@keboola/api-client 33.0.0 → 34.0.0

package/dist/chat/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","names":["z"],"sources":["../../src/clients/chat/types.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport type {\n  OpenapiBodyType,\n  OpenapiPathType,\n  OpenapiQueryType,\n  OpenapiReturnType,\n} from '../../fetchClient';\n\nimport type { components, paths } from './__generated__/schema';\n\n// Wire-format answer map produced by the AskUserQuestion approval flow.\n// Keys are full question text; values are user-selected labels (multi-select\n// joined with \", \"). Shared between kbc-ui (sender) and kai-agent (receiver).\nexport const askUserQuestionAnswersSchema = z.record(z.string(), z.string());\nexport type AskUserQuestionAnswers = z.Infer<typeof askUserQuestionAnswersSchema>;\n\n// Query Types\nexport type GetHistoryQuery = OpenapiQueryType<paths['/history']['get']>;\nexport type GetVotesQuery = OpenapiQueryType<paths['/vote']['get']>;\n\n// Path Types\nexport type GetChatPath = OpenapiPathType<paths['/chat/{id}']['get']>;\n\n// Body Types\nexport type VoteRequest = OpenapiBodyType<paths['/vote']['patch']>;\nexport type ChatRequest = OpenapiBodyType<paths['/chat']['post']>;\n\n// Return Types\nexport type HistoryResponse = OpenapiReturnType<paths['/history']['get']>;\nexport type ChatWithMessages = OpenapiReturnType<paths['/chat/{id}']['get']>;\nexport type VotesResponse = OpenapiReturnType<paths['/vote']['get']>;\nexport type UsageResponse = OpenapiReturnType<paths['/usage']['get']>;\n\n// Schema Types\nexport type Chat = components['schemas']['Chat'];\nexport type Vote = VotesResponse[number];\nexport type ChatWithMessage = components['schemas']['ChatWithMessages'];\nexport type ChatMessage = ChatWithMessage['messages'][number];\nexport type UserMessage = components['schemas']['Message'];\nexport type TextPart = UserMessage['parts'][number];\nexport type MessageStatus = NonNullable<UserMessage['status']>;\nexport type AgentSettings = components['schemas']['AgentSettings'];\nexport type UpdateAgentSettingsRequest = components['schemas']['UpdateAgentSettingsRequest'];\nexport type UserAgentSettings = components['schemas']['UserAgentSettings'];\nexport type UpdateUserAgentSettingsRequest =\n  components['schemas']['UpdateUserAgentSettingsRequest'];\nexport type ToolPermissionValue = components['schemas']['ToolPermissionValue'];\nexport type ToolInfo = components['schemas']['ToolInfo'];\nexport type ToolsListResponse = components['schemas']['ToolsListResponse'];\n"],"mappings":";;;AAcA,MAAa,+BAA+BA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,OAAO,CAAC"}
+{"version":3,"file":"types.cjs","names":["z"],"sources":["../../src/clients/chat/types.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport type {\n  OpenapiBodyType,\n  OpenapiPathType,\n  OpenapiQueryType,\n  OpenapiReturnType,\n} from '../../fetchClient';\n\nimport type { components, paths } from './__generated__/schema';\n\n// Wire-format answer map produced by the AskUserQuestion approval flow.\n// Keys are full question text; values are user-selected labels (multi-select\n// joined with \", \"). Shared between kbc-ui (sender) and kai-agent (receiver).\nexport const askUserQuestionAnswersSchema = z.record(z.string(), z.string());\nexport type AskUserQuestionAnswers = z.Infer<typeof askUserQuestionAnswersSchema>;\n\n/**\n * Why an approval slot the client posted to is gone.\n *\n * - kai-agent keeps a tombstone per removed slot and returns the reason as the\n *   error envelope's `subtype` on a 409.\n * - A 404 means no tombstone either — the toolUseId was never registered.\n * - `resolved` is benign: the decision was already recorded (double-click).\n * - `timed_out` / `swept` are genuine expiry — the run is dead.\n * - `chat_cancelled` / `shutdown` are server-side teardown, not user inaction.\n */\nexport const approvalGoneReasonSchema = z.enum([\n  'resolved',\n  'timed_out',\n  'chat_cancelled',\n  'swept',\n  'shutdown',\n]);\nexport type ApprovalGoneReason = z.Infer<typeof approvalGoneReasonSchema>;\n\n// Query Types\nexport type GetHistoryQuery = OpenapiQueryType<paths['/history']['get']>;\nexport type GetVotesQuery = OpenapiQueryType<paths['/vote']['get']>;\n\n// Path Types\nexport type GetChatPath = OpenapiPathType<paths['/chat/{id}']['get']>;\n\n// Body Types\nexport type VoteRequest = OpenapiBodyType<paths['/vote']['patch']>;\nexport type ChatRequest = OpenapiBodyType<paths['/chat']['post']>;\n\n// Return Types\nexport type HistoryResponse = OpenapiReturnType<paths['/history']['get']>;\nexport type ChatWithMessages = OpenapiReturnType<paths['/chat/{id}']['get']>;\nexport type VotesResponse = OpenapiReturnType<paths['/vote']['get']>;\nexport type UsageResponse = OpenapiReturnType<paths['/usage']['get']>;\n\n// Schema Types\nexport type Chat = components['schemas']['Chat'];\nexport type Vote = VotesResponse[number];\nexport type ChatWithMessage = components['schemas']['ChatWithMessages'];\nexport type ChatMessage = ChatWithMessage['messages'][number];\nexport type UserMessage = components['schemas']['Message'];\nexport type TextPart = UserMessage['parts'][number];\nexport type MessageStatus = NonNullable<UserMessage['status']>;\nexport type AgentSettings = components['schemas']['AgentSettings'];\nexport type UpdateAgentSettingsRequest = components['schemas']['UpdateAgentSettingsRequest'];\nexport type UserAgentSettings = components['schemas']['UserAgentSettings'];\nexport type UpdateUserAgentSettingsRequest =\n  components['schemas']['UpdateUserAgentSettingsRequest'];\nexport type ToolPermissionValue = components['schemas']['ToolPermissionValue'];\nexport type ToolInfo = components['schemas']['ToolInfo'];\nexport type ToolsListResponse = components['schemas']['ToolsListResponse'];\n"],"mappings":";;;AAcA,MAAa,+BAA+BA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,OAAO,CAAC;;;;;;;;;;;AAa3E,MAAa,2BAA2BA,IAAAA,EAAE,KAAK;CAC7C;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/chat/types.d.cts

@@ -1,2 +1,2 @@
-import { C as VoteRequest, S as Vote, T as askUserQuestionAnswersSchema, _ as UpdateAgentSettingsRequest, a as ChatRequest, b as UserAgentSettings, c as GetChatPath, d as HistoryResponse, f as MessageStatus, g as ToolsListResponse, h as ToolPermissionValue, i as ChatMessage, l as GetHistoryQuery, m as ToolInfo, n as AskUserQuestionAnswers, o as ChatWithMessage, p as TextPart, r as Chat, s as ChatWithMessages, t as AgentSettings, u as GetVotesQuery, v as UpdateUserAgentSettingsRequest, w as VotesResponse, x as UserMessage, y as UsageResponse } from "../types-0xa_7cgo.cjs";
-export { AgentSettings, AskUserQuestionAnswers, Chat, ChatMessage, ChatRequest, ChatWithMessage, ChatWithMessages, GetChatPath, GetHistoryQuery, GetVotesQuery, HistoryResponse, MessageStatus, TextPart, ToolInfo, ToolPermissionValue, ToolsListResponse, UpdateAgentSettingsRequest, UpdateUserAgentSettingsRequest, UsageResponse, UserAgentSettings, UserMessage, Vote, VoteRequest, VotesResponse, askUserQuestionAnswersSchema };
+import { C as Vote, D as askUserQuestionAnswersSchema, E as approvalGoneReasonSchema, S as UserMessage, T as VotesResponse, _ as ToolsListResponse, a as ChatMessage, b as UsageResponse, c as ChatWithMessages, d as GetVotesQuery, f as HistoryResponse, g as ToolPermissionValue, h as ToolInfo, i as Chat, l as GetChatPath, m as TextPart, n as ApprovalGoneReason, o as ChatRequest, p as MessageStatus, r as AskUserQuestionAnswers, s as ChatWithMessage, t as AgentSettings, u as GetHistoryQuery, v as UpdateAgentSettingsRequest, w as VoteRequest, x as UserAgentSettings, y as UpdateUserAgentSettingsRequest } from "../types-bGQb4Jtl.cjs";
+export { AgentSettings, ApprovalGoneReason, AskUserQuestionAnswers, Chat, ChatMessage, ChatRequest, ChatWithMessage, ChatWithMessages, GetChatPath, GetHistoryQuery, GetVotesQuery, HistoryResponse, MessageStatus, TextPart, ToolInfo, ToolPermissionValue, ToolsListResponse, UpdateAgentSettingsRequest, UpdateUserAgentSettingsRequest, UsageResponse, UserAgentSettings, UserMessage, Vote, VoteRequest, VotesResponse, approvalGoneReasonSchema, askUserQuestionAnswersSchema };

package/dist/chat/types.d.ts

@@ -1,2 +1,2 @@
-import { C as VoteRequest, S as Vote, T as askUserQuestionAnswersSchema, _ as UpdateAgentSettingsRequest, a as ChatRequest, b as UserAgentSettings, c as GetChatPath, d as HistoryResponse, f as MessageStatus, g as ToolsListResponse, h as ToolPermissionValue, i as ChatMessage, l as GetHistoryQuery, m as ToolInfo, n as AskUserQuestionAnswers, o as ChatWithMessage, p as TextPart, r as Chat, s as ChatWithMessages, t as AgentSettings, u as GetVotesQuery, v as UpdateUserAgentSettingsRequest, w as VotesResponse, x as UserMessage, y as UsageResponse } from "../types-k4R8gQ4U.js";
-export { AgentSettings, AskUserQuestionAnswers, Chat, ChatMessage, ChatRequest, ChatWithMessage, ChatWithMessages, GetChatPath, GetHistoryQuery, GetVotesQuery, HistoryResponse, MessageStatus, TextPart, ToolInfo, ToolPermissionValue, ToolsListResponse, UpdateAgentSettingsRequest, UpdateUserAgentSettingsRequest, UsageResponse, UserAgentSettings, UserMessage, Vote, VoteRequest, VotesResponse, askUserQuestionAnswersSchema };
+import { C as Vote, D as askUserQuestionAnswersSchema, E as approvalGoneReasonSchema, S as UserMessage, T as VotesResponse, _ as ToolsListResponse, a as ChatMessage, b as UsageResponse, c as ChatWithMessages, d as GetVotesQuery, f as HistoryResponse, g as ToolPermissionValue, h as ToolInfo, i as Chat, l as GetChatPath, m as TextPart, n as ApprovalGoneReason, o as ChatRequest, p as MessageStatus, r as AskUserQuestionAnswers, s as ChatWithMessage, t as AgentSettings, u as GetHistoryQuery, v as UpdateAgentSettingsRequest, w as VoteRequest, x as UserAgentSettings, y as UpdateUserAgentSettingsRequest } from "../types-DhDNS-5B.js";
+export { AgentSettings, ApprovalGoneReason, AskUserQuestionAnswers, Chat, ChatMessage, ChatRequest, ChatWithMessage, ChatWithMessages, GetChatPath, GetHistoryQuery, GetVotesQuery, HistoryResponse, MessageStatus, TextPart, ToolInfo, ToolPermissionValue, ToolsListResponse, UpdateAgentSettingsRequest, UpdateUserAgentSettingsRequest, UsageResponse, UserAgentSettings, UserMessage, Vote, VoteRequest, VotesResponse, approvalGoneReasonSchema, askUserQuestionAnswersSchema };

package/dist/chat/types.js

@@ -1,7 +1,24 @@
 import { z } from "zod";
 //#region src/clients/chat/types.ts
 const askUserQuestionAnswersSchema = z.record(z.string(), z.string());
+/**
+* Why an approval slot the client posted to is gone.
+*
+* - kai-agent keeps a tombstone per removed slot and returns the reason as the
+*   error envelope's `subtype` on a 409.
+* - A 404 means no tombstone either — the toolUseId was never registered.
+* - `resolved` is benign: the decision was already recorded (double-click).
+* - `timed_out` / `swept` are genuine expiry — the run is dead.
+* - `chat_cancelled` / `shutdown` are server-side teardown, not user inaction.
+*/
+const approvalGoneReasonSchema = z.enum([
+	"resolved",
+	"timed_out",
+	"chat_cancelled",
+	"swept",
+	"shutdown"
+]);
 //#endregion
-export { askUserQuestionAnswersSchema };
+export { approvalGoneReasonSchema, askUserQuestionAnswersSchema };
 
 //# sourceMappingURL=types.js.map

package/dist/chat/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../src/clients/chat/types.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport type {\n  OpenapiBodyType,\n  OpenapiPathType,\n  OpenapiQueryType,\n  OpenapiReturnType,\n} from '../../fetchClient';\n\nimport type { components, paths } from './__generated__/schema';\n\n// Wire-format answer map produced by the AskUserQuestion approval flow.\n// Keys are full question text; values are user-selected labels (multi-select\n// joined with \", \"). Shared between kbc-ui (sender) and kai-agent (receiver).\nexport const askUserQuestionAnswersSchema = z.record(z.string(), z.string());\nexport type AskUserQuestionAnswers = z.Infer<typeof askUserQuestionAnswersSchema>;\n\n// Query Types\nexport type GetHistoryQuery = OpenapiQueryType<paths['/history']['get']>;\nexport type GetVotesQuery = OpenapiQueryType<paths['/vote']['get']>;\n\n// Path Types\nexport type GetChatPath = OpenapiPathType<paths['/chat/{id}']['get']>;\n\n// Body Types\nexport type VoteRequest = OpenapiBodyType<paths['/vote']['patch']>;\nexport type ChatRequest = OpenapiBodyType<paths['/chat']['post']>;\n\n// Return Types\nexport type HistoryResponse = OpenapiReturnType<paths['/history']['get']>;\nexport type ChatWithMessages = OpenapiReturnType<paths['/chat/{id}']['get']>;\nexport type VotesResponse = OpenapiReturnType<paths['/vote']['get']>;\nexport type UsageResponse = OpenapiReturnType<paths['/usage']['get']>;\n\n// Schema Types\nexport type Chat = components['schemas']['Chat'];\nexport type Vote = VotesResponse[number];\nexport type ChatWithMessage = components['schemas']['ChatWithMessages'];\nexport type ChatMessage = ChatWithMessage['messages'][number];\nexport type UserMessage = components['schemas']['Message'];\nexport type TextPart = UserMessage['parts'][number];\nexport type MessageStatus = NonNullable<UserMessage['status']>;\nexport type AgentSettings = components['schemas']['AgentSettings'];\nexport type UpdateAgentSettingsRequest = components['schemas']['UpdateAgentSettingsRequest'];\nexport type UserAgentSettings = components['schemas']['UserAgentSettings'];\nexport type UpdateUserAgentSettingsRequest =\n  components['schemas']['UpdateUserAgentSettingsRequest'];\nexport type ToolPermissionValue = components['schemas']['ToolPermissionValue'];\nexport type ToolInfo = components['schemas']['ToolInfo'];\nexport type ToolsListResponse = components['schemas']['ToolsListResponse'];\n"],"mappings":";;AAcA,MAAa,+BAA+B,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC"}
+{"version":3,"file":"types.js","names":[],"sources":["../../src/clients/chat/types.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport type {\n  OpenapiBodyType,\n  OpenapiPathType,\n  OpenapiQueryType,\n  OpenapiReturnType,\n} from '../../fetchClient';\n\nimport type { components, paths } from './__generated__/schema';\n\n// Wire-format answer map produced by the AskUserQuestion approval flow.\n// Keys are full question text; values are user-selected labels (multi-select\n// joined with \", \"). Shared between kbc-ui (sender) and kai-agent (receiver).\nexport const askUserQuestionAnswersSchema = z.record(z.string(), z.string());\nexport type AskUserQuestionAnswers = z.Infer<typeof askUserQuestionAnswersSchema>;\n\n/**\n * Why an approval slot the client posted to is gone.\n *\n * - kai-agent keeps a tombstone per removed slot and returns the reason as the\n *   error envelope's `subtype` on a 409.\n * - A 404 means no tombstone either — the toolUseId was never registered.\n * - `resolved` is benign: the decision was already recorded (double-click).\n * - `timed_out` / `swept` are genuine expiry — the run is dead.\n * - `chat_cancelled` / `shutdown` are server-side teardown, not user inaction.\n */\nexport const approvalGoneReasonSchema = z.enum([\n  'resolved',\n  'timed_out',\n  'chat_cancelled',\n  'swept',\n  'shutdown',\n]);\nexport type ApprovalGoneReason = z.Infer<typeof approvalGoneReasonSchema>;\n\n// Query Types\nexport type GetHistoryQuery = OpenapiQueryType<paths['/history']['get']>;\nexport type GetVotesQuery = OpenapiQueryType<paths['/vote']['get']>;\n\n// Path Types\nexport type GetChatPath = OpenapiPathType<paths['/chat/{id}']['get']>;\n\n// Body Types\nexport type VoteRequest = OpenapiBodyType<paths['/vote']['patch']>;\nexport type ChatRequest = OpenapiBodyType<paths['/chat']['post']>;\n\n// Return Types\nexport type HistoryResponse = OpenapiReturnType<paths['/history']['get']>;\nexport type ChatWithMessages = OpenapiReturnType<paths['/chat/{id}']['get']>;\nexport type VotesResponse = OpenapiReturnType<paths['/vote']['get']>;\nexport type UsageResponse = OpenapiReturnType<paths['/usage']['get']>;\n\n// Schema Types\nexport type Chat = components['schemas']['Chat'];\nexport type Vote = VotesResponse[number];\nexport type ChatWithMessage = components['schemas']['ChatWithMessages'];\nexport type ChatMessage = ChatWithMessage['messages'][number];\nexport type UserMessage = components['schemas']['Message'];\nexport type TextPart = UserMessage['parts'][number];\nexport type MessageStatus = NonNullable<UserMessage['status']>;\nexport type AgentSettings = components['schemas']['AgentSettings'];\nexport type UpdateAgentSettingsRequest = components['schemas']['UpdateAgentSettingsRequest'];\nexport type UserAgentSettings = components['schemas']['UserAgentSettings'];\nexport type UpdateUserAgentSettingsRequest =\n  components['schemas']['UpdateUserAgentSettingsRequest'];\nexport type ToolPermissionValue = components['schemas']['ToolPermissionValue'];\nexport type ToolInfo = components['schemas']['ToolInfo'];\nexport type ToolsListResponse = components['schemas']['ToolsListResponse'];\n"],"mappings":";;AAcA,MAAa,+BAA+B,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;;;;;;;;;;;AAa3E,MAAa,2BAA2B,EAAE,KAAK;CAC7C;CACA;CACA;CACA;CACA;AACF,CAAC"}

package/dist/{configurations-d7SZmw69.js → configurations-BVvcimzo.js}

@@ -86,6 +86,21 @@ const assertCanWriteKaiSettings = (token) => {
 		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
 	});
 };
+/**
+* Whether this token may write the project's semantic layer — models and their
+* datasets, metrics, relationships, glossary terms and constraints in the
+* metastore.
+*
+* - A denylist, unlike `isKaiSettingsWriterRole` above: the metastore's
+*   project-level ACL admits ordinary project work, so every role that can edit
+*   configurations can edit the model. Only `readOnly` is refused.
+* - A limited (non-master) token carries no project role and its `admin` block is
+*   absent (AI-3593) — hence the optional chain. It is not denied here: the
+*   metastore, not this client, decides what such a token may do.
+* - Organization-scope promotion is a separate, narrower right the metastore
+*   answers with a 403; surface that error rather than pre-empting it here.
+*/
+const canWriteSemanticLayer = (token) => token.admin?.role !== AdminRole.ReadOnly;
 const assertCanAdmin = (token) => {
 	if (!isAdmin(token)) throw new PermissionDeniedError({
 		action: "admin",
@@ -157,6 +172,6 @@ const assertCanAssignFolder = (token, ctx) => {
 	});
 };
 //#endregion
-export { isKnownAdminRole as C, PermissionDeniedError as E, isKaiSettingsWriterRole as S, isReadOnlyRole as T, assertCanWriteKaiSettings as _, assertCanPurgeConfiguration as a, isAdminOrShare as b, canCopyConfiguration as c, canPurgeConfiguration as d, canUpdateConfiguration as f, assertCanProductionManage as g, assertCanDevelopOrReview as h, assertCanMigrateFromTemplate as i, canCreateConfiguration as l, assertCanAdminOrShare as m, assertCanCopyConfiguration as n, assertCanUpdateConfiguration as o, assertCanAdmin as p, assertCanCreateConfiguration as r, canAssignFolder as s, assertCanAssignFolder as t, canMigrateFromTemplate as u, canWriteKaiSettings as v, isProductionManager as w, isDeveloperOrReviewer as x, isAdmin as y };
+export { isKaiSettingsWriterRole as C, PermissionDeniedError as D, isReadOnlyRole as E, isDeveloperOrReviewer as S, isProductionManager as T, assertCanWriteKaiSettings as _, assertCanPurgeConfiguration as a, isAdmin as b, canCopyConfiguration as c, canPurgeConfiguration as d, canUpdateConfiguration as f, assertCanProductionManage as g, assertCanDevelopOrReview as h, assertCanMigrateFromTemplate as i, canCreateConfiguration as l, assertCanAdminOrShare as m, assertCanCopyConfiguration as n, assertCanUpdateConfiguration as o, assertCanAdmin as p, assertCanCreateConfiguration as r, canAssignFolder as s, assertCanAssignFolder as t, canMigrateFromTemplate as u, canWriteKaiSettings as v, isKnownAdminRole as w, isAdminOrShare as x, canWriteSemanticLayer as y };
 
-//# sourceMappingURL=configurations-d7SZmw69.js.map
+//# sourceMappingURL=configurations-BVvcimzo.js.map

package/dist/configurations-BVvcimzo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configurations-BVvcimzo.js","names":[],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n *\n * @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are\n * organization-admin only and use that predicate; do not widen this one to\n * cover them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer — models and their\n * datasets, metrics, relationships, glossary terms and constraints in the\n * metastore.\n *\n * - A denylist, unlike `isKaiSettingsWriterRole` above: the metastore's\n *   project-level ACL admits ordinary project work, so every role that can edit\n *   configurations can edit the model. Only `readOnly` is refused.\n * - A limited (non-master) token carries no project role and its `admin` block is\n *   absent (AI-3593) — hence the optional chain. It is not denied here: the\n *   metastore, not this client, decides what such a token may do.\n * - Organization-scope promotion is a separate, narrower right the metastore\n *   answers with a 403; surface that error rather than pre-empting it here.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role !== AdminRole.ReadOnly;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACfA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAM,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,MAAM,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAM,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK,MAAM,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAM,UAAU;;;;;;;;;;AAW1F,MAAa,oBAAoB,cAC9B,OAAO,OAAO,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;AAsBjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAK,UAAU;EACf,KAAK,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;;AAQA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;;;;;;;AAgBA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAAS,UAAU;AAElC,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;ACrFA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/{configurations-CqwAxiQL.cjs → configurations-CyFF9Dtu.cjs}

@@ -86,6 +86,21 @@ const assertCanWriteKaiSettings = (token) => {
 		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' may not write Kai settings` : "a limited (non-master) token may not write Kai settings"
 	});
 };
+/**
+* Whether this token may write the project's semantic layer — models and their
+* datasets, metrics, relationships, glossary terms and constraints in the
+* metastore.
+*
+* - A denylist, unlike `isKaiSettingsWriterRole` above: the metastore's
+*   project-level ACL admits ordinary project work, so every role that can edit
+*   configurations can edit the model. Only `readOnly` is refused.
+* - A limited (non-master) token carries no project role and its `admin` block is
+*   absent (AI-3593) — hence the optional chain. It is not denied here: the
+*   metastore, not this client, decides what such a token may do.
+* - Organization-scope promotion is a separate, narrower right the metastore
+*   answers with a 403; surface that error rather than pre-empting it here.
+*/
+const canWriteSemanticLayer = (token) => token.admin?.role !== require_adminRoles.AdminRole.ReadOnly;
 const assertCanAdmin = (token) => {
 	if (!isAdmin(token)) throw new PermissionDeniedError({
 		action: "admin",
@@ -271,6 +286,12 @@ Object.defineProperty(exports, "canWriteKaiSettings", {
 		return canWriteKaiSettings;
 	}
 });
+Object.defineProperty(exports, "canWriteSemanticLayer", {
+	enumerable: true,
+	get: function() {
+		return canWriteSemanticLayer;
+	}
+});
 Object.defineProperty(exports, "isAdmin", {
 	enumerable: true,
 	get: function() {
@@ -314,4 +335,4 @@ Object.defineProperty(exports, "isReadOnlyRole", {
 	}
 });
 
-//# sourceMappingURL=configurations-CqwAxiQL.cjs.map
+//# sourceMappingURL=configurations-CyFF9Dtu.cjs.map

package/dist/configurations-CyFF9Dtu.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configurations-CyFF9Dtu.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n *\n * @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are\n * organization-admin only and use that predicate; do not widen this one to\n * cover them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer — models and their\n * datasets, metrics, relationships, glossary terms and constraints in the\n * metastore.\n *\n * - A denylist, unlike `isKaiSettingsWriterRole` above: the metastore's\n *   project-level ACL admits ordinary project work, so every role that can edit\n *   configurations can edit the model. Only `readOnly` is refused.\n * - A limited (non-master) token carries no project role and its `admin` block is\n *   absent (AI-3593) — hence the optional chain. It is not denied here: the\n *   metastore, not this client, decides what such a token may do.\n * - Organization-scope promotion is a separate, narrower right the metastore\n *   answers with a 403; surface that error rather than pre-empting it here.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role !== AdminRole.ReadOnly;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACfA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;;;;;AAW1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;AAsBjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;;AAQA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;;;;;;;AAgBA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAASA,mBAAAA,UAAU;AAElC,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;ACrFA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/{configurations-ZwBXilW-.js → configurations-VtNE0nrT.js}

@@ -1,5 +1,5 @@
 import { t as isPlainObject } from "./isPlainObject-LYW-03uB.js";
-import { o as assertCanUpdateConfiguration, r as assertCanCreateConfiguration } from "./configurations-d7SZmw69.js";
+import { o as assertCanUpdateConfiguration, r as assertCanCreateConfiguration } from "./configurations-BVvcimzo.js";
 import { t as ComponentId } from "./componentId-vJz-kWs6.js";
 import { z } from "zod";
 //#region src/utils/isEmptyDeep.ts
@@ -723,4 +723,4 @@ const createConfigurationSdk = ({ storageClient, encryptionClient, context }) =>
 //#endregion
 export { schemaGuidedMerge as n, isEmptyDeep as r, createConfigurationSdk as t };
 
-//# sourceMappingURL=configurations-ZwBXilW-.js.map
+//# sourceMappingURL=configurations-VtNE0nrT.js.map

package/dist/{configurations-ZwBXilW-.js.map → configurations-VtNE0nrT.js.map}

@@ -1 +1 @@
-{"version":3,"file":"configurations-ZwBXilW-.js","names":["snowflakeCommon"],"sources":["../src/utils/isEmptyDeep.ts","../src/utils/schemaGuidedMerge.ts","../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../src/sdks/configurations/schemas/common/dbConfig.ts","../src/sdks/configurations/schemas/common/dbConnection.ts","../src/sdks/configurations/schemas/common/forbidden.ts","../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../src/sdks/configurations/schemas/common/sslSchema.ts","../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../src/sdks/configurations/schemas/googleAdsSchema.ts","../src/sdks/configurations/schemas/schedulerSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../src/sdks/configurations/createRegistry/createRegistry.ts","../src/sdks/configurations/registry.ts","../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { isPlainObject } from './isPlainObject';\n\n/**\n * Is `value` \"deeply empty\" — i.e. carries no leaf data? `null`/`undefined`, `{}`, `[]`, and\n * nested structures whose every leaf is itself empty (e.g. `{ parameters: {} }`) are empty.\n * Any present primitive (string, number, boolean — including `''`) counts as content.\n *\n * Used to skip a pointless encryption round-trip when a validated configuration has nothing\n * to encrypt.\n */\nexport const isEmptyDeep = (value: unknown): boolean => {\n  if (value == null) return true;\n  if (Array.isArray(value)) return value.every(isEmptyDeep);\n  if (isPlainObject(value)) return Object.values(value).every(isEmptyDeep);\n  return false;\n};\n","import { z } from 'zod';\n\nimport { isPlainObject } from './isPlainObject';\n\n/** Strip optional/nullable/default wrappers to reach the structural schema node. */\nconst unwrap = (schema: z.core.$ZodType): z.core.$ZodType =>\n  schema instanceof z.ZodOptional ||\n  schema instanceof z.ZodNullable ||\n  schema instanceof z.ZodDefault\n    ? unwrap(schema.unwrap())\n    : schema;\n\n/**\n * Merge `patch` into `base`, guided by `schema`: descend only through object schemas, merging\n * key-by-key. At every non-object node — a `z.union` (e.g. Snowflake's password|keypair auth),\n * an array, or a primitive — the patch REPLACES the base wholesale. That replace is what lets an\n * update *delete* keys the additive `deepMerge` cannot: switching a credential union to the other\n * variant drops the abandoned variant's secret, because the entire union subtree is swapped.\n *\n * Consequence: a union (or array) subtree is all-or-nothing — the caller must send the complete\n * block, since a partial patch replaces (and so loses) the omitted siblings.\n *\n * Object keys present only in `base` (e.g. `storage`, `processors`, anything the schema omits) are\n * preserved at every level; `undefined` patch values are skipped. Assumes `patch` is already\n * schema-validated (so every object-valued patch key has a matching schema node). Pure — neither\n * argument is mutated.\n */\nexport const schemaGuidedMerge = <T extends Record<string, unknown>>(\n  schema: z.core.$ZodType,\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const node = unwrap(schema);\n  if (!(node instanceof z.ZodObject) || !isPlainObject(base)) return patch as T;\n\n  const out: Record<string, unknown> = { ...base };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const child = node.shape[key];\n    const current = out[key];\n    out[key] =\n      child && isPlainObject(current) && isPlainObject(value)\n        ? schemaGuidedMerge(child, current, value)\n        : value;\n  }\n\n  return out as T;\n};\n","import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials — host/port/user/#password/database + optional SSH tunnel, the\n * same `parameters.db` block the writers use. Tunnel support mirrors kbc-ui's `hasSshTunnel` /\n * `hasSsl` (`apps/kbc-ui/src/scripts/modules/ex-db-generic/helpers.ts`): most drivers accept an\n * SSH tunnel, only pgsql/mysql/mssql also accept SSL, and a handful accept neither. This shared\n * schema covers the generic SSH-only drivers: redshift, db2(-bata), mssql-cdata, impala,\n * hive(-csas, -csas-test). SSL-capable pgsql and the tunnel-less progress-db get their own\n * schema, as do drivers with extra/renamed fields.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { createDefaultBranch } from '../../domain/defaultBranch';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — schema-guided deep merge: object fields patch individually, while a\n *   credential union or array subtree is replaced wholesale (so switching auth variants deletes\n *   the abandoned secret). Untouched leaves and out-of-schema keys are preserved. Reads the\n *   current config first to merge onto.\n * - `'replace'` — store exactly what the caller sends (after validation + encryption); no read,\n *   no merge. Completeness is on the caller — any field or sibling key (e.g. `storage`) it omits\n *   is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,eAAe,UAA4B;CACtD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,MAAM,WAAW;CACxD,IAAI,cAAc,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,WAAW;CACvE,OAAO;AACT;;;;ACVA,MAAM,UAAU,WACd,kBAAkB,EAAE,eACpB,kBAAkB,EAAE,eACpB,kBAAkB,EAAE,aAChB,OAAO,OAAO,OAAO,CAAC,IACtB;;;;;;;;;;;;;;;;AAiBN,MAAa,qBACX,QACA,MACA,UACM;CACN,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,EAAE,gBAAgB,EAAE,cAAc,CAAC,cAAc,IAAI,GAAG,OAAO;CAEnE,MAAM,MAA+B,EAAE,GAAG,KAAK;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OACF,SAAS,cAAc,OAAO,KAAK,cAAc,KAAK,IAClD,kBAAkB,OAAO,SAAS,KAAK,IACvC;CACR;CAEA,OAAO;AACT;;;;;;;;ACxCA,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO,EACnB,IAAI,EAAE,OAAO,EACX,aAAa,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;;ACVD,MAAa,YAAkC,OAC7C,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;;ACI3C,MAAa,qBAAqB,EAAE,OAAO;CACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;;ACLD,MAAa,YAAY,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;;ACFhD,MAAa,2BAA2B,EAAE,OAAO,EAC/C,WAAW,EAAE,OAAO;CAClB,IAAI,EAAE,OAAO;CACb,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;;ACVD,MAAa,kBAAkB,EAAE,OAAO;CACtC,SAAS,EAAE,QAAQ;CACnB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAM,EACH,OAAO;EACN,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;ACZD,MAAa,YAAY,EAAE,OAAO;CAChC,SAAS,EAAE,QAAQ;CACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;;ACAD,MAAM,gBAAgB,EAAE,OAAO;CAC7B,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,iBAAiB,EAAE,OAAO;CAC1B,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+B,EAAE,OAAO,EACnD,YAAY,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoB,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuB,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;;ACfD,MAAM,qBAAqB,EACxB,OAAO;CACN,WAAW,EAAE,QAAQ,aAAa;CAClC,aAAa,EAAE,OAAO;CACtB,oBAAoB,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAc,EACjB,OAAO;CACN,WAAW,EAAE,QAAQ,MAAM;CAC3B,WAAW,EAAE,OAAO;CACpB,UAAU,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgB,EAC1B,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;;AChCT,MAAa,oBAAoB,EAC9B,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;;ACVT,MAAa,wBAAwB,EAClC,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;ACZT,MAAM,gBAAgB,EAAE,OAAO;CAC7B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,gBAAgB,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAU,EAAE,OAAO;CACnB,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAc,EACxB,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;;AC/BT,MAAa,eAAe,EACzB,OAAO,EACN,YAAY,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;;;;;ACDT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2B,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACTA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,MAAM,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO;AAAE,CAAC,CAC5E;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAY,EAAE,OAAO;CACrB,UAAU,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;;ACDA,MAAMA,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACNA,kBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5EA,kBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;ACdA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CACP,WAAW,EAAE,OAAO;CACpB,QAAQ,EAAE,OAAO;CACjB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;;ACfA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,MAAM,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAU,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqB,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgB,EAAE,OAAO;CAC7B,OAAO,EAAE,OAAO;CAChB,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoB,EAAE,OAAO;CACjC,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO;CACnB,SAAS,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAM,EAAE,OAAO;EAAE,OAAO,EAAE,OAAO;EAAG,aAAa,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;;ACjED,MAAa,oBAAoB,EAAE,OAAO;CACxC,eAAe;CACf,YAAY,EAAE,OAAO;EACnB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;EAC9B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;;ACJD,MAAa,kBAAkB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO;EACjB,SAAS,EAAE,OAAO;EAGlB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAO,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQ,EAAE,OAAO;EACf,aAAa,EAAE,OAAO;EACtB,iBAAiB,EAAE,OAAO;EAC1B,MAAM,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAY,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAW,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;;ACGA,MAAM,aAAa,EAAE,OAAO;CAC1B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5B,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkB,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;;ACjBA,MAAa,mBAAmB,SAC9B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;CACnB,gBAAgB,EAAE,OAAO;CACzB,uBAAuB,EAAE,OAAO;CAChC,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgB,EAAE,OAAO;CACzB,kBAAkB,EAAE,OAAO;CAC3B,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAAS,EAAE,OAAO;CAClB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CACH;;;;ACNA,MAAa,kBAAkB,SAC7B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkB,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkB,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAO,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiB,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAI,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAI,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAI,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAI,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAI,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAI,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAI,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAI,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAI,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAI,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAI,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAI,YAAY,SAAS,YAAY,CAAC,CACtC,IAAI,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAI,YAAY,aAAa,WAAW,CAAC,CACzC,IAAI,YAAY,WAAW,aAAa,CAAC,CACzC,IAAI,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAI,YAAY,6BAA6B,qBAAqB;;;AClErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}
+{"version":3,"file":"configurations-VtNE0nrT.js","names":["snowflakeCommon"],"sources":["../src/utils/isEmptyDeep.ts","../src/utils/schemaGuidedMerge.ts","../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../src/sdks/configurations/schemas/common/dbConfig.ts","../src/sdks/configurations/schemas/common/dbConnection.ts","../src/sdks/configurations/schemas/common/forbidden.ts","../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../src/sdks/configurations/schemas/common/sslSchema.ts","../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../src/sdks/configurations/schemas/googleAdsSchema.ts","../src/sdks/configurations/schemas/schedulerSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../src/sdks/configurations/createRegistry/createRegistry.ts","../src/sdks/configurations/registry.ts","../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { isPlainObject } from './isPlainObject';\n\n/**\n * Is `value` \"deeply empty\" — i.e. carries no leaf data? `null`/`undefined`, `{}`, `[]`, and\n * nested structures whose every leaf is itself empty (e.g. `{ parameters: {} }`) are empty.\n * Any present primitive (string, number, boolean — including `''`) counts as content.\n *\n * Used to skip a pointless encryption round-trip when a validated configuration has nothing\n * to encrypt.\n */\nexport const isEmptyDeep = (value: unknown): boolean => {\n  if (value == null) return true;\n  if (Array.isArray(value)) return value.every(isEmptyDeep);\n  if (isPlainObject(value)) return Object.values(value).every(isEmptyDeep);\n  return false;\n};\n","import { z } from 'zod';\n\nimport { isPlainObject } from './isPlainObject';\n\n/** Strip optional/nullable/default wrappers to reach the structural schema node. */\nconst unwrap = (schema: z.core.$ZodType): z.core.$ZodType =>\n  schema instanceof z.ZodOptional ||\n  schema instanceof z.ZodNullable ||\n  schema instanceof z.ZodDefault\n    ? unwrap(schema.unwrap())\n    : schema;\n\n/**\n * Merge `patch` into `base`, guided by `schema`: descend only through object schemas, merging\n * key-by-key. At every non-object node — a `z.union` (e.g. Snowflake's password|keypair auth),\n * an array, or a primitive — the patch REPLACES the base wholesale. That replace is what lets an\n * update *delete* keys the additive `deepMerge` cannot: switching a credential union to the other\n * variant drops the abandoned variant's secret, because the entire union subtree is swapped.\n *\n * Consequence: a union (or array) subtree is all-or-nothing — the caller must send the complete\n * block, since a partial patch replaces (and so loses) the omitted siblings.\n *\n * Object keys present only in `base` (e.g. `storage`, `processors`, anything the schema omits) are\n * preserved at every level; `undefined` patch values are skipped. Assumes `patch` is already\n * schema-validated (so every object-valued patch key has a matching schema node). Pure — neither\n * argument is mutated.\n */\nexport const schemaGuidedMerge = <T extends Record<string, unknown>>(\n  schema: z.core.$ZodType,\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const node = unwrap(schema);\n  if (!(node instanceof z.ZodObject) || !isPlainObject(base)) return patch as T;\n\n  const out: Record<string, unknown> = { ...base };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const child = node.shape[key];\n    const current = out[key];\n    out[key] =\n      child && isPlainObject(current) && isPlainObject(value)\n        ? schemaGuidedMerge(child, current, value)\n        : value;\n  }\n\n  return out as T;\n};\n","import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials — host/port/user/#password/database + optional SSH tunnel, the\n * same `parameters.db` block the writers use. Tunnel support mirrors kbc-ui's `hasSshTunnel` /\n * `hasSsl` (`apps/kbc-ui/src/scripts/modules/ex-db-generic/helpers.ts`): most drivers accept an\n * SSH tunnel, only pgsql/mysql/mssql also accept SSL, and a handful accept neither. This shared\n * schema covers the generic SSH-only drivers: redshift, db2(-bata), mssql-cdata, impala,\n * hive(-csas, -csas-test). SSL-capable pgsql and the tunnel-less progress-db get their own\n * schema, as do drivers with extra/renamed fields.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { createDefaultBranch } from '../../domain/defaultBranch';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — schema-guided deep merge: object fields patch individually, while a\n *   credential union or array subtree is replaced wholesale (so switching auth variants deletes\n *   the abandoned secret). Untouched leaves and out-of-schema keys are preserved. Reads the\n *   current config first to merge onto.\n * - `'replace'` — store exactly what the caller sends (after validation + encryption); no read,\n *   no merge. Completeness is on the caller — any field or sibling key (e.g. `storage`) it omits\n *   is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,eAAe,UAA4B;CACtD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,MAAM,WAAW;CACxD,IAAI,cAAc,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,WAAW;CACvE,OAAO;AACT;;;;ACVA,MAAM,UAAU,WACd,kBAAkB,EAAE,eACpB,kBAAkB,EAAE,eACpB,kBAAkB,EAAE,aAChB,OAAO,OAAO,OAAO,CAAC,IACtB;;;;;;;;;;;;;;;;AAiBN,MAAa,qBACX,QACA,MACA,UACM;CACN,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,EAAE,gBAAgB,EAAE,cAAc,CAAC,cAAc,IAAI,GAAG,OAAO;CAEnE,MAAM,MAA+B,EAAE,GAAG,KAAK;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OACF,SAAS,cAAc,OAAO,KAAK,cAAc,KAAK,IAClD,kBAAkB,OAAO,SAAS,KAAK,IACvC;CACR;CAEA,OAAO;AACT;;;;;;;;ACxCA,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO,EACnB,IAAI,EAAE,OAAO,EACX,aAAa,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;;ACVD,MAAa,YAAkC,OAC7C,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;;ACI3C,MAAa,qBAAqB,EAAE,OAAO;CACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;;ACLD,MAAa,YAAY,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;;ACFhD,MAAa,2BAA2B,EAAE,OAAO,EAC/C,WAAW,EAAE,OAAO;CAClB,IAAI,EAAE,OAAO;CACb,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;;ACVD,MAAa,kBAAkB,EAAE,OAAO;CACtC,SAAS,EAAE,QAAQ;CACnB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAM,EACH,OAAO;EACN,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;ACZD,MAAa,YAAY,EAAE,OAAO;CAChC,SAAS,EAAE,QAAQ;CACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;;ACAD,MAAM,gBAAgB,EAAE,OAAO;CAC7B,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,iBAAiB,EAAE,OAAO;CAC1B,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+B,EAAE,OAAO,EACnD,YAAY,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoB,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuB,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;;ACfD,MAAM,qBAAqB,EACxB,OAAO;CACN,WAAW,EAAE,QAAQ,aAAa;CAClC,aAAa,EAAE,OAAO;CACtB,oBAAoB,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAc,EACjB,OAAO;CACN,WAAW,EAAE,QAAQ,MAAM;CAC3B,WAAW,EAAE,OAAO;CACpB,UAAU,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgB,EAC1B,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;;AChCT,MAAa,oBAAoB,EAC9B,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;;ACVT,MAAa,wBAAwB,EAClC,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;ACZT,MAAM,gBAAgB,EAAE,OAAO;CAC7B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,gBAAgB,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAU,EAAE,OAAO;CACnB,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAc,EACxB,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;;AC/BT,MAAa,eAAe,EACzB,OAAO,EACN,YAAY,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;;;;;ACDT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2B,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACTA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,MAAM,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO;AAAE,CAAC,CAC5E;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAY,EAAE,OAAO;CACrB,UAAU,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;;ACDA,MAAMA,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACNA,kBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5EA,kBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;ACdA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CACP,WAAW,EAAE,OAAO;CACpB,QAAQ,EAAE,OAAO;CACjB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;;ACfA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,MAAM,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAU,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqB,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgB,EAAE,OAAO;CAC7B,OAAO,EAAE,OAAO;CAChB,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoB,EAAE,OAAO;CACjC,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO;CACnB,SAAS,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAM,EAAE,OAAO;EAAE,OAAO,EAAE,OAAO;EAAG,aAAa,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;;ACjED,MAAa,oBAAoB,EAAE,OAAO;CACxC,eAAe;CACf,YAAY,EAAE,OAAO;EACnB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;EAC9B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;;ACJD,MAAa,kBAAkB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO;EACjB,SAAS,EAAE,OAAO;EAGlB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAO,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQ,EAAE,OAAO;EACf,aAAa,EAAE,OAAO;EACtB,iBAAiB,EAAE,OAAO;EAC1B,MAAM,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAY,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAW,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;;ACGA,MAAM,aAAa,EAAE,OAAO;CAC1B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5B,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkB,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;;ACjBA,MAAa,mBAAmB,SAC9B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;CACnB,gBAAgB,EAAE,OAAO;CACzB,uBAAuB,EAAE,OAAO;CAChC,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgB,EAAE,OAAO;CACzB,kBAAkB,EAAE,OAAO;CAC3B,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAAS,EAAE,OAAO;CAClB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CACH;;;;ACNA,MAAa,kBAAkB,SAC7B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkB,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkB,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAO,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiB,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAI,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAI,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAI,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAI,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAI,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAI,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAI,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAI,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAI,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAI,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAI,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAI,YAAY,SAAS,YAAY,CAAC,CACtC,IAAI,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAI,YAAY,aAAa,WAAW,CAAC,CACzC,IAAI,YAAY,WAAW,aAAa,CAAC,CACzC,IAAI,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAI,YAAY,6BAA6B,qBAAqB;;;AClErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}

package/dist/{configurations-Ck-mNB_E.cjs → configurations-zkNjr73Q.cjs}

@@ -1,5 +1,5 @@
 const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_configurations = require("./configurations-CqwAxiQL.cjs");
+const require_configurations = require("./configurations-CyFF9Dtu.cjs");
 const require_componentId = require("./componentId-DkyQ8PM0.cjs");
 let zod = require("zod");
 //#region src/utils/isEmptyDeep.ts
@@ -740,4 +740,4 @@ Object.defineProperty(exports, "schemaGuidedMerge", {
 	}
 });
 
-//# sourceMappingURL=configurations-Ck-mNB_E.cjs.map
+//# sourceMappingURL=configurations-zkNjr73Q.cjs.map