aAAa,KAAK,gCAAgC,EAAE,MAAM;GAAE;GAAO;EAAK,EAAE,GAAG,EAAE,OAAO,CAAC;CAC/F;;;;;;CAOA,MAAM,gBAAgB,OAAO,cAAsB,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,aAAa,IAClC,eACA,CAAC,GACD;GAAE,SAAS,WAAW,YAAY;GAAG;EAAO,CAC9C;EACA,OAAO;CACT;;CAGA,MAAM,SAAS,OAAO,aAAqB,WAAyB;EAClE,MAAM,aAAa,KAAK,gBAAgB,CAAC,GAAG;GAAE,SAAS,WAAW,WAAW;GAAG;EAAO,CAAC;CAC1F;CAEA,MAAM,aAAa,OAAO,WAAyB;EACjD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EACjE,OAAO;CACT;CAEA,MAAM,uBAAuB,OAAO,OAAe,WAAyB;EAC1E,MAAM,aAAa,KAAK,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;CACjF;CAEA,MAAM,uBAAuB,OAC3B,OACA,MACA,WACG;EACH,MAAM,aAAa,KAAK,gCAAgC;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GAAG,EAAE,OAAO,CAAC;CAC/F;CAKA,MAAM,WAAW,OACf,EAAE,SAAS,eACX,WACG;EACH,MAAM,EAAE,SAAS,MAAM,aAAa,KAClC,aACA,EAAE,MAAM,EAAE,YAAY,EAAE,GACxB;GAAE,SAAS,WAAW,OAAO;GAAG;EAAO,CACzC;EACA,OAAO;CACT;CAEA,MAAM,aAAa,OACjB,EAAE,SAAS,aAAa,QACxB,WACG;EACH,MAAM,aAAa,KACjB,qBACA,EAAE,MAAM;GAAE;GAAa;EAAK,EAAE,GAC9B;GAAE,SAAS,WAAW,OAAO;GAAG;EAAO,CACzC;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;ACnGA,MAAa,iBAAiB,EAAE,QAAQ,mBAAyB;CAC/D,MAAM,aAAa,OAAO,QAAyB,CAAC,GAAG,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,QAAgB,WAAyB;EAChE,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;EAC7F,OAAO;CACT;;CAGA,MAAM,eAAe,OAAO,MAAyB,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,YAAY,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACnE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,QAAgB,MAAyB,WAAyB;EAC5F,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B,qBACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,iBAAiB,OACrB,QACA,QAA6B,CAAC,GAC9B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,0BAA0B,OAAO,QAAgB,WAAyB;EAC9E,MAAM,OAAO,KAAK,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;CAC/E;CAEA,MAAM,oBAAoB,OAAO,QAAgB,UAAkB,WAAyB;EAC1F,MAAM,OAAO,KACX,sCACA,EAAE,MAAM;GAAE;GAAQ;EAAS,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,mBAAmB,OAAO,QAAgB,UAAkB,WAAyB;EACzF,MAAM,OAAO,OACX,sCACA,EAAE,MAAM;GAAE;GAAQ;EAAS,EAAE,GAC7B,EAAE,OAAO,CACX;CACF;CAEA,MAAM,wBAAwB,OAC5B,QACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,mCACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAM,GAC1B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,uBAAuB,OAAO,QAAgB,OAAe,WAAyB;EAC1F,MAAM,OAAO,KACX,yCACA,EAAE,MAAM;GAAE;GAAQ;EAAM,EAAE,GAC1B,EAAE,OAAO,CACX;CACF;;CAGA,MAAM,yBAAyB,OAC7B,QACA,OACA,MACA,WACG;EACH,MAAM,aAAa,IACjB,gDACA,EAAE,MAAM;GAAE;GAAQ;GAAO;EAAK,EAAE,GAChC,EAAE,OAAO,CACX;CACF;;CAGA,MAAM,qBAAqB,OACzB,QACA,QAAyB,CAAC,GAC1B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,2BACA;GAAE,MAAM,EAAE,OAAO;GAAG,OAAO;IAAE,GAAG;IAAO,SAAS;GAAE;EAAE,GACpD,EAAE,OAAO,CACX;EACA,OAAO;CACT;;CAGA,MAAM,uBAAuB,OAC3B,QACA,MACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iCACA;GAAE,MAAM,EAAE,OAAO;GAAG;EAAK,GACzB,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;;AC7HA,MAAa,+BAA+B,EAC1C,SACA,cAAc,CAAC,GACf,qBACsC;CACtC,MAAM,eAAe,yBAAgC;EAAE;EAAS;CAAY,CAAC;CAC7E,MAAM,SAAS,iBACX,yBAAgC;EAAE;EAAS,aAAa,CAAC,gBAAgB,GAAG,WAAW;CAAE,CAAC,IAC1F;;CAGJ,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,aAAa,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAC3D,OAAO;CACT;CAEA,OAAO;EACL;EACA,MAAM,WAAW;GAAE;GAAQ;EAAa,CAAC;EACzC,SAAS,cAAc;GAAE;GAAQ;EAAa,CAAC;EAC/C,MAAM,WAAW;GAAE;GAAQ;EAAa,CAAC;EACzC,OAAO,YAAY,MAAM;CAC3B;AACF"}

package/dist/domain/permissions/index.cjs

@@ -1,9 +1,65 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_project = require("../../project-BvFi19K_.cjs");
-const require_configurations = require("../../configurations-DCOJONZZ.cjs");
+const require_configurations = require("../../configurations-CqwAxiQL.cjs");
+//#region src/domain/permissions/organization.ts
+/**
+* The raw signal: is this token's admin a member of the organization owning
+* the project?
+*
+* A limited (non-master) token never is — it carries no `admin` block at all
+* despite the hand-authored type declaring it required (AI-3593), hence the
+* optional chain and the `isMasterToken` requirement. Prefer
+* `isOrganizationAdmin` for authorization decisions; this bare signal exists
+* because a few kbc-ui call sites use it with no role conjunction (e.g.
+* `privileges.ts`'s `canManageUsers`/`canUnlinkBucket`), and porting those must
+* not change behaviour.
+*/
+const isOrganizationMember = (token) => token.isMasterToken && (token.admin?.isOrganizationMember ?? false);
+/**
+* May this token administer organization-owned settings on this project?
+*
+* `isOrganizationMember` AND `admin`/`share`. The conjunction — not the bare
+* flag — is the shape kbc-ui already uses wherever org authority gates a
+* project-level *write* (e.g. `privileges.ts`'s `canChangeUserRole` for the
+* SHARE target). Keeping the conjunction means an org member holding a
+* `readOnly` or `guest` token on this particular project still cannot write,
+* matching every existing write-shaped call site.
+*/
+const isOrganizationAdmin = (token) => isOrganizationMember(token) && require_configurations.isAdminOrShare(token);
+const assertCanAdministerOrganization = (token) => {
+	if (!isOrganizationAdmin(token)) throw new require_configurations.PermissionDeniedError({
+		action: "administer-organization",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings` : "a limited (non-master) token may not administer organization settings"
+	});
+};
+/**
+* Whether this token may write Kai's **spend caps** — the project cap, the
+* default per-user limit, and per-user overrides (AI-3738).
+*
+* Strictly stricter than `canWriteKaiSettings` (`./admin`), and deliberately a
+* distinct predicate rather than a widening of it. `canWriteKaiSettings` is
+* `admin`/`share` — the authority to rewrite shared project *config* (a
+* prompt-injection surface). Spend caps commit the organization's money across
+* every project it owns, so per AI-3738 they are organization-admin only: a
+* project admin sees which caps apply and cannot change them. A project whose
+* own admin could raise its own cap has no cap.
+*
+* Lives here rather than beside `canWriteKaiSettings` in `admin.ts` because its
+* rule is org-scoped and `admin.ts` is documented as depending purely on the
+* project role string.
+*/
+const canWriteKaiSpendCaps = (token) => isOrganizationAdmin(token);
+const assertCanWriteKaiSpendCaps = (token) => {
+	if (!canWriteKaiSpendCaps(token)) throw new require_configurations.PermissionDeniedError({
+		action: "write-kai-spend-caps",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps` : "a limited (non-master) token may not change Kai spend caps"
+	});
+};
+//#endregion
 exports.PermissionDeniedError = require_configurations.PermissionDeniedError;
 exports.assertCanAdmin = require_configurations.assertCanAdmin;
 exports.assertCanAdminOrShare = require_configurations.assertCanAdminOrShare;
+exports.assertCanAdministerOrganization = assertCanAdministerOrganization;
 exports.assertCanAssignFolder = require_configurations.assertCanAssignFolder;
 exports.assertCanCopyConfiguration = require_configurations.assertCanCopyConfiguration;
 exports.assertCanCreateConfiguration = require_configurations.assertCanCreateConfiguration;
@@ -13,6 +69,7 @@ exports.assertCanProductionManage = require_configurations.assertCanProductionMa
 exports.assertCanPurgeConfiguration = require_configurations.assertCanPurgeConfiguration;
 exports.assertCanUpdateConfiguration = require_configurations.assertCanUpdateConfiguration;
 exports.assertCanWriteKaiSettings = require_configurations.assertCanWriteKaiSettings;
+exports.assertCanWriteKaiSpendCaps = assertCanWriteKaiSpendCaps;
 exports.canAssignFolder = require_configurations.canAssignFolder;
 exports.canCopyConfiguration = require_configurations.canCopyConfiguration;
 exports.canCreateConfiguration = require_configurations.canCreateConfiguration;
@@ -20,6 +77,7 @@ exports.canMigrateFromTemplate = require_configurations.canMigrateFromTemplate;
 exports.canPurgeConfiguration = require_configurations.canPurgeConfiguration;
 exports.canUpdateConfiguration = require_configurations.canUpdateConfiguration;
 exports.canWriteKaiSettings = require_configurations.canWriteKaiSettings;
+exports.canWriteKaiSpendCaps = canWriteKaiSpendCaps;
 exports.hasAdminFeature = require_project.hasAdminFeature;
 exports.hasFeature = require_project.hasFeature;
 exports.isAdmin = require_configurations.isAdmin;
@@ -27,5 +85,9 @@ exports.isAdminOrShare = require_configurations.isAdminOrShare;
 exports.isDeveloperOrReviewer = require_configurations.isDeveloperOrReviewer;
 exports.isKaiSettingsWriterRole = require_configurations.isKaiSettingsWriterRole;
 exports.isKnownAdminRole = require_configurations.isKnownAdminRole;
+exports.isOrganizationAdmin = isOrganizationAdmin;
+exports.isOrganizationMember = isOrganizationMember;
 exports.isProductionManager = require_configurations.isProductionManager;
 exports.isReadOnlyRole = require_configurations.isReadOnlyRole;
+
+//# sourceMappingURL=index.cjs.map

package/dist/domain/permissions/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["isAdminOrShare","PermissionDeniedError"],"sources":["../../../src/domain/permissions/organization.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates. Token-only, like `admin.ts`, but these read\n * `StorageToken.admin.isOrganizationMember` rather than the project role\n * string — the two answer different questions and neither implies the other.\n *\n * The upstream field is named `isOrganizationMember`, but in Keboola\n * organization membership *is* organization administration — an org member\n * administers every project the organization owns. kbc-ui already reads it\n * under that meaning (e.g. `BranchProtectionTab.tsx`, `ActivateChatContent.tsx`\n * both assign it to a local `isOrgAdmin`), so `isOrganizationAdmin` below is a\n * rename of the existing reading, not a new semantic.\n *\n * `isOrganizationAdmin` and `canWriteKaiSpendCaps` each have an `assertCan*`\n * pair (`assertCanAdministerOrganization`, `assertCanWriteKaiSpendCaps`)\n * throwing `PermissionDeniedError` with a stable kebab-case `action`, per the\n * conventions in `packages/api-client/AGENTS.md`. `isOrganizationMember` is a\n * raw signal only — nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * The raw signal: is this token's admin a member of the organization owning\n * the project?\n *\n * A limited (non-master) token never is — it carries no `admin` block at all\n * despite the hand-authored type declaring it required (AI-3593), hence the\n * optional chain and the `isMasterToken` requirement. Prefer\n * `isOrganizationAdmin` for authorization decisions; this bare signal exists\n * because a few kbc-ui call sites use it with no role conjunction (e.g.\n * `privileges.ts`'s `canManageUsers`/`canUnlinkBucket`), and porting those must\n * not change behaviour.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * May this token administer organization-owned settings on this project?\n *\n * `isOrganizationMember` AND `admin`/`share`. The conjunction — not the bare\n * flag — is the shape kbc-ui already uses wherever org authority gates a\n * project-level *write* (e.g. `privileges.ts`'s `canChangeUserRole` for the\n * SHARE target). Keeping the conjunction means an org member holding a\n * `readOnly` or `guest` token on this particular project still cannot write,\n * matching every existing write-shaped call site.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's **spend caps** — the project cap, the\n * default per-user limit, and per-user overrides (AI-3738).\n *\n * Strictly stricter than `canWriteKaiSettings` (`./admin`), and deliberately a\n * distinct predicate rather than a widening of it. `canWriteKaiSettings` is\n * `admin`/`share` — the authority to rewrite shared project *config* (a\n * prompt-injection surface). Spend caps commit the organization's money across\n * every project it owns, so per AI-3738 they are organization-admin only: a\n * project admin sees which caps apply and cannot change them. A project whose\n * own admin could raise its own cap has no cap.\n *\n * Lives here rather than beside `canWriteKaiSettings` in `admin.ts` because its\n * rule is org-scoped and `admin.ts` is documented as depending purely on the\n * project role string.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAqCA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;;;;;;AAY/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAKA,uBAAAA,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAIC,uBAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;;;;;;;;;;;AAkBA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAIA,uBAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL"}

package/dist/domain/permissions/index.d.cts

@@ -1,5 +1,5 @@
-import { l as StorageToken } from "../../types-CIJAtX8q.cjs";
-import { n as hasAdminFeature, r as hasFeature } from "../../project-CRrsxSAK.cjs";
+import { l as StorageToken } from "../../types-CrH4H8M4.cjs";
+import { n as hasAdminFeature, r as hasFeature } from "../../project-D25GH8zK.cjs";
 //#region src/domain/permissions/errors.d.ts
 /**
  * @module domain/permissions/errors
@@ -59,6 +59,10 @@ declare const isKnownAdminRole: (adminRole: string | null | undefined) => boolea
  * would admit each new one silently with no test failing. Takes the raw role
  * string so a caller holding an unparsed `tokens.verify()` response can use it
  * without fabricating a `StorageToken`. AI-3671.
+ *
+ * @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are
+ * organization-admin only and use that predicate; do not widen this one to
+ * cover them.
  */
 declare const isKaiSettingsWriterRole: (adminRole: string | null | undefined) => boolean;
 /**
@@ -74,6 +78,51 @@ declare const assertCanAdminOrShare: (token: StorageToken) => void;
 declare const assertCanProductionManage: (token: StorageToken) => void;
 declare const assertCanDevelopOrReview: (token: StorageToken) => void;
 //#endregion
+//#region src/domain/permissions/organization.d.ts
+/**
+ * The raw signal: is this token's admin a member of the organization owning
+ * the project?
+ *
+ * A limited (non-master) token never is — it carries no `admin` block at all
+ * despite the hand-authored type declaring it required (AI-3593), hence the
+ * optional chain and the `isMasterToken` requirement. Prefer
+ * `isOrganizationAdmin` for authorization decisions; this bare signal exists
+ * because a few kbc-ui call sites use it with no role conjunction (e.g.
+ * `privileges.ts`'s `canManageUsers`/`canUnlinkBucket`), and porting those must
+ * not change behaviour.
+ */
+declare const isOrganizationMember: (token: StorageToken) => boolean;
+/**
+ * May this token administer organization-owned settings on this project?
+ *
+ * `isOrganizationMember` AND `admin`/`share`. The conjunction — not the bare
+ * flag — is the shape kbc-ui already uses wherever org authority gates a
+ * project-level *write* (e.g. `privileges.ts`'s `canChangeUserRole` for the
+ * SHARE target). Keeping the conjunction means an org member holding a
+ * `readOnly` or `guest` token on this particular project still cannot write,
+ * matching every existing write-shaped call site.
+ */
+declare const isOrganizationAdmin: (token: StorageToken) => boolean;
+declare const assertCanAdministerOrganization: (token: StorageToken) => void;
+/**
+ * Whether this token may write Kai's **spend caps** — the project cap, the
+ * default per-user limit, and per-user overrides (AI-3738).
+ *
+ * Strictly stricter than `canWriteKaiSettings` (`./admin`), and deliberately a
+ * distinct predicate rather than a widening of it. `canWriteKaiSettings` is
+ * `admin`/`share` — the authority to rewrite shared project *config* (a
+ * prompt-injection surface). Spend caps commit the organization's money across
+ * every project it owns, so per AI-3738 they are organization-admin only: a
+ * project admin sees which caps apply and cannot change them. A project whose
+ * own admin could raise its own cap has no cap.
+ *
+ * Lives here rather than beside `canWriteKaiSettings` in `admin.ts` because its
+ * rule is org-scoped and `admin.ts` is documented as depending purely on the
+ * project role string.
+ */
+declare const canWriteKaiSpendCaps: (token: StorageToken) => boolean;
+declare const assertCanWriteKaiSpendCaps: (token: StorageToken) => void;
+//#endregion
 //#region src/domain/permissions/configurations.d.ts
 /**
  * Caller-supplied context for configuration predicates.
@@ -115,5 +164,5 @@ declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: Configura
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
 //#endregion
-export { ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, hasAdminFeature, hasFeature, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isProductionManager, isReadOnlyRole };
+export { ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAdministerOrganization, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, assertCanWriteKaiSpendCaps, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, canWriteKaiSpendCaps, hasAdminFeature, hasFeature, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isOrganizationAdmin, isOrganizationMember, isProductionManager, isReadOnlyRole };
 //# sourceMappingURL=index.d.cts.map