@keboola/api-client 32.0.0 → 34.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keboola/api-client",
-  "version": "32.0.0",
+  "version": "34.0.0",
   "description": "TypeScript SDK for Keboola APIs",
   "license": "MIT",
   "type": "module",
@@ -41,6 +41,12 @@
       "auth/types": [
         "./dist/auth/types.d.ts"
       ],
+      "billing": [
+        "./dist/billing/index.d.ts"
+      ],
+      "billing/types": [
+        "./dist/billing/types.d.ts"
+      ],
       "chat": [
         "./dist/chat/index.d.ts"
       ],
@@ -326,6 +332,26 @@
         "default": "./dist/auth/types.cjs"
       }
     },
+    "./billing": {
+      "import": {
+        "types": "./dist/billing/index.d.ts",
+        "default": "./dist/billing/index.js"
+      },
+      "require": {
+        "types": "./dist/billing/index.d.cts",
+        "default": "./dist/billing/index.cjs"
+      }
+    },
+    "./billing/types": {
+      "import": {
+        "types": "./dist/billing/types.d.ts",
+        "default": "./dist/billing/types.js"
+      },
+      "require": {
+        "types": "./dist/billing/types.d.cts",
+        "default": "./dist/billing/types.cjs"
+      }
+    },
     "./chat": {
       "import": {
         "types": "./dist/chat/index.d.ts",
@@ -889,7 +915,7 @@
   },
   "dependencies": {
     "dayjs": "^1.11.19",
-    "qs": "^6.15.2",
+    "qs": "^6.16.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
@@ -900,8 +926,8 @@
     "@vitest/coverage-v8": "^4.1.10",
     "msw": "^2.14.6",
     "openapi-typescript": "7.10.1",
-    "oxfmt": "^0.57.0",
-    "oxlint": "^1.72.0",
+    "oxfmt": "^0.66.0",
+    "oxlint": "^1.81.0",
     "tsdown": "^0.22.14",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.1.5",

package/surface/auth.md

@@ -38,8 +38,8 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 
 ### `api.auth.pat`
 
-- `api.auth.pat.create(body: { name: string; expiresIn: number | null; scope: { projects: string[] | null; readOnly: boolean | null; } | null; }, signal?: AbortSignal | undefined): Promise<{ accessToken: string; tokenType: string; expiresIn: number; pat: { id: string; name: string; scope: Record<string, never>; projects: { id: number; name: string | null; role: string | null; }[]; readOnly: boolean; parentTokenId?: string | null | undefined; parentTokenType?: "session" | "pat" | null | undefined; expiresAt: string; lastUsedAt?: string | null | undefined; createdAt: string; }; }>`
-- `api.auth.pat.exchange(body?: { expiresIn: number | null; scope: { projects: string[] | null; readOnly: boolean | null; } | null; } | undefined, signal?: AbortSignal | undefined): Promise<{ accessToken: string; tokenType: string; expiresIn: number; scope: Record<string, never>; readOnly: boolean; parentTokenId: string; parentTokenType: "session" | "pat"; expiresAt: string; pat: { id: string; name: string; scope: Record<string, never>; projects: { id: number; name: string | null; role: string | null; }[]; readOnly: boolean; parentTokenId?: string | null | undefined; parentTokenType?: "session" | "pat" | null | undefined; expiresAt: string; lastUsedAt?: string | null | undefined; createdAt: string; }; }>`
+- `api.auth.pat.create(input: CreatePatInput, signal?: AbortSignal | undefined): Promise<{ accessToken: string; tokenType: string; expiresIn: number; pat: { id: string; name: string; scope: Record<string, never>; projects: { id: number; name: string | null; role: string | null; }[]; readOnly: boolean; parentTokenId?: string | null | undefined; parentTokenType?: "session" | "pat" | null | undefined; expiresAt: string; lastUsedAt?: string | null | undefined; createdAt: string; }; }>`
+- `api.auth.pat.exchange(input?: ExchangePatInput, signal?: AbortSignal | undefined): Promise<{ accessToken: string; tokenType: string; expiresIn: number; scope: Record<string, never>; readOnly: boolean; parentTokenId: string; parentTokenType: "session" | "pat"; expiresAt: string; pat: { id: string; name: string; scope: Record<string, never>; projects: { id: number; name: string | null; role: string | null; }[]; readOnly: boolean; parentTokenId?: string | null | undefined; parentTokenType?: "session" | "pat" | null | undefined; expiresAt: string; lastUsedAt?: string | null | undefined; createdAt: string; }; }>`
 - `api.auth.pat.getAll(signal?: AbortSignal | undefined): Promise<{ items: { id: string; name: string; scope: Record<string, never>; projects: { id: number; name: string | null; role: string | null; }[]; readOnly: boolean; parentTokenId?: string | null | undefined; parentTokenType?: "session" | "pat" | null | undefined; expiresAt: string; lastUsedAt?: string | null | undefined; createdAt: string; }[]; }>`
 - `api.auth.pat.revoke(id: string, signal?: AbortSignal | undefined): Promise<void>`
 

package/surface/billing.md

@@ -0,0 +1,9 @@
+# `api.billing` — `@keboola/api-client` surface
+
+<!-- GENERATED FILE — do not edit by hand. Run `pnpm --filter @keboola/api-client surface` to regenerate. -->
+
+Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
+
+- `api.billing.getCredits(signal?: AbortSignal | undefined): Promise<{ consumed: number; remaining: number; stats?: { componentJobs?: { consumed?: number | undefined; } | undefined; workspaceJobs?: { workspaceType?: "writer" | "sandbox-sql" | "transformation" | "sandbox-data-science" | undefined; warehouseSize?: "small" | "medium" | "large" | "x-small" | "x-large" | "2x-large" | "3x-large" | "4x-large" | undefined; consumed?: number | undefined; } | undefined; marketplaceSubscription?: { vendor: "aws" | "azure"; state: "inactive" | "active" | "suspended" | "unsubscribed"; billingLink: string; } | undefined; } | undefined; }>`
+- `api.billing.getCreditsAndTopUp(signal?: AbortSignal | undefined): Promise<{ consumed: number; remaining: number; stats?: { componentJobs?: { consumed?: number | undefined; } | undefined; workspaceJobs?: { workspaceType?: "writer" | "sandbox-sql" | "transformation" | "sandbox-data-science" | undefined; warehouseSize?: "small" | "medium" | "large" | "x-small" | "x-large" | "2x-large" | "3x-large" | "4x-large" | undefined; consumed?: number | undefined; } | undefined; marketplaceSubscription?: { vendor: "aws" | "azure"; state: "inactive" | "active" | "suspended" | "unsubscribed"; billingLink: string; } | undefined; } | undefined; }>`
+- `api.billing.healthCheck(signal?: AbortSignal | undefined): Promise<{ status?: string | undefined; }>`

package/surface/kaiAgent.md

@@ -5,24 +5,27 @@
 Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 
 - `api.kaiAgent.approveToolCall(chatId: string, body: { toolUseId: string; approved: boolean; reason?: string | undefined; updatedInput?: { [key: string]: unknown; } | undefined; answers?: { [key: string]: string; } | undefined; }): Promise<void>`
-- `api.kaiAgent.createChat(request: { id: string; message: { id: string; role: "user" | "assistant"; parts: { [key: string]: unknown; }[]; metadata?: { hidden?: boolean | undefined; requestContext?: { path?: string | undefined; sqlEditorActive?: boolean | undefined; } | undefined; tableContext?: { tableName: string; tableId: string; bucketId: string; fileName: string; }[] | undefined; } | undefined; }; selectedChatModel?: string | undefined; selectedVisibilityType?: "public" | "private" | undefined; branchId?: number | undefined; toolRestrictions?: { allowedTools?: string[] | undefined; disallowedTools?: string[] | undefined; readOnlyMode?: boolean | undefined; } | undefined; telemetryMetadata?: { [key: string]: string | number | boolean; } | undefined; supportsApprovalRequestedEvent?: boolean | undefined; }): Promise<Response>`
+- `api.kaiAgent.createChat(request: { id: string; message: { id: string; role: "user" | "assistant"; parts: { [key: string]: unknown; }[]; metadata?: { hidden?: boolean | undefined; requestContext?: { path?: string | undefined; sqlEditorActive?: boolean | undefined; } | undefined; tableContext?: { tableName: string; tableId: string; bucketId: string; fileName: string; }[] | undefined; } | undefined; }; selectedChatModel?: string | undefined; selectedVisibilityType?: "public" | "private" | undefined; branchId?: number | undefined; toolRestrictions?: { allowedTools?: string[] | undefined; disallowedTools?: string[] | undefined; readOnlyMode?: boolean | undefined; } | undefined; telemetryMetadata?: { [key: string]: string | number | boolean; } | undefined; supportsApprovalRequestedEvent?: boolean | undefined; client?: "kbc-ui" | "business-chat" | undefined; }): Promise<Response>`
 - `api.kaiAgent.deleteChat(chatId: string): Promise<{ id?: string | undefined; title?: string | undefined; userId?: string | undefined; createdAt?: string | undefined; visibility?: "public" | "private" | undefined; branchId?: number | null | undefined; }>`
 - `api.kaiAgent.downloadSandboxFile(chatId: string, path: string, signal?: AbortSignal | undefined): Promise<Blob>`
 - `api.kaiAgent.getAgentSettings(signal?: AbortSignal | undefined): Promise<{ projectId: string; customInstructions: string | null; createdAt: string; updatedAt: string; }>`
-- `api.kaiAgent.getChat(chatId: string, signal?: AbortSignal | undefined): Promise<{ id: string; title: string; userId: string; createdAt: string; lastMessageAt: string; visibility: "public" | "private"; branchId?: number | null | undefined; contextWindow?: { usedTokens: number; maxTokens: number; percentage: number; } | null | undefined; messages: { id: string; role: "user" | "assistant"; parts: ({ type: "text"; text: string; state?: "done" | undefined; } | { type: "tool-result"; toolCallId: string; toolName: string; result: string; } | { type: "step-start"; } | { type: "data-compact-boundary"; data: { trigger: "manual" | "auto"; preTokens: number; preservedSegment?: { headUuid: string; anchorUuid: string; tailUuid: string; } | undefined; summary: string; sdkSessionId: string; }; } | { type: string; toolCallId: string; state: "output-available" | "output-error" | "output-denied" | "input-available" | "input-streaming" | "approval-requested" | "approval-responded"; input?: { [key: string]: unknown; } | undefined; output?: unknown; errorText?: string | undefined; approval?: { id: string; approved: boolean; reason?: string | undefined; } | undefined; })[]; metadata?: { createdAt?: string | undefined; hidden?: boolean | undefined; requestContext?: { path?: string | undefined; sqlEditorActive?: boolean | undefined; } | undefined; } | undefined; status?: "completed" | "failed" | "pending" | "interrupted" | undefined; }[]; }>`
-- `api.kaiAgent.getHistory(params?: { limit?: number | undefined; starting_after?: string | undefined; ending_before?: string | undefined; } | undefined): Promise<{ chats: { id?: string | undefined; title?: string | undefined; userId?: string | undefined; createdAt?: string | undefined; lastMessageAt?: string | undefined; visibility?: "public" | "private" | undefined; branchId?: number | null | undefined; }[]; hasMore: boolean; }>`
+- `api.kaiAgent.getChat(chatId: string, signal?: AbortSignal | undefined): Promise<{ id: string; title: string; userId: string; createdAt: string; lastMessageAt: string; visibility: "public" | "private"; branchId?: number | null | undefined; contextWindow?: { usedTokens: number; maxTokens: number; percentage: number; } | null | undefined; ppuUsed: number | null; ppuPercentage: number | null; messages: { id: string; role: "user" | "assistant"; parts: ({ type: "text"; text: string; state?: "done" | undefined; } | { type: "tool-result"; toolCallId: string; toolName: string; result: string; } | { type: "step-start"; } | { type: "data-compact-boundary"; data: { trigger: "manual" | "auto"; preTokens: number; preservedSegment?: { headUuid: string; anchorUuid: string; tailUuid: string; } | undefined; summary: string; sdkSessionId: string; }; } | { type: string; toolCallId: string; state: "output-available" | "output-error" | "output-denied" | "input-available" | "input-streaming" | "approval-requested" | "approval-responded"; input?: { [key: string]: unknown; } | undefined; output?: unknown; errorText?: string | undefined; approval?: { id: string; approved: boolean; reason?: string | undefined; } | undefined; })[]; metadata?: { createdAt?: string | undefined; hidden?: boolean | undefined; requestContext?: { path?: string | undefined; sqlEditorActive?: boolean | undefined; } | undefined; } | undefined; status?: "completed" | "failed" | "pending" | "interrupted" | undefined; }[]; }>`
+- `api.kaiAgent.getHistory(params?: { limit?: number | undefined; starting_after?: string | undefined; ending_before?: string | undefined; client?: "kbc-ui" | "business-chat" | undefined; } | undefined): Promise<{ chats: { id?: string | undefined; title?: string | undefined; userId?: string | undefined; createdAt?: string | undefined; lastMessageAt?: string | undefined; visibility?: "public" | "private" | undefined; branchId?: number | null | undefined; client?: "kbc-ui" | "business-chat" | null | undefined; }[]; hasMore: boolean; }>`
 - `api.kaiAgent.getSandboxGitBranch(chatId: string, signal?: AbortSignal | undefined): Promise<{ branch: string | null; }>`
 - `api.kaiAgent.getSkillsList(signal?: AbortSignal | undefined): Promise<{ skills: { name: string; description: string | null; source: "first-party" | "vendored" | "project"; }[]; commands: { name: string; description: string; }[]; }>`
+- `api.kaiAgent.getSpendCaps(signal?: AbortSignal | undefined): Promise<SpendCapsView>`
 - `api.kaiAgent.getSuggestions(request: { context: "dashboard"; data: { recentFailedJobs: { id: string; status: "error" | "warning"; component: string; configId: string; createdTime: string; configName?: string | undefined; durationSeconds?: number | undefined; errorMessage?: string | undefined; }[]; deprecatedComponents: { id: string; name: string; type: string; expiredOn: string; configCount: number; }[]; userRecentEdits: { component: string; configId: string; configName: string; lastEdited: string; }[]; currentUserEmail: string; }; } | { context: "job-detail"; data: { job: { id: string; status: "error" | "success" | "warning" | "created" | "waiting" | "processing" | "terminating" | "terminated" | "cancelled"; component: string; createdTime: string; configId?: string | undefined; configName?: string | undefined; startTime?: string | undefined; endTime?: string | undefined; durationSeconds?: number | undefined; errorMessage?: string | undefined; errorType?: "user" | "application" | undefined; backendSize?: string | undefined; }; currentUserEmail: string; component?: { id: string; name: string; type: string; } | undefined; runtimeHistory?: { recentJobsCount: number; averageDurationSeconds?: number | undefined; minDurationSeconds?: number | undefined; maxDurationSeconds?: number | undefined; isSlowerThanAverage?: boolean | undefined; isFasterThanAverage?: boolean | undefined; percentageDifference?: number | undefined; } | undefined; }; } | { context: "configuration-detail"; data: { configuration: { id: string; name: string; component: string; hasRows: boolean; description?: string | undefined; rowCount?: number | undefined; lastChangeDescription?: string | undefined; }; currentUserEmail: string; component?: { id: string; name: string; type: string; } | undefined; latestJobs?: { id: string; status: "error" | "success" | "warning" | "created" | "waiting" | "processing" | "terminating" | "terminated" | "cancelled"; createdTime: string; durationSeconds?: number | undefined; errorMessage?: string | undefined; }[] | undefined; }; }, signal?: AbortSignal | undefined): Promise<{ suggestions: { label: string; prompt: string; priority: number; category: "error" | "maintenance" | "documentation"; reasoning: string; id: string; }[]; suggestionSessionId: string; }>`
 - `api.kaiAgent.getToolsList(signal?: AbortSignal | undefined): Promise<{ tools: { name: string; description: string; readOnly: boolean; }[]; }>`
-- `api.kaiAgent.getUsage(signal?: AbortSignal | undefined): Promise<{ messagesUsed: number; messagesLimit: number | null; resetDate: string; }>`
+- `api.kaiAgent.getUsage(signal?: AbortSignal | undefined): Promise<{ messagesUsed: number; messagesLimit: number | null; ppuUsed: number; ppuLimit: number | null; ppuLimitScope: "user" | "project" | null; projectPpuPercentage: number | null; resetDate: string; }>`
 - `api.kaiAgent.getUserAgentSettings(signal?: AbortSignal | undefined): Promise<{ projectId: string; userId: string; customInstructions: string | null; toolPermissions: Record<string, "always_allow" | "always_ask" | "blocked"> | null; createdAt: string; updatedAt: string; }>`
 - `api.kaiAgent.getVotes(chatId: string): Promise<{ chatId: string; messageId: string; isUpvoted: boolean; }[]>`
 - `api.kaiAgent.healthCheck(signal?: AbortSignal | undefined): Promise<unknown>`
 - `api.kaiAgent.listSandboxFiles(chatId: string, path?: string | undefined, signal?: AbortSignal | undefined): Promise<{ entries: { name: string; path: string; type: "file" | "dir"; size?: number | undefined; }[]; }>`
 - `api.kaiAgent.readSandboxFile(chatId: string, path: string, signal?: AbortSignal | undefined): Promise<{ content: string; encoding: "utf-8" | "binary"; truncated: boolean; size: number; }>`
+- `api.kaiAgent.setUserSpendLimit(userId: string, overrideLimitPpu: number | null, signal?: AbortSignal | undefined): Promise<{ userId: string; overrideLimitPpu: number | null; effectiveLimitPpu: number | null; usedPpu: number; overrideUpdatedAt: string | null; overrideUpdatedByUserId: string | null; }>`
 - `api.kaiAgent.stopChat(chatId: string): Promise<{ stopped: boolean; }>`
 - `api.kaiAgent.submitToolOutput(chatId: string, body: { toolUseId: string; output?: string | undefined; errorText?: string | undefined; }): Promise<void>`
 - `api.kaiAgent.submitVote(params: { chatId: string; messageId: string; type: "up" | "down"; }): Promise<void>`
 - `api.kaiAgent.updateAgentSettings(request: UpdateAgentSettingsRequest, signal?: AbortSignal | undefined): Promise<{ projectId: string; customInstructions: string | null; createdAt: string; updatedAt: string; }>`
+- `api.kaiAgent.updateSpendCaps(request: UpdateSpendCapsRequest, signal?: AbortSignal | undefined): Promise<SpendCapsView>`
 - `api.kaiAgent.updateUserAgentSettings(request: UpdateUserAgentSettingsRequest, signal?: AbortSignal | undefined): Promise<{ projectId: string; userId: string; customInstructions: string | null; toolPermissions: Record<string, "always_allow" | "always_ask" | "blocked"> | null; createdAt: string; updatedAt: string; }>`

package/surface/management.md

@@ -61,7 +61,7 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.management.maintainers.createMaintainer(body: { name: string; defaultConnectionMysqlId?: number | null | undefined; defaultConnectionSnowflakeId?: number | null | undefined; defaultConnectionSynapseId?: number | null | undefined; defaultConnectionExasolId?: number | null | undefined; defaultConnectionBigqueryId?: number | null | undefined; defaultConnectionTeradataId?: number | null | undefined; zendeskUrl?: string | null | undefined; defaultFileStorageId?: number | null | undefined; }): Promise<{ id: number; name: string; created: string; defaultConnectionMysqlId: number | null; defaultConnectionSnowflakeId: number | null; defaultConnectionSynapseId: number | null; defaultConnectionExasolId: number | null; defaultConnectionBigqueryId: number | null; defaultConnectionTeradataId: number | null; defaultFileStorageId: number | null; zendeskUrl: string | null; } & { organizations: { id: number; name: string; }[]; }>`
 - `api.management.maintainers.createMaintainerInvitation({ maintainerId, ...body }: CreateMaintainerInvitationInput): Promise<{ id: number; created?: string | null | undefined; user: { id?: number | undefined; name?: string | undefined; email?: string | undefined; }; creator: { id?: number | undefined; name?: string | undefined; email?: string | undefined; }; }>`
 - `api.management.maintainers.createMaintainerOrganization({ maintainerId, ...body }: CreateMaintainerOrganizationInput): Promise<{ id: number; name: string; created: string; allowAutoJoin: boolean; crmId: string | null; activityCenterProjectId: number | null; mfaRequired: boolean; }>`
-- `api.management.maintainers.createMaintainerSamlConfig({ maintainerId, ...body }: CreateSamlConfigInput): Promise<{ id?: number | undefined; maintainerId?: number | undefined; customerSlug?: string | undefined; name?: string | undefined; isActive?: boolean | undefined; spConfiguration?: { entityId?: string | undefined; acsUrl?: string | undefined; slsUrl?: string | undefined; metadataUrl?: string | undefined; x509Certificate?: string | undefined; } | undefined; nextSteps?: { instructions?: string | undefined; curlCommand?: string | undefined; } | undefined; }>`
+- `api.management.maintainers.createMaintainerSamlConfig({ maintainerId, ...body }: CreateSamlConfigInput): Promise<{ id?: number | undefined; maintainerId?: number | undefined; customerSlug?: string | undefined; name?: string | undefined; isActive?: boolean | undefined; membershipRestriction?: "none" | "permittedDomains" | undefined; spConfiguration?: { entityId?: string | undefined; acsUrl?: string | undefined; slsUrl?: string | undefined; metadataUrl?: string | undefined; x509Certificate?: string | undefined; } | undefined; nextSteps?: { instructions?: string | undefined; curlCommand?: string | undefined; } | undefined; }>`
 - `api.management.maintainers.deleteMaintainer(maintainerId: number): Promise<void>`
 - `api.management.maintainers.deleteMaintainerInvitation({ maintainerId, invitationId, }: MaintainerInvitationPath): Promise<void>`
 - `api.management.maintainers.deleteMaintainerMetadata({ maintainerId, metadataId, }: MaintainerMetadataItemPath): Promise<void>`
@@ -71,8 +71,8 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.management.maintainers.getMaintainerInvitations(maintainerId: number, signal?: AbortSignal | undefined): Promise<{ id: number; created?: string | null | undefined; user: { id?: number | undefined; name?: string | undefined; email?: string | undefined; }; creator: { id?: number | undefined; name?: string | undefined; email?: string | undefined; }; }[]>`
 - `api.management.maintainers.getMaintainerMetadata(maintainerId: number, signal?: AbortSignal | undefined): Promise<MetadataItem[]>`
 - `api.management.maintainers.getMaintainerOrganizations(maintainerId: number, signal?: AbortSignal | undefined): Promise<{ id?: number | undefined; name?: string | undefined; created?: string | undefined; allowAutoJoin?: boolean | undefined; crmId?: string | null | undefined; activityCenterProjectId?: number | null | undefined; mfaRequired?: boolean | undefined; }[]>`
-- `api.management.maintainers.getMaintainerSamlConfig({ maintainerId, configId }: { maintainerId: number; configId: number; }, signal?: AbortSignal | undefined): Promise<{ id?: number | undefined; maintainerId?: number | undefined; customerSlug?: string | undefined; name?: string | undefined; description?: string | null | undefined; idpEntityId?: string | undefined; idpSsoUrl?: string | null | undefined; idpSloUrl?: string | null | undefined; idpX509Cert?: string | null | undefined; spX509Cert?: string | undefined; spEntityIdSuffix?: string | null | undefined; attributeEmail?: string | undefined; attributeFirstName?: string | undefined; attributeLastName?: string | undefined; attributeRoles?: string | null | undefined; roleRequiredToLogin?: string | null | undefined; roleProjectPrefix?: string | null | undefined; roleOrgAdminPrefix?: string | null | undefined; designAdminEmail?: string | null | undefined; loginUrlParams?: { [key: string]: string; } | null | undefined; isActive?: boolean | undefined; createdAt?: string | undefined; updatedAt?: string | undefined; }>`
-- `api.management.maintainers.getMaintainerSamlConfigs(maintainerId: number, signal?: AbortSignal | undefined): Promise<{ id?: number | undefined; maintainerId?: number | undefined; customerSlug?: string | undefined; name?: string | undefined; description?: string | null | undefined; idpEntityId?: string | undefined; isActive?: boolean | undefined; createdAt?: string | undefined; updatedAt?: string | undefined; }>`
+- `api.management.maintainers.getMaintainerSamlConfig({ maintainerId, configId }: { maintainerId: number; configId: number; }, signal?: AbortSignal | undefined): Promise<{ id: number; maintainerId: number; customerSlug: string; name: string; description: string | null; idpEntityId: string; idpSsoUrl: string | null; idpSloUrl: string | null; idpX509Cert: string | null; spX509Cert: string; spEntityIdSuffix: string | null; attributeEmail: string; attributeFirstName: string; attributeLastName: string; attributeRoles: string | null; roleRequiredToLogin: string | null; roleProjectPrefix: string | null; roleOrgAdminPrefix: string | null; designAdminEmail: string | null; loginUrlParams: { [key: string]: string; } | null; permittedEmailDomains: string[]; membershipRestriction: "none" | "permittedDomains"; isActive: boolean; createdAt: string; updatedAt: string; }>`
+- `api.management.maintainers.getMaintainerSamlConfigs(maintainerId: number, signal?: AbortSignal | undefined): Promise<{ id: number; maintainerId: number; customerSlug: string; name: string; description: string | null; idpEntityId: string; membershipRestriction: "none" | "permittedDomains"; isActive: boolean; createdAt: string; updatedAt: string; }>`
 - `api.management.maintainers.getMaintainerUsers(maintainerId: number, signal?: AbortSignal | undefined): Promise<MaintainerUser[]>`
 - `api.management.maintainers.getMaintainers(signal?: AbortSignal | undefined): Promise<Maintainer[]>`
 - `api.management.maintainers.joinMaintainer(maintainerId: number): Promise<void>`
@@ -103,6 +103,16 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.management.organizations.setOrganizationMetadata({ organizationId, ...body }: SetOrganizationMetadataInput): Promise<MetadataItem[]>`
 - `api.management.organizations.updateOrganization({ organizationId, ...body }: UpdateOrganizationInput): Promise<{ id: number; name: string; created: string; allowAutoJoin: boolean; crmId: string | null; activityCenterProjectId: number | null; mfaRequired: boolean; }>`
 
+### `api.management.payAsYouGo`
+
+- `api.management.payAsYouGo.createPaymentRequest(body: { idProject: number; amount: number; saveCard?: boolean | null | undefined; }): Promise<CreditPaymentRequest>`
+- `api.management.payAsYouGo.getBillingConfiguration(signal?: AbortSignal | undefined): Promise<PayAsYouGoBillingConfiguration>`
+- `api.management.payAsYouGo.getCreditPurchases(idProject: number, signal?: AbortSignal | undefined): Promise<CreditPurchase[]>`
+- `api.management.payAsYouGo.getStripeCustomer(idProject: number, signal?: AbortSignal | undefined): Promise<{ email: string | null; name: string | null; address?: { line1?: string | null | undefined; line2?: string | null | undefined; city?: string | null | undefined; state?: string | null | undefined; postal_code?: string | null | undefined; country?: string | null | undefined; } | undefined; vat_id?: string | undefined; cards: { id: string; brand: string; exp_month: number; exp_year: number; last4: string; funding: string; }[]; } | null>`
+- `api.management.payAsYouGo.getTopUpSetting(projectId: number, signal?: AbortSignal | undefined): Promise<TopUpSetting>`
+- `api.management.payAsYouGo.updateStripeCustomer(body: { idProject: number; email?: string | null | undefined; name?: string | null | undefined; vatId?: string | null | undefined; addressLine1?: string | null | undefined; addressLine2?: string | null | undefined; addressCity?: string | null | undefined; addressState?: string | null | undefined; addressPostalCode?: string | null | undefined; addressCountry?: string | null | undefined; dropCardId?: string | null | undefined; }): Promise<{ email: string | null; name: string | null; address?: { line1?: string | null | undefined; line2?: string | null | undefined; city?: string | null | undefined; state?: string | null | undefined; postal_code?: string | null | undefined; country?: string | null | undefined; } | undefined; vat_id?: string | undefined; cards: { id: string; brand: string; exp_month: number; exp_year: number; last4: string; funding: string; }[]; }>`
+- `api.management.payAsYouGo.updateTopUpSetting(body: { idProject: number; amount: number; limit: number; enabled: boolean; }): Promise<void>`
+
 ### `api.management.projects`
 
 - `api.management.projects.addProjectFeature({ projectId, feature, }: CreateProjectFeaturePath & CreateProjectFeatureBody): Promise<ProjectBase>`

package/surface/telemetry.md

@@ -4,7 +4,5 @@
 
 Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 
-
-### `api.telemetry.provisioning`
-
-- `api.telemetry.provisioning.createCredentials(body: CreateCredentialsBody, signal?: AbortSignal | undefined): Promise<WorkspaceData>`
+- `api.telemetry.getProvisioningToken(body: { project_type?: string | undefined; }, signal?: AbortSignal | undefined): Promise<{ token?: string | undefined; expires_at?: string | undefined; }>`
+- `api.telemetry.healthCheck(signal?: AbortSignal | undefined): Promise<string>`

package/dist/ValidationError-CzPWydEb.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ValidationError-CzPWydEb.js","names":[],"sources":["../src/errors/ValidationError.ts"],"sourcesContent":["import type * as z from 'zod';\n\n/**\n * A payload the SDK refused to accept — an input a caller assembled wrongly, or a response that did\n * not match the shape the endpoint is documented to return.\n *\n * It exists so a `ZodError` never leaves the package. `ZodError.message` is `JSON.stringify` of its\n * issue list — over a kilobyte for two problems — and a consumer that renders a caught error's\n * message puts that blob in front of a user. `message` here is a single line built for exactly that\n * rendering, while `issues` keeps the structured detail for anyone inspecting the failure rather\n * than displaying it.\n */\nexport class ValidationError extends Error {\n  issues: z.core.$ZodIssue[];\n\n  constructor(message: string, issues: z.core.$ZodIssue[] = []) {\n    super(message);\n    this.name = 'ValidationError';\n    this.issues = issues;\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport const isValidationError = (error: unknown): error is ValidationError =>\n  error instanceof ValidationError;\n\n/**\n * One line per issue, prefixed by the field it belongs to. Not `z.prettifyError`, which formats for\n * a terminal — its `✖`/`→` glyphs and newlines survive a log but collapse into one run-on line in\n * HTML, where most of these end up.\n */\nconst formatIssues = (issues: readonly z.core.$ZodIssue[]) =>\n  issues\n    .map((issue) => {\n      const path = issue.path.join('.');\n\n      // A root-level issue is about the payload as a whole, and its message already says so —\n      // prefixing it with a name for \"the whole thing\" only adds noise.\n      return path ? `${path}: ${issue.message}` : issue.message;\n    })\n    .join('; ');\n\n/**\n * Parses with `schema`, converting a `ZodError` into a {@link ValidationError}. Use it instead of a\n * bare `schema.parse()` anywhere the value crosses the package boundary — every client input and\n * every response body.\n */\nexport const parseOrThrow = <T extends z.ZodType>(schema: T, value: unknown): z.output<T> => {\n  const result = schema.safeParse(value);\n\n  if (result.success) return result.data;\n\n  throw new ValidationError(formatIssues(result.error.issues), result.error.issues);\n};\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,kBAAb,MAAa,wBAAwB,MAAM;CACzC;CAEA,YAAY,SAAiB,SAA6B,CAAC,GAAG;EAC5D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,OAAO,eAAe,MAAM,gBAAgB,SAAS;CACvD;AACF;AAEA,MAAa,qBAAqB,UAChC,iBAAiB;;;;;;AAOnB,MAAM,gBAAgB,WACpB,OACG,KAAK,UAAU;CACd,MAAM,OAAO,MAAM,KAAK,KAAK,GAAG;CAIhC,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,YAAY,MAAM;AACpD,CAAC,CAAC,CACD,KAAK,IAAI;;;;;;AAOd,MAAa,gBAAqC,QAAW,UAAgC;CAC3F,MAAM,SAAS,OAAO,UAAU,KAAK;CAErC,IAAI,OAAO,SAAS,OAAO,OAAO;CAElC,MAAM,IAAI,gBAAgB,aAAa,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,MAAM;AAClF"}

package/dist/ValidationError-h5qvwahi.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ValidationError-h5qvwahi.cjs","names":[],"sources":["../src/errors/ValidationError.ts"],"sourcesContent":["import type * as z from 'zod';\n\n/**\n * A payload the SDK refused to accept — an input a caller assembled wrongly, or a response that did\n * not match the shape the endpoint is documented to return.\n *\n * It exists so a `ZodError` never leaves the package. `ZodError.message` is `JSON.stringify` of its\n * issue list — over a kilobyte for two problems — and a consumer that renders a caught error's\n * message puts that blob in front of a user. `message` here is a single line built for exactly that\n * rendering, while `issues` keeps the structured detail for anyone inspecting the failure rather\n * than displaying it.\n */\nexport class ValidationError extends Error {\n  issues: z.core.$ZodIssue[];\n\n  constructor(message: string, issues: z.core.$ZodIssue[] = []) {\n    super(message);\n    this.name = 'ValidationError';\n    this.issues = issues;\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport const isValidationError = (error: unknown): error is ValidationError =>\n  error instanceof ValidationError;\n\n/**\n * One line per issue, prefixed by the field it belongs to. Not `z.prettifyError`, which formats for\n * a terminal — its `✖`/`→` glyphs and newlines survive a log but collapse into one run-on line in\n * HTML, where most of these end up.\n */\nconst formatIssues = (issues: readonly z.core.$ZodIssue[]) =>\n  issues\n    .map((issue) => {\n      const path = issue.path.join('.');\n\n      // A root-level issue is about the payload as a whole, and its message already says so —\n      // prefixing it with a name for \"the whole thing\" only adds noise.\n      return path ? `${path}: ${issue.message}` : issue.message;\n    })\n    .join('; ');\n\n/**\n * Parses with `schema`, converting a `ZodError` into a {@link ValidationError}. Use it instead of a\n * bare `schema.parse()` anywhere the value crosses the package boundary — every client input and\n * every response body.\n */\nexport const parseOrThrow = <T extends z.ZodType>(schema: T, value: unknown): z.output<T> => {\n  const result = schema.safeParse(value);\n\n  if (result.success) return result.data;\n\n  throw new ValidationError(formatIssues(result.error.issues), result.error.issues);\n};\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,kBAAb,MAAa,wBAAwB,MAAM;CACzC;CAEA,YAAY,SAAiB,SAA6B,CAAC,GAAG;EAC5D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,OAAO,eAAe,MAAM,gBAAgB,SAAS;CACvD;AACF;AAEA,MAAa,qBAAqB,UAChC,iBAAiB;;;;;;AAOnB,MAAM,gBAAgB,WACpB,OACG,KAAK,UAAU;CACd,MAAM,OAAO,MAAM,KAAK,KAAK,GAAG;CAIhC,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,YAAY,MAAM;AACpD,CAAC,CAAC,CACD,KAAK,IAAI;;;;;;AAOd,MAAa,gBAAqC,QAAW,UAAgC;CAC3F,MAAM,SAAS,OAAO,UAAU,KAAK;CAErC,IAAI,OAAO,SAAS,OAAO,OAAO;CAElC,MAAM,IAAI,gBAAgB,aAAa,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,MAAM;AAClF"}

package/dist/authClient--BtZgjIc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authClient--BtZgjIc.js","names":["z","z","z"],"sources":["../src/clients/auth/device/device.ts","../src/clients/auth/login/schemas.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/webauthn/webauthn.ts","../src/clients/auth/authClient.ts"],"sourcesContent":["import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n/**\n * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\n *\n * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy\n *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch\n *   and handle the unknown case themselves.\n * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey\n *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it\n *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate\n *   present, `null` and absent alike.\n * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody\n *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely\n *   out of the passkey path. Whoever runs the ceremony validates it properly instead.\n */\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n  // `.optional()` explicitly: zod 4 dropped zod 3's implicit optionality for `z.unknown()`, so\n  // without it a TOTP challenge — which omits the key — fails to parse and blocks sign-in.\n  webauthn: z.unknown().optional(),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type MfaChallenge = z.infer<typeof mfaChallengeSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  // Unauthenticated. Carries the public OAuth client ids `withOidc` callers mint an id token with.\n  const methods = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/methods', {}, { signal });\n    return data;\n  };\n\n  return { withPassword, withOidc, methods };\n};\n","import * as z from 'zod';\n\nimport type { components } from '../__generated__/schema';\n\n/**\n * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in\n * `mfaType` / `allowedMethods`.\n *\n * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.\n * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or\n *   drops a method fails the build here rather than at runtime mid-sign-in.\n * - A challenge may still name a method absent from here, so the wire fields stay `string`.\n */\nexport const MFA_METHOD = {\n  totp: 'totp',\n  webauthn: 'webauthn',\n  recoveryCode: 'recovery_code',\n} as const satisfies Record<string, components['schemas']['MfaRequest']['type']>;\n\nexport type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum([MFA_METHOD.totp, MFA_METHOD.recoveryCode]),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport const totpVerifyInputSchema = z.object({\n  code: z.string().min(1, 'Required'),\n  // Optional in the spec, but `openapi-typescript` emits every `default`-bearing property as\n  // required — the schema fills in the backend's own default so callers may still omit it. Set true\n  // to sign the admin out everywhere else as part of enrolling.\n  revokeOtherSessions: z.boolean().default(false),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type TotpVerifyInput = z.input<typeof totpVerifyInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput, TotpVerifyInput } from './schemas';\nimport {\n  MFA_METHOD,\n  mfaCodeInputSchema,\n  mfaWebauthnInputSchema,\n  totpVerifyInputSchema,\n} from './schemas';\nimport type { DisableTotpPath, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: MFA_METHOD.webauthn, assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyInput, signal?: AbortSignal) => {\n      const body = totpVerifyInputSchema.parse(input);\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { CreatePatBody, ExchangePatBody, RevokePatPath } from './types';\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (body: CreatePatBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body }, { signal });\n    return data;\n  };\n\n  const exchange = async (body?: ExchangePatBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat/exchange', { body }, { signal });\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody, SudoBodyRaw } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    // The generated request body (`SudoBodyRaw`) describes a payload the endpoint rejects — see the\n    // `SudoBody` docs. Assert at this one boundary rather than making every caller send the invalid\n    // shape; the real fix is the `#[OA\\Schema]`-vs-object mismatch on the backend, upstream of the\n    // generated schema. Same pattern as `syncActionsClient`'s `PostActionsBodyRaw`.\n    const { data } = await client.post(\n      '/v1/auth/sudo',\n      { body: body as unknown as SudoBodyRaw },\n      { signal },\n    );\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  RegisterWebauthnInput,\n  RegisterWebauthnOptionsResult,\n  RemoveWebauthnInput,\n} from './types';\n\nexport const createWebauthn = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/webauthn', {}, { signal });\n    return data;\n  };\n\n  const registerOptions = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/webauthn/register/options', {}, { signal });\n    // Cast: the spec types the free-form `options` object as `Record<string, never>`.\n    return data as RegisterWebauthnOptionsResult;\n  };\n\n  const register = async (\n    { credential, deviceName = null, revokeOtherSessions = false }: RegisterWebauthnInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/v1/auth/webauthn/register',\n      { body: { credential, deviceName, revokeOtherSessions } },\n      { signal },\n    );\n    return data;\n  };\n\n  // `revokeOtherSessions` signs every other session out along with the credential — the calling\n  // session and personal access tokens survive. Omitted means the backend's own `false`.\n  const remove = async ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => {\n    await client.delete('/v1/auth/webauthn/{id}', { path: { id }, query }, { signal });\n  };\n\n  return { getAll, registerOptions, register, remove };\n};\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\nimport { validateConnectionStatus } from '../validateConnectionStatus';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\nimport { createWebauthn } from './webauthn';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n  const genericClient = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n\n  // Host-level: Connection serves the storage, management and auth APIs off one baseUrl, so this\n  // probes the host, not this API's prefix — `/v2/storage/health-check`, `/manage/health-check`\n  // and `/v1/auth/health-check` all 404.\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n    webauthn: createWebauthn(client),\n  };\n};\n"],"mappings":";;;;;;AAQA,MAAa,gBAAgB,WAAmC;CAC9D,MAAM,SAAS,OAAO,MAAqC,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,mBAAmB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC1E,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,MAAsC,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAuC,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAS;CAAS;AACrC;;;ACvBA,MAAa,mBAAmBA,IAAE,OAAO;CACvC,OAAOA,IAAE,MAAM;CACf,UAAUA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACxC,CAAC;AAED,MAAa,kBAAkBA,IAAE,OAAO;CACtC,WAAWA,IAAE,KAAK,CAAC,UAAU,WAAW,CAAC;CACzC,SAASA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACvC,CAAC;AAKD,MAAM,aAAaA,IAAE,OAAO;CAC1B,IAAIA,IAAE,OAAO;CACb,OAAOA,IAAE,OAAO;CAChB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAID,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK;CAC3C,aAAaA,IAAE,OAAO;CACtB,cAAcA,IAAE,OAAO;CACvB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,MAAM;AACR,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,IAAI;CAC3B,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,MAAMA,IAAE,OAAO,CAAC;CAGlC,UAAUA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACjC,CAAC;AAED,MAAa,oBAAoBA,IAAE,MAAM,CAAC,oBAAoB,kBAAkB,CAAC;;;ACpDjF,MAAa,eAAe,WAAmC;CAC7D,MAAM,SAAS,OAAO,MAAiB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,OAAmB,WAAyB;EACtE,MAAM,EAAE,OAAO,aAAa,iBAAiB,MAAM,KAAK;EAExD,MAAM,OAAO,MAAM,OAAO;GAAE,WAAW;GAAY;GAAO;EAAS,GAAgB,MAAM;EAGzF,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAEA,MAAM,WAAW,OAAO,OAAkB,WAAyB;EACjE,MAAM,EAAE,WAAW,YAAY,gBAAgB,MAAM,KAAK;EAE1D,MAAM,OAAO,MAAM,OAAO;GAAE;GAAW;EAAQ,GAAgB,MAAM;EACrE,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAGA,MAAM,UAAU,OAAO,WAAyB;EAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;EACpE,OAAO;CACT;CAEA,OAAO;EAAE;EAAc;EAAU;CAAQ;AAC3C;;;;;;;;;;;;ACtBA,MAAa,aAAa;CACxB,MAAM;CACN,UAAU;CACV,cAAc;AAChB;AAIA,MAAa,qBAAqBC,IAAE,OAAO;CACzC,UAAUA,IAAE,OAAO;CACnB,MAAMA,IAAE,KAAK,CAAC,WAAW,MAAM,WAAW,YAAY,CAAC;CACvD,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACpC,CAAC;AAED,MAAa,yBAAyBA,IAAE,OAAO;CAC7C,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAED,MAAa,wBAAwBA,IAAE,OAAO;CAC5C,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIlC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;AAChD,CAAC;;;AC3BD,MAAa,aAAa,WAAmC;CAC3D,MAAM,UAAU,OAAO,MAAqB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAO,OAAqB,WAAyB;EAC1E,MAAM,EAAE,UAAU,MAAM,SAAS,mBAAmB,MAAM,KAAK;EAE/D,OAAO,QAAQ;GAAE;GAAU;GAAM;EAAK,GAAoB,MAAM;CAClE;CAEA,MAAM,qBAAqB,OAAO,OAAyB,WAAyB;EAClF,MAAM,EAAE,UAAU,cAAc,uBAAuB,MAAM,KAAK;EAElE,OAAO,QAAQ;GAAE;GAAU,MAAM,WAAW;GAAU;EAAU,GAAoB,MAAM;CAC5F;CAEA,MAAM,0BAA0B,OAAO,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAoBA,OAAO;EAAE;EAAgB;EAAoB;EAAyB,MAAA;GAdpE,OAAO,OAAO,WAAyB;IACrC,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACtE,OAAO;GACT;GACA,QAAQ,OAAO,OAAwB,WAAyB;IAC9D,MAAM,OAAO,sBAAsB,MAAM,KAAK;IAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;IACnF,OAAO;GACT;GACA,SAAS,OAAO,IAA2B,WAAyB;IAClE,MAAM,OAAO,OAAO,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;GAC5E;EAGuE;CAAE;AAC7E;;;ACnDA,MAAa,0BAA0BC,IAAE,OAAO,EAC9C,OAAOA,IAAE,MAAM,EACjB,CAAC;AAED,MAAa,mBAAmBA,IAAE,OAAO;CAEvC,OAAOA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CACnC,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAGzC,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC1C,CAAC;AAED,MAAa,oBAAoBA,IAAE,OAAO;CACxC,iBAAiBA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAC7C,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIzC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC/C,CAAC;;;ACjBD,MAAa,kBAAkB,WAAmC;CAGhE,MAAM,eAAe,OAAO,OAA0B,WAAyB;EAC7E,MAAM,OAAO,wBAAwB,MAAM,KAAK;EAChD,MAAM,OAAO,KAAK,mCAAmC,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC3E;CAIA,MAAM,QAAQ,OAAO,OAAmB,WAAyB;EAG/D,MAAM,OAAO,iBAAiB,MAAM,KAAK;EACzC,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACnE;CAKA,MAAM,SAAS,OAAO,OAA4B,WAAyB;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACpE;CAEA,OAAO;EAAE;EAAc;EAAO;CAAO;AACvC;;;AC3BA,MAAa,aAAa,WAAmC;CAC3D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAqB,WAAyB;EAClE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAyB,WAAyB;EACtE,MAAM,OAAO,OAAO,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;CACvE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAQ;CAAO;AAC5C;;;ACrBA,MAAa,cAAc,WAAmC;CAC5D,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,uBAAuB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC9E,OAAO;CACT;CAEA,OAAO,EAAE,SAAS;AACpB;;;ACPA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAsB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC/E,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAyB,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,0BAA0B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACjF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAS;AAC5B;;;ACZA,MAAa,iBAAiB,WAAmC;CAC/D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,WAA2C,WAAyB;EACxF,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;CAC1F;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,OAAO,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;CACzD;CAEA,OAAO;EAAE;EAAQ;EAAQ;CAAU;AACrC;;;ACfA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAgB,WAAyB;EAK7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iBACA,EAAQ,KAA+B,GACvC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAU;AAC7B;;;ACnBA,MAAa,eAAe,WAAmC;CAC7D,MAAM,UAAU,OAAO,cAAsB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA,EAAE,MAAM,EAAE,aAAa,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,aAAa,OAAO,OAAgB,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA,CAAC,GACD;GAAE;GAAQ,SAAS,QAAQ,GAAG,WAAW,gBAAgB,UAAU,QAAQ,IAAI,KAAA;EAAU,CAC3F;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAuB,WAAyB;EACpE,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACjE;CAEA,OAAO;EAAE;EAAS;EAAY;CAAO;AACvC;;;AC3BA,MAAa,kBAAkB,WAAmC;CAChE,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,WAAyB;EACtD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;EAEvF,OAAO;CACT;CAEA,MAAM,WAAW,OACf,EAAE,YAAY,aAAa,MAAM,sBAAsB,SACvD,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,8BACA,EAAE,MAAM;GAAE;GAAY;GAAY;EAAoB,EAAE,GACxD,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAIA,MAAM,SAAS,OAAO,EAAE,IAAI,GAAG,SAA8B,WAAyB;EACpF,MAAM,OAAO,OAAO,0BAA0B;GAAE,MAAM,EAAE,GAAG;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;CACnF;CAEA,OAAO;EAAE;EAAQ;EAAiB;EAAU;CAAO;AACrD;;;AClBA,MAAa,oBAAoB,EAAE,SAAS,kBAAyC;CACnF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,gBAAgB;CAClB,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAC7C;EACA;EACA,gBAAgB;CAClB,CAAC;CAKD,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA,OAAO,YAAY,MAAM;EACzB,KAAK,UAAU,MAAM;EACrB,UAAU,eAAe,MAAM;EAC/B,MAAM,WAAW,MAAM;EACvB,KAAK,UAAU,MAAM;EACrB,QAAQ,aAAa,MAAM;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,WAAW,MAAM;EACvB,SAAS,cAAc,MAAM;EAC7B,OAAO,YAAY,MAAM;EACzB,UAAU,eAAe,MAAM;CACjC;AACF"}

package/dist/authClient-b7uec7sw.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"authClient-b7uec7sw.cjs","names":["z","z","z","HttpHeader","createOpenapiFetchClient","validateConnectionStatus","createGenericFetchClient"],"sources":["../src/clients/auth/device/device.ts","../src/clients/auth/login/schemas.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/webauthn/webauthn.ts","../src/clients/auth/authClient.ts"],"sourcesContent":["import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n/**\n * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\n *\n * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy\n *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch\n *   and handle the unknown case themselves.\n * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey\n *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it\n *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate\n *   present, `null` and absent alike.\n * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody\n *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely\n *   out of the passkey path. Whoever runs the ceremony validates it properly instead.\n */\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n  // `.optional()` explicitly: zod 4 dropped zod 3's implicit optionality for `z.unknown()`, so\n  // without it a TOTP challenge — which omits the key — fails to parse and blocks sign-in.\n  webauthn: z.unknown().optional(),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type MfaChallenge = z.infer<typeof mfaChallengeSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  // Unauthenticated. Carries the public OAuth client ids `withOidc` callers mint an id token with.\n  const methods = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/methods', {}, { signal });\n    return data;\n  };\n\n  return { withPassword, withOidc, methods };\n};\n","import * as z from 'zod';\n\nimport type { components } from '../__generated__/schema';\n\n/**\n * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in\n * `mfaType` / `allowedMethods`.\n *\n * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.\n * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or\n *   drops a method fails the build here rather than at runtime mid-sign-in.\n * - A challenge may still name a method absent from here, so the wire fields stay `string`.\n */\nexport const MFA_METHOD = {\n  totp: 'totp',\n  webauthn: 'webauthn',\n  recoveryCode: 'recovery_code',\n} as const satisfies Record<string, components['schemas']['MfaRequest']['type']>;\n\nexport type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum([MFA_METHOD.totp, MFA_METHOD.recoveryCode]),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport const totpVerifyInputSchema = z.object({\n  code: z.string().min(1, 'Required'),\n  // Optional in the spec, but `openapi-typescript` emits every `default`-bearing property as\n  // required — the schema fills in the backend's own default so callers may still omit it. Set true\n  // to sign the admin out everywhere else as part of enrolling.\n  revokeOtherSessions: z.boolean().default(false),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type TotpVerifyInput = z.input<typeof totpVerifyInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput, TotpVerifyInput } from './schemas';\nimport {\n  MFA_METHOD,\n  mfaCodeInputSchema,\n  mfaWebauthnInputSchema,\n  totpVerifyInputSchema,\n} from './schemas';\nimport type { DisableTotpPath, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: MFA_METHOD.webauthn, assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyInput, signal?: AbortSignal) => {\n      const body = totpVerifyInputSchema.parse(input);\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { CreatePatBody, ExchangePatBody, RevokePatPath } from './types';\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (body: CreatePatBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body }, { signal });\n    return data;\n  };\n\n  const exchange = async (body?: ExchangePatBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat/exchange', { body }, { signal });\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody, SudoBodyRaw } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    // The generated request body (`SudoBodyRaw`) describes a payload the endpoint rejects — see the\n    // `SudoBody` docs. Assert at this one boundary rather than making every caller send the invalid\n    // shape; the real fix is the `#[OA\\Schema]`-vs-object mismatch on the backend, upstream of the\n    // generated schema. Same pattern as `syncActionsClient`'s `PostActionsBodyRaw`.\n    const { data } = await client.post(\n      '/v1/auth/sudo',\n      { body: body as unknown as SudoBodyRaw },\n      { signal },\n    );\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  RegisterWebauthnInput,\n  RegisterWebauthnOptionsResult,\n  RemoveWebauthnInput,\n} from './types';\n\nexport const createWebauthn = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/webauthn', {}, { signal });\n    return data;\n  };\n\n  const registerOptions = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/webauthn/register/options', {}, { signal });\n    // Cast: the spec types the free-form `options` object as `Record<string, never>`.\n    return data as RegisterWebauthnOptionsResult;\n  };\n\n  const register = async (\n    { credential, deviceName = null, revokeOtherSessions = false }: RegisterWebauthnInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/v1/auth/webauthn/register',\n      { body: { credential, deviceName, revokeOtherSessions } },\n      { signal },\n    );\n    return data;\n  };\n\n  // `revokeOtherSessions` signs every other session out along with the credential — the calling\n  // session and personal access tokens survive. Omitted means the backend's own `false`.\n  const remove = async ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => {\n    await client.delete('/v1/auth/webauthn/{id}', { path: { id }, query }, { signal });\n  };\n\n  return { getAll, registerOptions, register, remove };\n};\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\nimport { validateConnectionStatus } from '../validateConnectionStatus';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\nimport { createWebauthn } from './webauthn';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n  const genericClient = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n\n  // Host-level: Connection serves the storage, management and auth APIs off one baseUrl, so this\n  // probes the host, not this API's prefix — `/v2/storage/health-check`, `/manage/health-check`\n  // and `/v1/auth/health-check` all 404.\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n    webauthn: createWebauthn(client),\n  };\n};\n"],"mappings":";;;;;;;;AAQA,MAAa,gBAAgB,WAAmC;CAC9D,MAAM,SAAS,OAAO,MAAqC,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,mBAAmB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC1E,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,MAAsC,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAuC,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAS;CAAS;AACrC;;;ACvBA,MAAa,mBAAmBA,IAAE,OAAO;CACvC,OAAOA,IAAE,MAAM;CACf,UAAUA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACxC,CAAC;AAED,MAAa,kBAAkBA,IAAE,OAAO;CACtC,WAAWA,IAAE,KAAK,CAAC,UAAU,WAAW,CAAC;CACzC,SAASA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACvC,CAAC;AAKD,MAAM,aAAaA,IAAE,OAAO;CAC1B,IAAIA,IAAE,OAAO;CACb,OAAOA,IAAE,OAAO;CAChB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAID,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK;CAC3C,aAAaA,IAAE,OAAO;CACtB,cAAcA,IAAE,OAAO;CACvB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,MAAM;AACR,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,IAAI;CAC3B,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,MAAMA,IAAE,OAAO,CAAC;CAGlC,UAAUA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACjC,CAAC;AAED,MAAa,oBAAoBA,IAAE,MAAM,CAAC,oBAAoB,kBAAkB,CAAC;;;ACpDjF,MAAa,eAAe,WAAmC;CAC7D,MAAM,SAAS,OAAO,MAAiB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,OAAmB,WAAyB;EACtE,MAAM,EAAE,OAAO,aAAa,iBAAiB,MAAM,KAAK;EAExD,MAAM,OAAO,MAAM,OAAO;GAAE,WAAW;GAAY;GAAO;EAAS,GAAgB,MAAM;EAGzF,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAEA,MAAM,WAAW,OAAO,OAAkB,WAAyB;EACjE,MAAM,EAAE,WAAW,YAAY,gBAAgB,MAAM,KAAK;EAE1D,MAAM,OAAO,MAAM,OAAO;GAAE;GAAW;EAAQ,GAAgB,MAAM;EACrE,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAGA,MAAM,UAAU,OAAO,WAAyB;EAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;EACpE,OAAO;CACT;CAEA,OAAO;EAAE;EAAc;EAAU;CAAQ;AAC3C;;;;;;;;;;;;ACtBA,MAAa,aAAa;CACxB,MAAM;CACN,UAAU;CACV,cAAc;AAChB;AAIA,MAAa,qBAAqBC,IAAE,OAAO;CACzC,UAAUA,IAAE,OAAO;CACnB,MAAMA,IAAE,KAAK,CAAC,WAAW,MAAM,WAAW,YAAY,CAAC;CACvD,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACpC,CAAC;AAED,MAAa,yBAAyBA,IAAE,OAAO;CAC7C,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAED,MAAa,wBAAwBA,IAAE,OAAO;CAC5C,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIlC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;AAChD,CAAC;;;AC3BD,MAAa,aAAa,WAAmC;CAC3D,MAAM,UAAU,OAAO,MAAqB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAO,OAAqB,WAAyB;EAC1E,MAAM,EAAE,UAAU,MAAM,SAAS,mBAAmB,MAAM,KAAK;EAE/D,OAAO,QAAQ;GAAE;GAAU;GAAM;EAAK,GAAoB,MAAM;CAClE;CAEA,MAAM,qBAAqB,OAAO,OAAyB,WAAyB;EAClF,MAAM,EAAE,UAAU,cAAc,uBAAuB,MAAM,KAAK;EAElE,OAAO,QAAQ;GAAE;GAAU,MAAM,WAAW;GAAU;EAAU,GAAoB,MAAM;CAC5F;CAEA,MAAM,0BAA0B,OAAO,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAoBA,OAAO;EAAE;EAAgB;EAAoB;EAAyB,MAAA;GAdpE,OAAO,OAAO,WAAyB;IACrC,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACtE,OAAO;GACT;GACA,QAAQ,OAAO,OAAwB,WAAyB;IAC9D,MAAM,OAAO,sBAAsB,MAAM,KAAK;IAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;IACnF,OAAO;GACT;GACA,SAAS,OAAO,IAA2B,WAAyB;IAClE,MAAM,OAAO,OAAO,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;GAC5E;EAGuE;CAAE;AAC7E;;;ACnDA,MAAa,0BAA0BC,IAAE,OAAO,EAC9C,OAAOA,IAAE,MAAM,EACjB,CAAC;AAED,MAAa,mBAAmBA,IAAE,OAAO;CAEvC,OAAOA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CACnC,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAGzC,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC1C,CAAC;AAED,MAAa,oBAAoBA,IAAE,OAAO;CACxC,iBAAiBA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAC7C,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIzC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC/C,CAAC;;;ACjBD,MAAa,kBAAkB,WAAmC;CAGhE,MAAM,eAAe,OAAO,OAA0B,WAAyB;EAC7E,MAAM,OAAO,wBAAwB,MAAM,KAAK;EAChD,MAAM,OAAO,KAAK,mCAAmC,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC3E;CAIA,MAAM,QAAQ,OAAO,OAAmB,WAAyB;EAG/D,MAAM,OAAO,iBAAiB,MAAM,KAAK;EACzC,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACnE;CAKA,MAAM,SAAS,OAAO,OAA4B,WAAyB;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACpE;CAEA,OAAO;EAAE;EAAc;EAAO;CAAO;AACvC;;;AC3BA,MAAa,aAAa,WAAmC;CAC3D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAqB,WAAyB;EAClE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAyB,WAAyB;EACtE,MAAM,OAAO,OAAO,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;CACvE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAQ;CAAO;AAC5C;;;ACrBA,MAAa,cAAc,WAAmC;CAC5D,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,uBAAuB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC9E,OAAO;CACT;CAEA,OAAO,EAAE,SAAS;AACpB;;;ACPA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAsB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC/E,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAyB,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,0BAA0B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACjF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAS;AAC5B;;;ACZA,MAAa,iBAAiB,WAAmC;CAC/D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,WAA2C,WAAyB;EACxF,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;CAC1F;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,OAAO,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;CACzD;CAEA,OAAO;EAAE;EAAQ;EAAQ;CAAU;AACrC;;;ACfA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAgB,WAAyB;EAK7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iBACA,EAAQ,KAA+B,GACvC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAU;AAC7B;;;ACnBA,MAAa,eAAe,WAAmC;CAC7D,MAAM,UAAU,OAAO,cAAsB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA,EAAE,MAAM,EAAE,aAAa,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,aAAa,OAAO,OAAgB,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA,CAAC,GACD;GAAE;GAAQ,SAAS,QAAQ,GAAGC,0BAAAA,WAAW,gBAAgB,UAAU,QAAQ,IAAI,KAAA;EAAU,CAC3F;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAuB,WAAyB;EACpE,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACjE;CAEA,OAAO;EAAE;EAAS;EAAY;CAAO;AACvC;;;AC3BA,MAAa,kBAAkB,WAAmC;CAChE,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,WAAyB;EACtD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;EAEvF,OAAO;CACT;CAEA,MAAM,WAAW,OACf,EAAE,YAAY,aAAa,MAAM,sBAAsB,SACvD,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,8BACA,EAAE,MAAM;GAAE;GAAY;GAAY;EAAoB,EAAE,GACxD,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAIA,MAAM,SAAS,OAAO,EAAE,IAAI,GAAG,SAA8B,WAAyB;EACpF,MAAM,OAAO,OAAO,0BAA0B;GAAE,MAAM,EAAE,GAAG;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;CACnF;CAEA,OAAO;EAAE;EAAQ;EAAiB;EAAU;CAAO;AACrD;;;AClBA,MAAa,oBAAoB,EAAE,SAAS,kBAAyC;CACnF,MAAM,SAASC,iCAAAA,yBAAgC;EAC7C;EACA;EACA,gBAAgBC,iCAAAA;CAClB,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAC7C;EACA;EACA,gBAAgBD,iCAAAA;CAClB,CAAC;CAKD,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA,OAAO,YAAY,MAAM;EACzB,KAAK,UAAU,MAAM;EACrB,UAAU,eAAe,MAAM;EAC/B,MAAM,WAAW,MAAM;EACvB,KAAK,UAAU,MAAM;EACrB,QAAQ,aAAa,MAAM;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,WAAW,MAAM;EACvB,SAAS,cAAc,MAAM;EAC7B,OAAO,YAAY,MAAM;EACzB,UAAU,eAAe,MAAM;CACjC;AACF"}

package/dist/configurations-CqwAxiQL.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"configurations-CqwAxiQL.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n *\n * @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are\n * organization-admin only and use that predicate; do not widen this one to\n * cover them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACfA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;;;;;AAW1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;AAsBjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;;AAQA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;AAEA,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;ACpEA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/configurations-d7SZmw69.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"configurations-d7SZmw69.js","names":[],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n *\n * @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are\n * organization-admin only and use that predicate; do not widen this one to\n * cover them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACfA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAM,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,MAAM,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAM,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK,MAAM,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAM,UAAU;;;;;;;;;;AAW1F,MAAa,oBAAoB,cAC9B,OAAO,OAAO,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;AAsBjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAK,UAAU;EACf,KAAK,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;;AAQA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;AAEA,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;ACpEA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/constants-ByEwVtGf.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants-ByEwVtGf.js","names":[],"sources":["../src/constants/projectFeatures.ts","../src/constants/backends.ts","../src/constants/serviceIds.ts","../src/constants/stacks.ts","../src/constants/index.ts"],"sourcesContent":["export const ProjectFeature = {\n  DisableLegacyBucketPrefix: 'disable-legacy-bucket-prefix',\n  SoxProtectedDefaultBranch: 'protected-default-branch',\n  StorageBranches: 'storage-branches',\n} as const;\n\nexport type ProjectFeature = (typeof ProjectFeature)[keyof typeof ProjectFeature];\n","export const Backend = {\n  Snowflake: 'snowflake',\n  Bigquery: 'bigquery',\n} as const;\n\nexport type Backend = (typeof Backend)[keyof typeof Backend];\n","/**\n * Every service a Keboola stack can announce in its `GET /v2/storage` index.\n *\n * - The values are the `id`s the stack reports; `Service['id']` and the service-client registry\n *   both narrow on them.\n * - Callers enumerate them at runtime — a test double announcing every service, for one.\n */\nexport const ServiceId = {\n  Vault: 'vault',\n  DataScience: 'data-science',\n  Encryption: 'encryption',\n  Telemetry: 'telemetry',\n  Ai: 'ai',\n  Editor: 'editor',\n  Import: 'import',\n  Oauth: 'oauth',\n  Query: 'query',\n  Queue: 'queue',\n  KaiAssistant: 'kai-assistant',\n  KaiAgent: 'kai-agent',\n  SyncActions: 'sync-actions',\n  Stream: 'stream',\n  Notification: 'notification',\n  Scheduler: 'scheduler',\n  Metastore: 'metastore',\n} as const;\n\nexport type ServiceId = (typeof ServiceId)[keyof typeof ServiceId];\n","export const Provider = {\n  Aws: 'aws',\n  Azure: 'azure',\n  Gcp: 'gcp',\n} as const;\n\nexport type Provider = (typeof Provider)[keyof typeof Provider];\n\nexport const Continent = {\n  Us: 'us',\n  Europe: 'europe',\n} as const;\n\nexport type Continent = (typeof Continent)[keyof typeof Continent];\n\nexport type KeboolaStack = {\n  id: string;\n  host: string;\n  isSingleTenant?: boolean;\n  isTesting?: boolean;\n  isPayg?: boolean;\n  provider?: Provider;\n  continent?: Continent;\n  region?: string;\n  isCanary?: boolean;\n};\n\nconst stacks = {\n  NORTH_EUROPE_AZURE: {\n    id: 'com-keboola-azure-north-europe',\n    region: 'north-europe',\n    host: 'connection.north-europe.azure.keboola.com',\n    provider: 'azure',\n    continent: 'europe',\n    isPayg: true,\n  },\n  EU_CENTRAL_1_AWS: {\n    id: 'kbc-eu-central-1',\n    region: 'eu-central-1',\n    host: 'connection.eu-central-1.keboola.com',\n    provider: 'aws',\n    continent: 'europe',\n  },\n  US_EAST_1_AWS: {\n    id: 'kbc-us-east-1',\n    region: 'us-east-1',\n    host: 'connection.keboola.com',\n    provider: 'aws',\n    continent: 'us',\n  },\n  EUROPE_WEST3_GCP: {\n    id: 'com-keboola-gcp-europe-west3',\n    region: 'europe-west3',\n    host: 'connection.europe-west3.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'europe',\n  },\n  US_EAST_4_GCP: {\n    id: 'com-keboola-gcp-us-east4',\n    region: 'us-east4',\n    host: 'connection.us-east4.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'us',\n    isPayg: true,\n  },\n\n  /* PRIVATE SINGLE TENANT STACKS\n     ---------------------------- */\n  HCI: {\n    id: 'cloud-keboola-hci',\n    host: 'connection.hci.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_PROD: {\n    id: 'cloud-keboola-cs',\n    host: 'connection.cs.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_TEST: {\n    id: 'cloud-keboola-cs-test',\n    host: 'connection.cs-test.keboola.cloud',\n    isSingleTenant: true,\n  },\n  INNOGY: {\n    id: 'cloud-keboola-innogy-hub',\n    host: 'connection.innogy-hub.keboola.cloud',\n    isSingleTenant: true,\n  },\n  GROUPON: {\n    id: 'cloud-keboola-groupon',\n    host: 'connection.groupon.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CREDIT_INFO: {\n    id: 'cloud-keboola-creditinfo',\n    host: 'connection.creditinfo.keboola.cloud',\n    isSingleTenant: true,\n  },\n  COATES: {\n    id: 'cloud-keboola-coates',\n    host: 'connection.coates.keboola.cloud',\n    isSingleTenant: true,\n  },\n  SLSP: {\n    id: 'cloud-keboola-slsp',\n    host: 'connection.slsp.keboola.cloud',\n    isSingleTenant: true,\n  },\n  HCKZ: {\n    id: 'cloud-keboola-hckz',\n    host: 'connection.hckz.keboola.cloud',\n    isSingleTenant: true,\n  },\n  PASHA: {\n    id: 'cloud-keboola-pasha',\n    host: 'connection.pasha.keboola.cloud',\n    isSingleTenant: true,\n  },\n  RBI: {\n    id: 'cloud-keboola-rbi',\n    host: 'connection.rbi.keboola.cloud',\n    isSingleTenant: true,\n  },\n  NAH: {\n    id: 'cloud-keboola-nah',\n    host: 'connection.nah.keboola.cloud',\n    isSingleTenant: true,\n    provider: 'azure',\n    continent: 'us',\n  },\n\n  /* DEV STACKS\n     ---------------------------- */\n  DEV_US_CENTRAL_1_GCP: {\n    id: 'dev-keboola-gcp-us-central1',\n    region: 'us-central1',\n    host: 'connection.us-central1.gcp.keboola.dev',\n    provider: 'gcp',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_EU_WEST_1_AWS: {\n    id: 'dev-keboola-aws-eu-west-1',\n    region: 'eu-west-1',\n    host: 'connection.eu-west-1.aws.keboola.dev',\n    provider: 'aws',\n    continent: 'europe',\n    isTesting: true,\n  },\n  DEV_US_EAST_2_AZURE: {\n    id: 'kbc-testing-azure-east-us-2',\n    region: 'east-us-2',\n    host: 'connection.east-us-2.azure.keboola-testing.com',\n    provider: 'azure',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_KEBOOLA_CANARY_ORION: {\n    id: 'dev-keboola-canary-orion',\n    region: 'europe-west3',\n    host: 'connection.canary-orion.keboola.dev',\n    provider: 'gcp',\n    continent: 'europe',\n    isCanary: true,\n  },\n} satisfies Record<string, Readonly<KeboolaStack>>;\n\n/**\n * Every stack the platform knows, keyed by name.\n *\n * - The key set is literal, so a name that is not in the object is a compile error at the call site\n *   rather than an `undefined` to fall back from.\n * - The value type stays the uniform `KeboolaStack`, so `stack.isCanary` reads on any entry, not\n *   only on the ones that carry the flag.\n */\nexport const STACKS: Record<keyof typeof stacks, Readonly<KeboolaStack>> = stacks;\n","export { ComponentId } from './componentId';\nexport { ProjectFeature } from './projectFeatures';\nexport { Backend } from './backends';\nexport { AdminRole } from './adminRoles';\nexport { ServiceId } from './serviceIds';\nexport { Continent, Provider, STACKS } from './stacks';\nexport type { KeboolaStack } from './stacks';\n\nexport const URLS = {\n  USER_DOCUMENTATION: 'https://help.keboola.com',\n  COMPONENTS: 'https://components.keboola.com',\n  DEVELOPERS_DOCUMENTATION: 'https://developers.keboola.com',\n  ACADEMY: 'https://academy.keboola.com',\n  SALES_CONTACT_FORM: 'https://keboola.com/contact',\n  SNOWFLAKE: 'https://www.snowflake.com',\n  SNOWFLAKE_DOCS: 'https://docs.snowflake.com',\n  MCP: 'https://www.keboola.com/mcp',\n  CLI: 'https://www.keboola.com/cli',\n  NODE_JS: 'https://nodejs.org/en',\n  CLAUDE_CONNECTORS: 'https://claude.ai/customize/connectors',\n  // Vendor \"how do I get this client\" pages linked from the connect surfaces.\n  CLIENT_CLAUDE_CODE_QUICKSTART: 'https://code.claude.com/docs/en/quickstart',\n  CLIENT_CLAUDE_AI: 'https://claude.ai',\n  CLIENT_CLAUDE_DESKTOP_DOWNLOAD: 'https://claude.com/download',\n  CLIENT_CURSOR_QUICKSTART: 'https://cursor.com/docs/get-started/quickstart',\n  CLIENT_VS_CODE_SETUP: 'https://code.visualstudio.com/docs/setup/setup-overview',\n  CLIENT_CODEX_QUICKSTART: 'https://developers.openai.com/codex/cli',\n  CLIENT_CHATGPT_DOWNLOAD: 'https://chatgpt.com/download',\n  CLIENT_MAKE_GET_STARTED: 'https://help.make.com/get-started',\n  CLIENT_DEVIN_DESKTOP: 'https://docs.devin.ai/desktop/getting-started',\n} as const;\n"],"mappings":";AAAA,MAAa,iBAAiB;CAC5B,2BAA2B;CAC3B,2BAA2B;CAC3B,iBAAiB;AACnB;;;ACJA,MAAa,UAAU;CACrB,WAAW;CACX,UAAU;AACZ;;;;;;;;;;ACIA,MAAa,YAAY;CACvB,OAAO;CACP,aAAa;CACb,YAAY;CACZ,WAAW;CACX,IAAI;CACJ,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,OAAO;CACP,OAAO;CACP,cAAc;CACd,UAAU;CACV,aAAa;CACb,QAAQ;CACR,cAAc;CACd,WAAW;CACX,WAAW;AACb;;;ACzBA,MAAa,WAAW;CACtB,KAAK;CACL,OAAO;CACP,KAAK;AACP;AAIA,MAAa,YAAY;CACvB,IAAI;CACJ,QAAQ;AACV;;;;;;;;;AAoKA,MAAa,SAA8D;CAnJzE,oBAAoB;EAClB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,QAAQ;CACV;CACA,kBAAkB;EAChB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,eAAe;EACb,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,kBAAkB;EAChB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,eAAe;EACb,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,QAAQ;CACV;CAIA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,WAAW;EACT,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,WAAW;EACT,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,SAAS;EACP,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,aAAa;EACX,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,OAAO;EACL,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;EAChB,UAAU;EACV,WAAW;CACb;CAIA,sBAAsB;EACpB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,mBAAmB;EACjB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,qBAAqB;EACnB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,0BAA0B;EACxB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,UAAU;CACZ;AAWyE;;;ACvK3E,MAAa,OAAO;CAClB,oBAAoB;CACpB,YAAY;CACZ,0BAA0B;CAC1B,SAAS;CACT,oBAAoB;CACpB,WAAW;CACX,gBAAgB;CAChB,KAAK;CACL,KAAK;CACL,SAAS;CACT,mBAAmB;CAEnB,+BAA+B;CAC/B,kBAAkB;CAClB,gCAAgC;CAChC,0BAA0B;CAC1B,sBAAsB;CACtB,yBAAyB;CACzB,yBAAyB;CACzB,yBAAyB;CACzB,sBAAsB;AACxB"}

package/dist/constants-lIfSdTzS.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants-lIfSdTzS.cjs","names":[],"sources":["../src/constants/projectFeatures.ts","../src/constants/backends.ts","../src/constants/serviceIds.ts","../src/constants/stacks.ts","../src/constants/index.ts"],"sourcesContent":["export const ProjectFeature = {\n  DisableLegacyBucketPrefix: 'disable-legacy-bucket-prefix',\n  SoxProtectedDefaultBranch: 'protected-default-branch',\n  StorageBranches: 'storage-branches',\n} as const;\n\nexport type ProjectFeature = (typeof ProjectFeature)[keyof typeof ProjectFeature];\n","export const Backend = {\n  Snowflake: 'snowflake',\n  Bigquery: 'bigquery',\n} as const;\n\nexport type Backend = (typeof Backend)[keyof typeof Backend];\n","/**\n * Every service a Keboola stack can announce in its `GET /v2/storage` index.\n *\n * - The values are the `id`s the stack reports; `Service['id']` and the service-client registry\n *   both narrow on them.\n * - Callers enumerate them at runtime — a test double announcing every service, for one.\n */\nexport const ServiceId = {\n  Vault: 'vault',\n  DataScience: 'data-science',\n  Encryption: 'encryption',\n  Telemetry: 'telemetry',\n  Ai: 'ai',\n  Editor: 'editor',\n  Import: 'import',\n  Oauth: 'oauth',\n  Query: 'query',\n  Queue: 'queue',\n  KaiAssistant: 'kai-assistant',\n  KaiAgent: 'kai-agent',\n  SyncActions: 'sync-actions',\n  Stream: 'stream',\n  Notification: 'notification',\n  Scheduler: 'scheduler',\n  Metastore: 'metastore',\n} as const;\n\nexport type ServiceId = (typeof ServiceId)[keyof typeof ServiceId];\n","export const Provider = {\n  Aws: 'aws',\n  Azure: 'azure',\n  Gcp: 'gcp',\n} as const;\n\nexport type Provider = (typeof Provider)[keyof typeof Provider];\n\nexport const Continent = {\n  Us: 'us',\n  Europe: 'europe',\n} as const;\n\nexport type Continent = (typeof Continent)[keyof typeof Continent];\n\nexport type KeboolaStack = {\n  id: string;\n  host: string;\n  isSingleTenant?: boolean;\n  isTesting?: boolean;\n  isPayg?: boolean;\n  provider?: Provider;\n  continent?: Continent;\n  region?: string;\n  isCanary?: boolean;\n};\n\nconst stacks = {\n  NORTH_EUROPE_AZURE: {\n    id: 'com-keboola-azure-north-europe',\n    region: 'north-europe',\n    host: 'connection.north-europe.azure.keboola.com',\n    provider: 'azure',\n    continent: 'europe',\n    isPayg: true,\n  },\n  EU_CENTRAL_1_AWS: {\n    id: 'kbc-eu-central-1',\n    region: 'eu-central-1',\n    host: 'connection.eu-central-1.keboola.com',\n    provider: 'aws',\n    continent: 'europe',\n  },\n  US_EAST_1_AWS: {\n    id: 'kbc-us-east-1',\n    region: 'us-east-1',\n    host: 'connection.keboola.com',\n    provider: 'aws',\n    continent: 'us',\n  },\n  EUROPE_WEST3_GCP: {\n    id: 'com-keboola-gcp-europe-west3',\n    region: 'europe-west3',\n    host: 'connection.europe-west3.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'europe',\n  },\n  US_EAST_4_GCP: {\n    id: 'com-keboola-gcp-us-east4',\n    region: 'us-east4',\n    host: 'connection.us-east4.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'us',\n    isPayg: true,\n  },\n\n  /* PRIVATE SINGLE TENANT STACKS\n     ---------------------------- */\n  HCI: {\n    id: 'cloud-keboola-hci',\n    host: 'connection.hci.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_PROD: {\n    id: 'cloud-keboola-cs',\n    host: 'connection.cs.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_TEST: {\n    id: 'cloud-keboola-cs-test',\n    host: 'connection.cs-test.keboola.cloud',\n    isSingleTenant: true,\n  },\n  INNOGY: {\n    id: 'cloud-keboola-innogy-hub',\n    host: 'connection.innogy-hub.keboola.cloud',\n    isSingleTenant: true,\n  },\n  GROUPON: {\n    id: 'cloud-keboola-groupon',\n    host: 'connection.groupon.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CREDIT_INFO: {\n    id: 'cloud-keboola-creditinfo',\n    host: 'connection.creditinfo.keboola.cloud',\n    isSingleTenant: true,\n  },\n  COATES: {\n    id: 'cloud-keboola-coates',\n    host: 'connection.coates.keboola.cloud',\n    isSingleTenant: true,\n  },\n  SLSP: {\n    id: 'cloud-keboola-slsp',\n    host: 'connection.slsp.keboola.cloud',\n    isSingleTenant: true,\n  },\n  HCKZ: {\n    id: 'cloud-keboola-hckz',\n    host: 'connection.hckz.keboola.cloud',\n    isSingleTenant: true,\n  },\n  PASHA: {\n    id: 'cloud-keboola-pasha',\n    host: 'connection.pasha.keboola.cloud',\n    isSingleTenant: true,\n  },\n  RBI: {\n    id: 'cloud-keboola-rbi',\n    host: 'connection.rbi.keboola.cloud',\n    isSingleTenant: true,\n  },\n  NAH: {\n    id: 'cloud-keboola-nah',\n    host: 'connection.nah.keboola.cloud',\n    isSingleTenant: true,\n    provider: 'azure',\n    continent: 'us',\n  },\n\n  /* DEV STACKS\n     ---------------------------- */\n  DEV_US_CENTRAL_1_GCP: {\n    id: 'dev-keboola-gcp-us-central1',\n    region: 'us-central1',\n    host: 'connection.us-central1.gcp.keboola.dev',\n    provider: 'gcp',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_EU_WEST_1_AWS: {\n    id: 'dev-keboola-aws-eu-west-1',\n    region: 'eu-west-1',\n    host: 'connection.eu-west-1.aws.keboola.dev',\n    provider: 'aws',\n    continent: 'europe',\n    isTesting: true,\n  },\n  DEV_US_EAST_2_AZURE: {\n    id: 'kbc-testing-azure-east-us-2',\n    region: 'east-us-2',\n    host: 'connection.east-us-2.azure.keboola-testing.com',\n    provider: 'azure',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_KEBOOLA_CANARY_ORION: {\n    id: 'dev-keboola-canary-orion',\n    region: 'europe-west3',\n    host: 'connection.canary-orion.keboola.dev',\n    provider: 'gcp',\n    continent: 'europe',\n    isCanary: true,\n  },\n} satisfies Record<string, Readonly<KeboolaStack>>;\n\n/**\n * Every stack the platform knows, keyed by name.\n *\n * - The key set is literal, so a name that is not in the object is a compile error at the call site\n *   rather than an `undefined` to fall back from.\n * - The value type stays the uniform `KeboolaStack`, so `stack.isCanary` reads on any entry, not\n *   only on the ones that carry the flag.\n */\nexport const STACKS: Record<keyof typeof stacks, Readonly<KeboolaStack>> = stacks;\n","export { ComponentId } from './componentId';\nexport { ProjectFeature } from './projectFeatures';\nexport { Backend } from './backends';\nexport { AdminRole } from './adminRoles';\nexport { ServiceId } from './serviceIds';\nexport { Continent, Provider, STACKS } from './stacks';\nexport type { KeboolaStack } from './stacks';\n\nexport const URLS = {\n  USER_DOCUMENTATION: 'https://help.keboola.com',\n  COMPONENTS: 'https://components.keboola.com',\n  DEVELOPERS_DOCUMENTATION: 'https://developers.keboola.com',\n  ACADEMY: 'https://academy.keboola.com',\n  SALES_CONTACT_FORM: 'https://keboola.com/contact',\n  SNOWFLAKE: 'https://www.snowflake.com',\n  SNOWFLAKE_DOCS: 'https://docs.snowflake.com',\n  MCP: 'https://www.keboola.com/mcp',\n  CLI: 'https://www.keboola.com/cli',\n  NODE_JS: 'https://nodejs.org/en',\n  CLAUDE_CONNECTORS: 'https://claude.ai/customize/connectors',\n  // Vendor \"how do I get this client\" pages linked from the connect surfaces.\n  CLIENT_CLAUDE_CODE_QUICKSTART: 'https://code.claude.com/docs/en/quickstart',\n  CLIENT_CLAUDE_AI: 'https://claude.ai',\n  CLIENT_CLAUDE_DESKTOP_DOWNLOAD: 'https://claude.com/download',\n  CLIENT_CURSOR_QUICKSTART: 'https://cursor.com/docs/get-started/quickstart',\n  CLIENT_VS_CODE_SETUP: 'https://code.visualstudio.com/docs/setup/setup-overview',\n  CLIENT_CODEX_QUICKSTART: 'https://developers.openai.com/codex/cli',\n  CLIENT_CHATGPT_DOWNLOAD: 'https://chatgpt.com/download',\n  CLIENT_MAKE_GET_STARTED: 'https://help.make.com/get-started',\n  CLIENT_DEVIN_DESKTOP: 'https://docs.devin.ai/desktop/getting-started',\n} as const;\n"],"mappings":";AAAA,MAAa,iBAAiB;CAC5B,2BAA2B;CAC3B,2BAA2B;CAC3B,iBAAiB;AACnB;;;ACJA,MAAa,UAAU;CACrB,WAAW;CACX,UAAU;AACZ;;;;;;;;;;ACIA,MAAa,YAAY;CACvB,OAAO;CACP,aAAa;CACb,YAAY;CACZ,WAAW;CACX,IAAI;CACJ,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,OAAO;CACP,OAAO;CACP,cAAc;CACd,UAAU;CACV,aAAa;CACb,QAAQ;CACR,cAAc;CACd,WAAW;CACX,WAAW;AACb;;;ACzBA,MAAa,WAAW;CACtB,KAAK;CACL,OAAO;CACP,KAAK;AACP;AAIA,MAAa,YAAY;CACvB,IAAI;CACJ,QAAQ;AACV;;;;;;;;;AAoKA,MAAa,SAA8D;CAnJzE,oBAAoB;EAClB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,QAAQ;CACV;CACA,kBAAkB;EAChB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,eAAe;EACb,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,kBAAkB;EAChB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,eAAe;EACb,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,QAAQ;CACV;CAIA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,WAAW;EACT,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,WAAW;EACT,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,SAAS;EACP,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,aAAa;EACX,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,OAAO;EACL,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;EAChB,UAAU;EACV,WAAW;CACb;CAIA,sBAAsB;EACpB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,mBAAmB;EACjB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,qBAAqB;EACnB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,0BAA0B;EACxB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,UAAU;CACZ;AAWyE;;;ACvK3E,MAAa,OAAO;CAClB,oBAAoB;CACpB,YAAY;CACZ,0BAA0B;CAC1B,SAAS;CACT,oBAAoB;CACpB,WAAW;CACX,gBAAgB;CAChB,KAAK;CACL,KAAK;CACL,SAAS;CACT,mBAAmB;CAEnB,+BAA+B;CAC/B,kBAAkB;CAClB,gCAAgC;CAChC,0BAA0B;CAC1B,sBAAsB;CACtB,yBAAyB;CACzB,yBAAyB;CACzB,yBAAyB;CACzB,sBAAsB;AACxB"}

package/dist/createFetchClient-BRfTjBLV.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"createFetchClient-BRfTjBLV.cjs","names":[],"sources":["../src/errors/ApiError.ts","../src/internal.ts","../src/fetchClient/createFetchClient/utils.ts","../src/fetchClient/createFetchClient/createFetchClient.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nexport class ApiError extends Error {\n  response: Response;\n  request: Request;\n  data: unknown;\n\n  constructor({ response, request, data }: ApiResponse) {\n    super(response.statusText);\n    this.response = response;\n    this.request = request;\n    this.data = data;\n  }\n}\n","// Package-internal constants. Not part of the public\n// `@keboola/api-client/constants` sub-path (that is the `constants/` directory).\n\nexport const KeboolaHttpHeader = {\n  STORAGE_API_TOKEN: 'X-StorageApi-Token',\n  MANAGEMENT_API_TOKEN: 'X-Kbc-Manageapitoken',\n  STORAGE_API_URL: 'x-storageapi-url',\n  PROJECT_ID: 'X-KBC-ProjectId',\n  /** Storage job a request enqueued, reported on the response rather than in its body. */\n  STORAGE_API_JOB_ID: 'X-StorageApi-Job-Id',\n} as const;\n\nexport const HttpStatus = {\n  NO_CONTENT: 204,\n  BAD_REQUEST: 400,\n  UNAUTHORIZED: 401,\n  UNPROCESSABLE_ENTITY: 422,\n  INTERNAL_SERVER_ERROR: 500,\n  BAD_GATEWAY: 502,\n  SERVICE_UNAVAILABLE: 503,\n  GATEWAY_TIMEOUT: 504,\n} as const;\n\nexport const ENCRYPTED_VALUE_PREFIX = 'KBC::';\n","import type { IStringifyOptions } from 'qs';\nimport qs from 'qs';\n\nimport { HttpStatus } from '../../internal';\n\nimport type {\n  ApiResponse,\n  BodyParam,\n  CreateFetchRequestFn,\n  ParseAs,\n  PathParam,\n  ValidateStatusFn,\n} from './types';\n\n/**\n * Strips trailing slashes from a base URL so concatenating a leading-slash\n * path (e.g. `/v2/storage`) never produces a double slash.\n *\n * Without this, callers that pass `https://connection.keboola.com/` end up\n * issuing requests to `https://connection.keboola.com//v2/storage/...`, which\n * the Storage API rejects with a 404.\n */\nexport const normalizeBaseUrl = (baseUrl: string): string => baseUrl.replace(/\\/+$/, '');\n\nexport const HttpHeader = {\n  CONTENT_TYPE: 'content-type',\n  CONTENT_DISPOSITION: 'content-disposition',\n  AUTHORIZATION: 'Authorization',\n  IDEMPOTENCY_KEY: 'Idempotency-Key',\n  IF_MATCH: 'If-Match',\n};\n\nexport const HttpContentType = {\n  JSON: 'application/json',\n  TEXT_PLAIN: 'text/plain',\n  FORM_DATA: 'multipart/form-data',\n  TEXT_HTML: 'text/html',\n};\n\nexport const defaultValidateStatus: ValidateStatusFn = ({ response }) =>\n  response.status >= 200 && response.status <= 299;\n\n/**\n * Whether a response carries an HTML document.\n *\n * - Media types are case-insensitive, so a `Text/HTML` login page is still one.\n * - Only meaningful on a *successful* response: HTML on a failed one is a real error page.\n */\nexport const isHtmlResponse = ({ response }: ApiResponse) =>\n  !!response.headers\n    .get(HttpHeader.CONTENT_TYPE)\n    ?.toLowerCase()\n    .includes(HttpContentType.TEXT_HTML);\n\nfunction removeUndefined(obj: Record<string, string>) {\n  const objCopy = { ...obj };\n  for (const [key, value] of Object.entries(objCopy)) {\n    if (value == null) delete objCopy[key];\n  }\n  return objCopy;\n}\n\n// `application/json`, but also `application/json; charset=utf-8` and the `+json` suffix family.\n// Comparing the raw header for equality misses every response that carries a charset.\nconst JSON_MEDIA_TYPE = /^application\\/([\\w.-]+\\+)?json$/;\n\nconst getMediaType = (response: Response) =>\n  response.headers.get(HttpHeader.CONTENT_TYPE)?.split(';')[0]?.trim().toLowerCase() ?? '';\n\n// Declared JSON is parsed strictly: a body that doesn't parse is a broken response, not a text\n// payload, and `JSON.parse` throwing is the right answer. Read it as text first only so an empty\n// body can resolve to `null` like a 204 — matching the charset form brings `application/json;\n// charset=utf-8` onto this path, where `response.json()` would turn a 200-with-no-body into a\n// `SyntaxError` it never used to be.\nconst parseJson = async (response: Response) => {\n  const text = await response.text();\n  return text.trim() === '' ? null : JSON.parse(text);\n};\n\nexport const parseData = async (response: Response, parseAs: ParseAs = 'auto') => {\n  // No body to read, whatever the caller asked for.\n  if (response.status === HttpStatus.NO_CONTENT) return null;\n\n  // Per-method-call override\n  if (parseAs === 'text') return response.text();\n  if (parseAs === 'blob') return response.blob();\n  if (parseAs === 'json') return parseJson(response);\n\n  const mediaType = getMediaType(response);\n  if (JSON_MEDIA_TYPE.test(mediaType)) return parseJson(response);\n\n  // A declared binary payload must come back as bytes — `text()` would decode it as UTF-8 and\n  // corrupt it. `application/octet-stream` is the only binary type an endpoint declares today\n  // (kai-agent's sandbox file download); widen deliberately, never by sniffing.\n  if (mediaType === 'application/octet-stream') return response.blob();\n\n  // Any other declared type describes its own payload — the query-service CSV export, the\n  // data-science `text/plain` endpoints — so hand back the exact bytes instead of sniffing them.\n  return response.text();\n};\n\n// Header instance serialize undefined value as `undefined`, we do not want that\nconst cleanHeadersInit = (headersInit: HeadersInit | undefined) => {\n  if (Array.isArray(headersInit)) return headersInit;\n  if (headersInit instanceof Headers) return headersInit;\n  if (headersInit == null) return headersInit;\n\n  return removeUndefined(headersInit);\n};\n\nconst createHeaders = (\n  headersInitA: HeadersInit | undefined,\n  headersInitB: HeadersInit | undefined,\n) => {\n  const headersA = new Headers(cleanHeadersInit(headersInitA));\n  const headersB = new Headers(cleanHeadersInit(headersInitB));\n\n  headersB.forEach((value, key) => {\n    headersA.set(key, value);\n  });\n\n  return headersA;\n};\n\nexport const createPath = (path: string, pathParam: PathParam = {}) =>\n  path.replace(/\\{([^}]+)}/g, (_, key) => {\n    if (!(key in pathParam))\n      throw new Error(`Path parameter \"${key}\" is missing in the path \"${path}\"`);\n\n    return encodeURIComponent(pathParam[key]!);\n  });\n\nexport const createSearch = (\n  query: Record<string, unknown>,\n  options: Pick<IStringifyOptions, 'arrayFormat'> = {},\n) => {\n  return qs.stringify(query, {\n    encodeValuesOnly: true,\n    skipNulls: true,\n    ...options,\n  });\n};\n\nexport const createBody = (body: BodyParam, headers: Headers) => {\n  if (body == null) return null;\n  if (body instanceof FormData) return body; // fetch automatically sets content-type header\n  if (typeof body === 'string') return body; // fetch automatically sets content-type header\n\n  const stringifyBody = JSON.stringify(body);\n  const stringBody = stringifyBody === '{}' ? null : stringifyBody;\n  if (stringBody) headers.set(HttpHeader.CONTENT_TYPE, HttpContentType.JSON);\n\n  return stringBody;\n};\n\nexport const parseContentDispositionHeader = (contentDisposition?: string | null) => {\n  // extract the type ('inline' or 'attachment'), default the type to 'unknown'\n  const type = (() => {\n    const typeMatch = contentDisposition?.match(/^\\s*(inline|attachment)\\s*;/i);\n    return (typeMatch?.[1]?.toLowerCase() ?? 'unknown') as 'inline' | 'attachment' | 'unknown';\n  })();\n\n  // extract the filename, default the type to null\n  const filename = (() => {\n    const filenameMatch = contentDisposition?.match(/filename=\"([^\"]+)\"/i);\n    if (filenameMatch) return filenameMatch[1];\n\n    // If no filename=\"...\", check for encoded filename*=UTF-8''\n    const encodedFilenameMatch = contentDisposition?.match(/filename\\*=(?:UTF-8'')?([^;]+)/i);\n    if (encodedFilenameMatch?.[1]) return decodeURIComponent(encodedFilenameMatch[1]);\n\n    // Check for unquoted filenames (rare but possible)\n    const unquotedFilenameMatch = contentDisposition?.match(/filename=([^;]+)/i);\n    return unquotedFilenameMatch?.[1] ?? null;\n  })();\n\n  // Return the parsed result\n  return { type, filename };\n};\n\nexport const createFetchRequest: CreateFetchRequestFn = ({\n  url,\n  method,\n  params,\n  options = {},\n  defaultOptions,\n}) => {\n  const {\n    baseUrl,\n    validateStatus: defValidateStatus = defaultValidateStatus,\n    headers: defaultHeaders,\n    fetchFn: defaultFetchFn,\n    ...restDefaultOptions\n  } = defaultOptions;\n  const {\n    validateStatus,\n    queryArrayFormat,\n    headers: endpointHeaders,\n    fetchFn,\n    parseAs,\n    ...restOptions\n  } = options;\n\n  const headers = createHeaders(defaultHeaders, endpointHeaders);\n  const path = createPath(url, params.path);\n  const search = createSearch(params.query ?? {}, { arrayFormat: queryArrayFormat });\n  const body = createBody(params.body, headers);\n\n  const urlInstance = new URL(normalizeBaseUrl(baseUrl) + path);\n  urlInstance.search = search;\n\n  const request = new Request(urlInstance, {\n    ...restDefaultOptions,\n    ...restOptions,\n    headers,\n    method: method.toUpperCase(),\n    body,\n  });\n\n  return {\n    request,\n    validateStatus: validateStatus ?? defValidateStatus,\n    fetchFn: fetchFn ?? defaultFetchFn,\n    parseAs,\n  };\n};\n","import { ApiError } from '../../errors';\n\nimport type {\n  BaseFetchParams,\n  CoreFetchFn,\n  CreateFetchClientOptions,\n  FetchClientOptions,\n  HttpMethod,\n} from './types';\nimport { createFetchRequest, parseData } from './utils';\n\nexport type FetchClientError = TypeError | ApiError | SyntaxError | DOMException;\n\nexport const isApiError = (error: unknown): error is ApiError => error instanceof ApiError;\n\nexport const isAbortError = (error: unknown): error is DOMException =>\n  error instanceof DOMException && error.name === 'AbortError';\n\nexport const isFetchClientError = (error: unknown): error is FetchClientError =>\n  error instanceof TypeError || error instanceof SyntaxError || isApiError(error);\n\n// `fetchFn` is resolved per request by `createFetchRequest` (endpoint option beats client option),\n// so a single request can swap the transport without rebuilding the client.\nconst coreFetch: CoreFetchFn = async ({ request, validateStatus, fetchFn = fetch, parseAs }) => {\n  const response = await fetchFn(request);\n  const data = await parseData(response, parseAs);\n\n  const apiResponse = {\n    request,\n    response,\n    data,\n  };\n\n  const boolOrError = validateStatus(apiResponse);\n  if (isApiError(boolOrError)) throw boolOrError;\n  if (!boolOrError) throw new ApiError(apiResponse);\n\n  return apiResponse;\n};\n\nexport const createFetchClient = ({\n  middlewares = [],\n  ...defaultOptions\n}: CreateFetchClientOptions) => {\n  const fetchWithMiddlewares = middlewares.reduceRight(\n    (next, middleware) => middleware(next),\n    coreFetch,\n  );\n\n  const createFetchMethod =\n    (method: HttpMethod) =>\n    async (url: string, params: BaseFetchParams, options: FetchClientOptions = {}) => {\n      const request = createFetchRequest({\n        url,\n        method,\n        params,\n        defaultOptions,\n        options,\n      });\n\n      const methodMiddlewares = options?.middlewares ?? [];\n\n      return methodMiddlewares.reduceRight(\n        (next, middleware) => middleware(next),\n        fetchWithMiddlewares,\n      )(request);\n    };\n\n  return {\n    get: createFetchMethod('get'),\n    post: createFetchMethod('post'),\n    put: createFetchMethod('put'),\n    patch: createFetchMethod('patch'),\n    delete: createFetchMethod('delete'),\n  };\n};\n"],"mappings":";;;;AAEA,IAAa,WAAb,cAA8B,MAAM;CAClC;CACA;CACA;CAEA,YAAY,EAAE,UAAU,SAAS,QAAqB;EACpD,MAAM,SAAS,UAAU;EACzB,KAAK,WAAW;EAChB,KAAK,UAAU;EACf,KAAK,OAAO;CACd;AACF;;;ACVA,MAAa,oBAAoB;CAC/B,mBAAmB;CACnB,sBAAsB;CACtB,iBAAiB;CACjB,YAAY;;CAEZ,oBAAoB;AACtB;AAEA,MAAa,aAAa;CACxB,YAAY;CACZ,aAAa;CACb,cAAc;CACd,sBAAsB;CACtB,uBAAuB;CACvB,aAAa;CACb,qBAAqB;CACrB,iBAAiB;AACnB;AAEA,MAAa,yBAAyB;;;;;;;;;;;ACDtC,MAAa,oBAAoB,YAA4B,QAAQ,QAAQ,QAAQ,EAAE;AAEvF,MAAa,aAAa;CACxB,cAAc;CACd,qBAAqB;CACrB,eAAe;CACf,iBAAiB;CACjB,UAAU;AACZ;AAEA,MAAa,kBAAkB;CAC7B,MAAM;CACN,YAAY;CACZ,WAAW;CACX,WAAW;AACb;AAEA,MAAa,yBAA2C,EAAE,eACxD,SAAS,UAAU,OAAO,SAAS,UAAU;;;;;;;AAQ/C,MAAa,kBAAkB,EAAE,eAC/B,CAAC,CAAC,SAAS,QACR,IAAI,WAAW,YAAY,CAAC,EAC3B,YAAY,CAAC,CACd,SAAS,gBAAgB,SAAS;AAEvC,SAAS,gBAAgB,KAA6B;CACpD,MAAM,UAAU,EAAE,GAAG,IAAI;CACzB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,SAAS,MAAM,OAAO,QAAQ;CAEpC,OAAO;AACT;AAIA,MAAM,kBAAkB;AAExB,MAAM,gBAAgB,aACpB,SAAS,QAAQ,IAAI,WAAW,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,KAAK;AAOxF,MAAM,YAAY,OAAO,aAAuB;CAC9C,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,OAAO,KAAK,KAAK,MAAM,KAAK,OAAO,KAAK,MAAM,IAAI;AACpD;AAEA,MAAa,YAAY,OAAO,UAAoB,UAAmB,WAAW;CAEhF,IAAI,SAAS,WAAW,WAAW,YAAY,OAAO;CAGtD,IAAI,YAAY,QAAQ,OAAO,SAAS,KAAK;CAC7C,IAAI,YAAY,QAAQ,OAAO,SAAS,KAAK;CAC7C,IAAI,YAAY,QAAQ,OAAO,UAAU,QAAQ;CAEjD,MAAM,YAAY,aAAa,QAAQ;CACvC,IAAI,gBAAgB,KAAK,SAAS,GAAG,OAAO,UAAU,QAAQ;CAK9D,IAAI,cAAc,4BAA4B,OAAO,SAAS,KAAK;CAInE,OAAO,SAAS,KAAK;AACvB;AAGA,MAAM,oBAAoB,gBAAyC;CACjE,IAAI,MAAM,QAAQ,WAAW,GAAG,OAAO;CACvC,IAAI,uBAAuB,SAAS,OAAO;CAC3C,IAAI,eAAe,MAAM,OAAO;CAEhC,OAAO,gBAAgB,WAAW;AACpC;AAEA,MAAM,iBACJ,cACA,iBACG;CACH,MAAM,WAAW,IAAI,QAAQ,iBAAiB,YAAY,CAAC;CAG3D,IAFqB,QAAQ,iBAAiB,YAAY,CAEnD,CAAC,CAAC,SAAS,OAAO,QAAQ;EAC/B,SAAS,IAAI,KAAK,KAAK;CACzB,CAAC;CAED,OAAO;AACT;AAEA,MAAa,cAAc,MAAc,YAAuB,CAAC,MAC/D,KAAK,QAAQ,gBAAgB,GAAG,QAAQ;CACtC,IAAI,EAAE,OAAO,YACX,MAAM,IAAI,MAAM,mBAAmB,IAAI,4BAA4B,KAAK,EAAE;CAE5E,OAAO,mBAAmB,UAAU,IAAK;AAC3C,CAAC;AAEH,MAAa,gBACX,OACA,UAAkD,CAAC,MAChD;CACH,OAAO,GAAA,QAAG,UAAU,OAAO;EACzB,kBAAkB;EAClB,WAAW;EACX,GAAG;CACL,CAAC;AACH;AAEA,MAAa,cAAc,MAAiB,YAAqB;CAC/D,IAAI,QAAQ,MAAM,OAAO;CACzB,IAAI,gBAAgB,UAAU,OAAO;CACrC,IAAI,OAAO,SAAS,UAAU,OAAO;CAErC,MAAM,gBAAgB,KAAK,UAAU,IAAI;CACzC,MAAM,aAAa,kBAAkB,OAAO,OAAO;CACnD,IAAI,YAAY,QAAQ,IAAI,WAAW,cAAc,gBAAgB,IAAI;CAEzE,OAAO;AACT;AAEA,MAAa,iCAAiC,uBAAuC;CAsBnF,OAAO;EAAE,aApBW;GAElB,QADkB,oBAAoB,MAAM,8BAA8B,EAAA,GACtD,EAAE,EAAE,YAAY,KAAK;EAC3C,EAAA,CAiBY;EAAG,iBAdS;GACtB,MAAM,gBAAgB,oBAAoB,MAAM,qBAAqB;GACrE,IAAI,eAAe,OAAO,cAAc;GAGxC,MAAM,uBAAuB,oBAAoB,MAAM,iCAAiC;GACxF,IAAI,uBAAuB,IAAI,OAAO,mBAAmB,qBAAqB,EAAE;GAIhF,QAD8B,oBAAoB,MAAM,mBAAmB,EAAA,GAC5C,MAAM;EACvC,EAAA,CAGsB;CAAE;AAC1B;AAEA,MAAa,sBAA4C,EACvD,KACA,QACA,QACA,UAAU,CAAC,GACX,qBACI;CACJ,MAAM,EACJ,SACA,gBAAgB,oBAAoB,uBACpC,SAAS,gBACT,SAAS,gBACT,GAAG,uBACD;CACJ,MAAM,EACJ,gBACA,kBACA,SAAS,iBACT,SACA,SACA,GAAG,gBACD;CAEJ,MAAM,UAAU,cAAc,gBAAgB,eAAe;CAC7D,MAAM,OAAO,WAAW,KAAK,OAAO,IAAI;CACxC,MAAM,SAAS,aAAa,OAAO,SAAS,CAAC,GAAG,EAAE,aAAa,iBAAiB,CAAC;CACjF,MAAM,OAAO,WAAW,OAAO,MAAM,OAAO;CAE5C,MAAM,cAAc,IAAI,IAAI,iBAAiB,OAAO,IAAI,IAAI;CAC5D,YAAY,SAAS;CAUrB,OAAO;EACL,SAAA,IATkB,QAAQ,aAAa;GACvC,GAAG;GACH,GAAG;GACH;GACA,QAAQ,OAAO,YAAY;GAC3B;EACF,CAGQ;EACN,gBAAgB,kBAAkB;EAClC,SAAS,WAAW;EACpB;CACF;AACF;;;ACpNA,MAAa,cAAc,UAAsC,iBAAiB;AAElF,MAAa,gBAAgB,UAC3B,iBAAiB,gBAAgB,MAAM,SAAS;AAElD,MAAa,sBAAsB,UACjC,iBAAiB,aAAa,iBAAiB,eAAe,WAAW,KAAK;AAIhF,MAAM,YAAyB,OAAO,EAAE,SAAS,gBAAgB,UAAU,OAAO,cAAc;CAC9F,MAAM,WAAW,MAAM,QAAQ,OAAO;CAGtC,MAAM,cAAc;EAClB;EACA;EACA,MAAA,MALiB,UAAU,UAAU,OAAO;CAM9C;CAEA,MAAM,cAAc,eAAe,WAAW;CAC9C,IAAI,WAAW,WAAW,GAAG,MAAM;CACnC,IAAI,CAAC,aAAa,MAAM,IAAI,SAAS,WAAW;CAEhD,OAAO;AACT;AAEA,MAAa,qBAAqB,EAChC,cAAc,CAAC,GACf,GAAG,qBAC2B;CAC9B,MAAM,uBAAuB,YAAY,aACtC,MAAM,eAAe,WAAW,IAAI,GACrC,SACF;CAEA,MAAM,qBACH,WACD,OAAO,KAAa,QAAyB,UAA8B,CAAC,MAAM;EAChF,MAAM,UAAU,mBAAmB;GACjC;GACA;GACA;GACA;GACA;EACF,CAAC;EAID,QAF0B,SAAS,eAAe,CAAC,EAAA,CAE1B,aACtB,MAAM,eAAe,WAAW,IAAI,GACrC,oBACF,CAAC,CAAC,OAAO;CACX;CAEF,OAAO;EACL,KAAK,kBAAkB,KAAK;EAC5B,MAAM,kBAAkB,MAAM;EAC9B,KAAK,kBAAkB,KAAK;EAC5B,OAAO,kBAAkB,OAAO;EAChC,QAAQ,kBAAkB,QAAQ;CACpC;AACF"}