@keboola/api-client 36.0.0 → 40.0.0

package/surface/storage.md

@@ -150,16 +150,16 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 
 ### `api.storage.mergeRequests`
 
-- `api.storage.mergeRequests.approveMergeRequest(id: number): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "canceled" | "development" | "in_review" | "approved" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; } & { changeLog?: Record<string, never> | undefined; }>`
-- `api.storage.mergeRequests.createMergeRequest(body: CreateMergeRequestBody): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "canceled" | "development" | "in_review" | "approved" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; }>`
+- `api.storage.mergeRequests.approveMergeRequest(id: number): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "approved" | "canceled" | "development" | "in_review" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; } & { changeLog?: Record<string, never> | undefined; }>`
+- `api.storage.mergeRequests.createMergeRequest(body: CreateMergeRequestBody): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "approved" | "canceled" | "development" | "in_review" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; }>`
 - `api.storage.mergeRequests.getMergeRequest(id: number, signal?: AbortSignal | undefined): Promise<MergeRequestDetail>`
 - `api.storage.mergeRequests.getMergeRequestConflicts(id: number, signal?: AbortSignal | undefined): Promise<{ message: string; componentId: string; configurationId: string; isDeleted: boolean; devBranchVersionIdentifier: string; defaultBranchVersionIdentifier: string; }[]>`
 - `api.storage.mergeRequests.getMergeRequestWithActivityLog(id: number, signal?: AbortSignal | undefined): Promise<MergeRequestDetailWithActivityLog>`
-- `api.storage.mergeRequests.getMergeRequests(signal?: AbortSignal | undefined): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "canceled" | "development" | "in_review" | "approved" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; }[]>`
+- `api.storage.mergeRequests.getMergeRequests(signal?: AbortSignal | undefined): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "approved" | "canceled" | "development" | "in_review" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; }[]>`
 - `api.storage.mergeRequests.mergeMergeRequest(id: number): Promise<{ id: string; status: string; url: string; tableId: string; operationName: string; operationParams: Record<string, never>; createdTime: string; startTime?: string | null | undefined; endTime?: string | null | undefined; runId: string; results?: Record<string, never> | { uri: string; id: string; name: string; displayName: string; transactional: boolean; primaryKey: string[]; indexType: string | null; indexKey: string[]; distributionType: string | null; distributionKey: string[]; syntheticPrimaryKeyEnabled: boolean; created: string | null; lastImportDate: string | null; lastChangeDate: string | null; rowsCount: number | null; dataSizeBytes: number | null; isAlias: boolean; isAliasable: boolean; isTyped: boolean; tableType: string; path: string; columns: string[]; sourceTable?: { id: string; uri: string; project: { id: number; name: string; }; isAlias: boolean; } | null | undefined; aliasColumnsAutoSync?: boolean | null | undefined; aliasFilter?: Record<string, never> | null | undefined; selectSql?: string | null | undefined; } | { bucketId: string; exposureName: string; exposureDescription?: string | null | undefined; bigquery: { listingId?: string | undefined; subscribers?: string[] | undefined; }; } | { idBucket: number; listingId: string; listingResourceName: string; providerResourceName: string; } | { id: number; status: string; url: string; tableId?: string | null | undefined; operationName: string; operationParams: { [key: string]: Record<string, never>; }; createdTime: string; startTime?: string | null | undefined; endTime?: string | null | undefined; runId?: string | null | undefined; results?: Record<string, never> | null | undefined; creatorToken: { id?: number | undefined; description?: string | null | undefined; }; metrics: { [key: string]: Record<string, never>; }; error?: { code?: string | null | undefined; message?: string | null | undefined; exceptionId?: string | null | undefined; } | null | undefined; } | { id: number; status: string; url: string; tableId?: string | null | undefined; operationName: string; operationParams: { [key: string]: Record<string, never>; }; createdTime: string; startTime?: string | null | undefined; endTime?: string | null | undefined; runId?: string | null | undefined; results?: Record<string, never> | null | undefined; creatorToken: { id?: number | undefined; description?: string | null | undefined; }; metrics: { [key: string]: Record<string, never>; }; error?: { code?: string | null | undefined; message?: string | null | undefined; exceptionId?: string | null | undefined; } | null | undefined; } | { uri: string; id: string; name: string; displayName: string; idBranch: number; stage: string; description: string; tables: string; created: string; lastChangeDate?: string | null | undefined; updated?: string | null | undefined; isReadOnly: boolean; dataSizeBytes: number; rowsCount: number; isMaintenance: boolean; backend: string; sharing?: string | null | undefined; hasExternalSchema: boolean; databaseName?: string | null | undefined; path: string; isSnowflakeSharedDatabase: boolean; color?: string | null | undefined; sharingParameters?: Record<string, never> | null | undefined; sharedBy?: { id?: number | null | undefined; name?: string | null | undefined; date?: string | null | undefined; } | null | undefined; owner?: Record<string, never> | null | undefined; sourceBucket?: Record<string, never> | null | undefined; warnings: { message?: string | undefined; context?: string | null | undefined; }[]; } | { id: string; description?: string | null | undefined; createdTime: string; type: string; creatorToken: { id?: number | undefined; description?: string | undefined; }; uri: string; dataFileId: number; } | { file: { id?: number | undefined; }; cacheHit: boolean; } | { tableAStringId: string; tableBStringId: string; } | { file?: { id?: number | null | undefined; } | null | undefined; } | null | undefined; creatorToken: { id?: string | undefined; description?: string | undefined; }; metrics: { inCompressed?: boolean | undefined; inBytes?: number | undefined; inBytesUncompressed?: number | undefined; outCompressed?: boolean | undefined; outBytes?: number | undefined; outBytesUncompressed?: number | undefined; }; error?: { code?: string | undefined; message?: string | undefined; exceptionId?: string | undefined; contextParams?: Record<string, never> | null | undefined; uuid?: string | null | undefined; } | null | undefined; }>`
-- `api.storage.mergeRequests.requestChangesMergeRequest(id: number, reason?: string | undefined): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "canceled" | "development" | "in_review" | "approved" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; } & { changeLog?: Record<string, never> | undefined; }>`
-- `api.storage.mergeRequests.requestReview(id: number): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "canceled" | "development" | "in_review" | "approved" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; } & { changeLog?: Record<string, never> | undefined; }>`
-- `api.storage.mergeRequests.updateMergeRequest({ id, ...body }: UpdateMergeRequestInput): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "canceled" | "development" | "in_review" | "approved" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; }>`
+- `api.storage.mergeRequests.requestChangesMergeRequest(id: number, reason?: string | undefined): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "approved" | "canceled" | "development" | "in_review" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; } & { changeLog?: Record<string, never> | undefined; }>`
+- `api.storage.mergeRequests.requestReview(id: number): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "approved" | "canceled" | "development" | "in_review" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; } & { changeLog?: Record<string, never> | undefined; }>`
+- `api.storage.mergeRequests.updateMergeRequest({ id, ...body }: UpdateMergeRequestInput): Promise<{ id: number; creator: { id?: number | undefined; name?: string | undefined; }; title: string; description: string; state: "approved" | "canceled" | "development" | "in_review" | "in_merge" | "published"; branches: { branchFromId?: number | null | undefined; branchIntoId?: number | null | undefined; }; merge: { mergedAt?: string | null | undefined; mergerId?: number | null | undefined; mergerName?: string | undefined; }; createdAt: string; externalId: string; autoMergeStrategy: "immediately" | "scheduled" | "none"; autoMergeAt?: string | null | undefined; approvals: { approverId?: string | undefined; approverName?: string | undefined; createdAt?: string | undefined; }[]; reviewers: { id?: number | undefined; name?: string | undefined; email?: string | undefined; status?: "approved" | "rejected" | null | undefined; }[]; }>`
 
 ### `api.storage.search`
 

package/surface/syncActions.md

@@ -18,6 +18,11 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.syncActions.dbt.compile(input: { branchId: string; componentId: string; configId: string; tag?: string | undefined; mode?: "run" | "debug" | undefined; artifacts?: Record<string, unknown> | undefined; }, signal?: AbortSignal | undefined): Promise<Record<string, string>>`
 - `api.syncActions.dbt.runResults(input: { branchId: string; componentId: string; configId: string; tag?: string | undefined; mode?: "run" | "debug" | undefined; artifacts?: Record<string, unknown> | undefined; }, signal?: AbortSignal | undefined): Promise<{ id: string; name: string; thread: number; timeStarted: string; timeCompleted: string; }[]>`
 
+### `api.syncActions.flowMigration`
+
+- `api.syncActions.flowMigration.preview(input: { branchId: string; orchestrationIds: string[]; tag?: string | undefined; mode?: "run" | "debug" | undefined; }, signal?: AbortSignal | undefined): Promise<{ orchestrationId: string; orchestrationName: string; status: "failed" | "dry-run" | "skipped"; issues: string[]; changes: string[]; error?: string | undefined; migratedConfiguration?: { [x: string]: unknown; phases?: unknown[] | undefined; tasks?: unknown[] | undefined; parameters?: unknown; } | undefined; }[]>`
+- `api.syncActions.flowMigration.validate(input: { branchId: string; orchestrationIds: string[]; tag?: string | undefined; mode?: "run" | "debug" | undefined; }, signal?: AbortSignal | undefined): Promise<{ orchestrationId: string; orchestrationName: string; valid: boolean; issues: string[]; }[]>`
+
 ### `api.syncActions.git`
 
 - `api.syncActions.git.getBranches(input: { branchId: string; repositoryUrl: string; componentId: "keboola.data-apps" | "keboola.sandboxes" | "keboola-test.dbt-core-key-pair" | "keboola-test.dbt-remote-snowflake" | "keboola.dbt-transformation" | "keboola.dbt-transformation-local-bigquery" | "keboola.dbt-transformation-remote-bigquery" | "keboola.dbt-transformation-remote-mssql" | "keboola.dbt-transformation-remote-postgresql" | "keboola.dbt-transformation-remote-redshift" | "keboola.dbt-transformation-remote-snowflake"; tag?: string | undefined; mode?: "run" | "debug" | undefined; auth?: { type: "public"; } | { type: "password"; username: string; '#password': string; } | { type: "sshKey"; '#sshKey': string; username?: string | undefined; } | undefined; }, signal?: AbortSignal | undefined): Promise<{ branch: string; sha: string; date: string; comment: string; author: { name: string; email: string; }; }[]>`
@@ -26,3 +31,7 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 ### `api.syncActions.looker`
 
 - `api.syncActions.looker.testCredentials(input: { branchId: string; credentialsId: string; '#token': string; host: string; tag?: string | undefined; mode?: "run" | "debug" | undefined; }, signal?: AbortSignal | undefined): Promise<{ status?: string | undefined; message?: string | undefined; }>`
+
+### `api.syncActions.sshKeys`
+
+- `api.syncActions.sshKeys.generate(input: { branchId: string; tag?: string | undefined; mode?: "run" | "debug" | undefined; }, signal?: AbortSignal | undefined): Promise<{ status: "success"; public: string; private: string; }>`

package/dist/ValidationError-BekhphAq.js

@@ -1,48 +0,0 @@
-//#region src/errors/ValidationError.ts
-/**
-* A payload the SDK refused to accept — an input a caller assembled wrongly, or a response that did
-* not match the shape the endpoint is documented to return.
-*
-* It exists so a `ZodError` never leaves the package. `ZodError.message` is `JSON.stringify` of its
-* issue list — over a kilobyte for two problems — and a consumer that renders a caught error's
-* message puts that blob in front of a user. `message` here is a single line built for exactly that
-* rendering, while `issues` keeps the structured detail for anyone inspecting the failure rather
-* than displaying it.
-*/
-var ValidationError = class ValidationError extends Error {
-	issues;
-	constructor(message, issues = []) {
-		super(message);
-		this.name = "ValidationError";
-		this.issues = issues;
-		Object.setPrototypeOf(this, ValidationError.prototype);
-	}
-};
-const isValidationError = (error) => error instanceof ValidationError;
-/**
-* One line per issue, prefixed by the field it belongs to.
-*
-* - Not `z.prettifyError`, which formats for a terminal — its `✖`/`→` glyphs and newlines survive a
-*   log but collapse into one run-on line in HTML, where most of these end up.
-* - Exported for the boundaries that degrade instead of throwing: a read that drops one malformed
-*   element still owes a reason, and it needs the same one line without a `ValidationError`.
-* - Says which field and what is wrong with it, never the value — so it is safe to log.
-*/
-const formatValidationIssues = (issues) => issues.map((issue) => {
-	const path = issue.path.join(".");
-	return path ? `${path}: ${issue.message}` : issue.message;
-}).join("; ");
-/**
-* Parses with `schema`, converting a `ZodError` into a {@link ValidationError}. Use it instead of a
-* bare `schema.parse()` anywhere the value crosses the package boundary — every client input and
-* every response body.
-*/
-const parseOrThrow = (schema, value) => {
-	const result = schema.safeParse(value);
-	if (result.success) return result.data;
-	throw new ValidationError(formatValidationIssues(result.error.issues), result.error.issues);
-};
-//#endregion
-export { parseOrThrow as i, formatValidationIssues as n, isValidationError as r, ValidationError as t };
-
-//# sourceMappingURL=ValidationError-BekhphAq.js.map

package/dist/ValidationError-BekhphAq.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ValidationError-BekhphAq.js","names":[],"sources":["../src/errors/ValidationError.ts"],"sourcesContent":["import type * as z from 'zod';\n\n/**\n * A payload the SDK refused to accept — an input a caller assembled wrongly, or a response that did\n * not match the shape the endpoint is documented to return.\n *\n * It exists so a `ZodError` never leaves the package. `ZodError.message` is `JSON.stringify` of its\n * issue list — over a kilobyte for two problems — and a consumer that renders a caught error's\n * message puts that blob in front of a user. `message` here is a single line built for exactly that\n * rendering, while `issues` keeps the structured detail for anyone inspecting the failure rather\n * than displaying it.\n */\nexport class ValidationError extends Error {\n  issues: z.core.$ZodIssue[];\n\n  constructor(message: string, issues: z.core.$ZodIssue[] = []) {\n    super(message);\n    this.name = 'ValidationError';\n    this.issues = issues;\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport const isValidationError = (error: unknown): error is ValidationError =>\n  error instanceof ValidationError;\n\n/**\n * One line per issue, prefixed by the field it belongs to.\n *\n * - Not `z.prettifyError`, which formats for a terminal — its `✖`/`→` glyphs and newlines survive a\n *   log but collapse into one run-on line in HTML, where most of these end up.\n * - Exported for the boundaries that degrade instead of throwing: a read that drops one malformed\n *   element still owes a reason, and it needs the same one line without a `ValidationError`.\n * - Says which field and what is wrong with it, never the value — so it is safe to log.\n */\nexport const formatValidationIssues = (issues: readonly z.core.$ZodIssue[]) =>\n  issues\n    .map((issue) => {\n      const path = issue.path.join('.');\n\n      // A root-level issue is about the payload as a whole, and its message already says so —\n      // prefixing it with a name for \"the whole thing\" only adds noise.\n      return path ? `${path}: ${issue.message}` : issue.message;\n    })\n    .join('; ');\n\n/**\n * Parses with `schema`, converting a `ZodError` into a {@link ValidationError}. Use it instead of a\n * bare `schema.parse()` anywhere the value crosses the package boundary — every client input and\n * every response body.\n */\nexport const parseOrThrow = <T extends z.ZodType>(schema: T, value: unknown): z.output<T> => {\n  const result = schema.safeParse(value);\n\n  if (result.success) return result.data;\n\n  throw new ValidationError(formatValidationIssues(result.error.issues), result.error.issues);\n};\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,kBAAb,MAAa,wBAAwB,MAAM;CACzC;CAEA,YAAY,SAAiB,SAA6B,CAAC,GAAG;EAC5D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,OAAO,eAAe,MAAM,gBAAgB,SAAS;CACvD;AACF;AAEA,MAAa,qBAAqB,UAChC,iBAAiB;;;;;;;;;;AAWnB,MAAa,0BAA0B,WACrC,OACG,KAAK,UAAU;CACd,MAAM,OAAO,MAAM,KAAK,KAAK,GAAG;CAIhC,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,YAAY,MAAM;AACpD,CAAC,CAAC,CACD,KAAK,IAAI;;;;;;AAOd,MAAa,gBAAqC,QAAW,UAAgC;CAC3F,MAAM,SAAS,OAAO,UAAU,KAAK;CAErC,IAAI,OAAO,SAAS,OAAO,OAAO;CAElC,MAAM,IAAI,gBAAgB,uBAAuB,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,MAAM;AAC5F"}

package/dist/ValidationError-CLVJCCwH.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ValidationError-CLVJCCwH.cjs","names":[],"sources":["../src/errors/ValidationError.ts"],"sourcesContent":["import type * as z from 'zod';\n\n/**\n * A payload the SDK refused to accept — an input a caller assembled wrongly, or a response that did\n * not match the shape the endpoint is documented to return.\n *\n * It exists so a `ZodError` never leaves the package. `ZodError.message` is `JSON.stringify` of its\n * issue list — over a kilobyte for two problems — and a consumer that renders a caught error's\n * message puts that blob in front of a user. `message` here is a single line built for exactly that\n * rendering, while `issues` keeps the structured detail for anyone inspecting the failure rather\n * than displaying it.\n */\nexport class ValidationError extends Error {\n  issues: z.core.$ZodIssue[];\n\n  constructor(message: string, issues: z.core.$ZodIssue[] = []) {\n    super(message);\n    this.name = 'ValidationError';\n    this.issues = issues;\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport const isValidationError = (error: unknown): error is ValidationError =>\n  error instanceof ValidationError;\n\n/**\n * One line per issue, prefixed by the field it belongs to.\n *\n * - Not `z.prettifyError`, which formats for a terminal — its `✖`/`→` glyphs and newlines survive a\n *   log but collapse into one run-on line in HTML, where most of these end up.\n * - Exported for the boundaries that degrade instead of throwing: a read that drops one malformed\n *   element still owes a reason, and it needs the same one line without a `ValidationError`.\n * - Says which field and what is wrong with it, never the value — so it is safe to log.\n */\nexport const formatValidationIssues = (issues: readonly z.core.$ZodIssue[]) =>\n  issues\n    .map((issue) => {\n      const path = issue.path.join('.');\n\n      // A root-level issue is about the payload as a whole, and its message already says so —\n      // prefixing it with a name for \"the whole thing\" only adds noise.\n      return path ? `${path}: ${issue.message}` : issue.message;\n    })\n    .join('; ');\n\n/**\n * Parses with `schema`, converting a `ZodError` into a {@link ValidationError}. Use it instead of a\n * bare `schema.parse()` anywhere the value crosses the package boundary — every client input and\n * every response body.\n */\nexport const parseOrThrow = <T extends z.ZodType>(schema: T, value: unknown): z.output<T> => {\n  const result = schema.safeParse(value);\n\n  if (result.success) return result.data;\n\n  throw new ValidationError(formatValidationIssues(result.error.issues), result.error.issues);\n};\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,kBAAb,MAAa,wBAAwB,MAAM;CACzC;CAEA,YAAY,SAAiB,SAA6B,CAAC,GAAG;EAC5D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,OAAO,eAAe,MAAM,gBAAgB,SAAS;CACvD;AACF;AAEA,MAAa,qBAAqB,UAChC,iBAAiB;;;;;;;;;;AAWnB,MAAa,0BAA0B,WACrC,OACG,KAAK,UAAU;CACd,MAAM,OAAO,MAAM,KAAK,KAAK,GAAG;CAIhC,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,YAAY,MAAM;AACpD,CAAC,CAAC,CACD,KAAK,IAAI;;;;;;AAOd,MAAa,gBAAqC,QAAW,UAAgC;CAC3F,MAAM,SAAS,OAAO,UAAU,KAAK;CAErC,IAAI,OAAO,SAAS,OAAO,OAAO;CAElC,MAAM,IAAI,gBAAgB,uBAAuB,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,MAAM;AAC5F"}

package/dist/authClient-D7W9vWPR.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authClient-D7W9vWPR.js","names":["z","z","z"],"sources":["../src/clients/auth/device/device.ts","../src/clients/auth/login/schemas.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/webauthn/webauthn.ts","../src/clients/auth/authClient.ts"],"sourcesContent":["import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n/**\n * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\n *\n * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy\n *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch\n *   and handle the unknown case themselves.\n * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey\n *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it\n *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate\n *   present, `null` and absent alike.\n * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody\n *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely\n *   out of the passkey path. Whoever runs the ceremony validates it properly instead.\n */\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n  // `.optional()` explicitly: zod 4 dropped zod 3's implicit optionality for `z.unknown()`, so\n  // without it a TOTP challenge — which omits the key — fails to parse and blocks sign-in.\n  webauthn: z.unknown().optional(),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type MfaChallenge = z.infer<typeof mfaChallengeSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  // Unauthenticated. Carries the public OAuth client ids `withOidc` callers mint an id token with.\n  const methods = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/methods', {}, { signal });\n    return data;\n  };\n\n  return { withPassword, withOidc, methods };\n};\n","import * as z from 'zod';\n\nimport type { components } from '../__generated__/schema';\n\n/**\n * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in\n * `mfaType` / `allowedMethods`.\n *\n * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.\n * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or\n *   drops a method fails the build here rather than at runtime mid-sign-in.\n * - A challenge may still name a method absent from here, so the wire fields stay `string`.\n */\nexport const MFA_METHOD = {\n  totp: 'totp',\n  webauthn: 'webauthn',\n  recoveryCode: 'recovery_code',\n} as const satisfies Record<string, components['schemas']['MfaRequest']['type']>;\n\nexport type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum([MFA_METHOD.totp, MFA_METHOD.recoveryCode]),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport const totpVerifyInputSchema = z.object({\n  code: z.string().min(1, 'Required'),\n  // Optional in the spec, but `openapi-typescript` emits every `default`-bearing property as\n  // required — the schema fills in the backend's own default so callers may still omit it. Set true\n  // to sign the admin out everywhere else as part of enrolling.\n  revokeOtherSessions: z.boolean().default(false),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type TotpVerifyInput = z.input<typeof totpVerifyInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput, TotpVerifyInput } from './schemas';\nimport {\n  MFA_METHOD,\n  mfaCodeInputSchema,\n  mfaWebauthnInputSchema,\n  totpVerifyInputSchema,\n} from './schemas';\nimport type { DisableTotpPath, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: MFA_METHOD.webauthn, assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyInput, signal?: AbortSignal) => {\n      const body = totpVerifyInputSchema.parse(input);\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  CreatePatBodyRaw,\n  CreatePatInput,\n  ExchangePatBodyRaw,\n  ExchangePatInput,\n  PatScopeInput,\n  RevokePatPath,\n} from './types';\n\n/**\n * Drop the keys whose value is `null` or `undefined`, and only those — an empty array or string is\n * a value the caller meant.\n *\n * The spec documents each optional PAT field as \"Omit (do not send `null`)\". Callers hold nullables\n * either way — an empty expiry picker, an untouched switch — so the rule lives here rather than at\n * every call site, where one of them would forget it.\n */\nconst withoutNullish = (entries: Record<string, unknown>): Record<string, unknown> =>\n  Object.fromEntries(Object.entries(entries).filter(([, value]) => value != null));\n\n/** `undefined` for a scope that narrows nothing — which is what an absent `scope` already asks for. */\nconst toScope = (scope: PatScopeInput | null | undefined): Record<string, unknown> | undefined => {\n  if (scope == null) return undefined;\n\n  const payload = withoutNullish({ projects: scope.projects, readOnly: scope.readOnly });\n  return Object.keys(payload).length > 0 ? payload : undefined;\n};\n\n// `as unknown as` at these two boundaries: `CreatePatBodyRaw` and `ExchangePatBodyRaw` both demand\n// the keys the endpoint documents as omittable, so the honest body is not expressible in either.\nconst toCreateBody = ({ name, expiresIn, scope }: CreatePatInput): CreatePatBodyRaw =>\n  ({\n    name,\n    ...withoutNullish({ expiresIn, scope: toScope(scope) }),\n  }) as unknown as CreatePatBodyRaw;\n\nconst toExchangeBody = ({ expiresIn, scope }: ExchangePatInput): ExchangePatBodyRaw =>\n  withoutNullish({ expiresIn, scope: toScope(scope) }) as unknown as ExchangePatBodyRaw;\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (input: CreatePatInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body: toCreateBody(input) }, { signal });\n    return data;\n  };\n\n  /**\n   * Issue a child token from the one this request is authorized with.\n   *\n   * A child only ever attenuates its parent, so an empty input is a full-inheritance copy.\n   */\n  const exchange = async (input: ExchangePatInput = {}, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/pat/exchange',\n      { body: toExchangeBody(input) },\n      { signal },\n    );\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody, SudoBodyRaw } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    // The generated request body (`SudoBodyRaw`) describes a payload the endpoint rejects — see the\n    // `SudoBody` docs. Assert at this one boundary rather than making every caller send the invalid\n    // shape; the real fix is the `#[OA\\Schema]`-vs-object mismatch on the backend, upstream of the\n    // generated schema. Same pattern as `syncActionsClient`'s `PostActionsBodyRaw`.\n    const { data } = await client.post(\n      '/v1/auth/sudo',\n      { body: body as unknown as SudoBodyRaw },\n      { signal },\n    );\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  RegisterWebauthnInput,\n  RegisterWebauthnOptionsResult,\n  RemoveWebauthnInput,\n} from './types';\n\nexport const createWebauthn = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/webauthn', {}, { signal });\n    return data;\n  };\n\n  const registerOptions = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/webauthn/register/options', {}, { signal });\n    // Cast: the spec types the free-form `options` object as `Record<string, never>`.\n    return data as RegisterWebauthnOptionsResult;\n  };\n\n  const register = async (\n    { credential, deviceName = null, revokeOtherSessions = false }: RegisterWebauthnInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/v1/auth/webauthn/register',\n      { body: { credential, deviceName, revokeOtherSessions } },\n      { signal },\n    );\n    return data;\n  };\n\n  // `revokeOtherSessions` signs every other session out along with the credential — the calling\n  // session and personal access tokens survive. Omitted means the backend's own `false`.\n  const remove = async ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => {\n    await client.delete('/v1/auth/webauthn/{id}', { path: { id }, query }, { signal });\n  };\n\n  return { getAll, registerOptions, register, remove };\n};\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\nimport { validateConnectionStatus } from '../validateConnectionStatus';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\nimport { createWebauthn } from './webauthn';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n  const genericClient = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n\n  // Host-level: Connection serves the storage, management and auth APIs off one baseUrl, so this\n  // probes the host, not this API's prefix — `/v2/storage/health-check`, `/manage/health-check`\n  // and `/v1/auth/health-check` all 404.\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n    webauthn: createWebauthn(client),\n  };\n};\n"],"mappings":";;;;;;AAQA,MAAa,gBAAgB,WAAmC;CAC9D,MAAM,SAAS,OAAO,MAAqC,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,mBAAmB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC1E,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,MAAsC,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAuC,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAS;CAAS;AACrC;;;ACvBA,MAAa,mBAAmBA,IAAE,OAAO;CACvC,OAAOA,IAAE,MAAM;CACf,UAAUA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACxC,CAAC;AAED,MAAa,kBAAkBA,IAAE,OAAO;CACtC,WAAWA,IAAE,KAAK,CAAC,UAAU,WAAW,CAAC;CACzC,SAASA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACvC,CAAC;AAKD,MAAM,aAAaA,IAAE,OAAO;CAC1B,IAAIA,IAAE,OAAO;CACb,OAAOA,IAAE,OAAO;CAChB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAID,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK;CAC3C,aAAaA,IAAE,OAAO;CACtB,cAAcA,IAAE,OAAO;CACvB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,MAAM;AACR,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,IAAI;CAC3B,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,MAAMA,IAAE,OAAO,CAAC;CAGlC,UAAUA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACjC,CAAC;AAED,MAAa,oBAAoBA,IAAE,MAAM,CAAC,oBAAoB,kBAAkB,CAAC;;;ACpDjF,MAAa,eAAe,WAAmC;CAC7D,MAAM,SAAS,OAAO,MAAiB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,OAAmB,WAAyB;EACtE,MAAM,EAAE,OAAO,aAAa,iBAAiB,MAAM,KAAK;EAExD,MAAM,OAAO,MAAM,OAAO;GAAE,WAAW;GAAY;GAAO;EAAS,GAAgB,MAAM;EAGzF,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAEA,MAAM,WAAW,OAAO,OAAkB,WAAyB;EACjE,MAAM,EAAE,WAAW,YAAY,gBAAgB,MAAM,KAAK;EAE1D,MAAM,OAAO,MAAM,OAAO;GAAE;GAAW;EAAQ,GAAgB,MAAM;EACrE,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAGA,MAAM,UAAU,OAAO,WAAyB;EAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;EACpE,OAAO;CACT;CAEA,OAAO;EAAE;EAAc;EAAU;CAAQ;AAC3C;;;;;;;;;;;;ACtBA,MAAa,aAAa;CACxB,MAAM;CACN,UAAU;CACV,cAAc;AAChB;AAIA,MAAa,qBAAqBC,IAAE,OAAO;CACzC,UAAUA,IAAE,OAAO;CACnB,MAAMA,IAAE,KAAK,CAAC,WAAW,MAAM,WAAW,YAAY,CAAC;CACvD,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACpC,CAAC;AAED,MAAa,yBAAyBA,IAAE,OAAO;CAC7C,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAED,MAAa,wBAAwBA,IAAE,OAAO;CAC5C,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIlC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;AAChD,CAAC;;;AC3BD,MAAa,aAAa,WAAmC;CAC3D,MAAM,UAAU,OAAO,MAAqB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAO,OAAqB,WAAyB;EAC1E,MAAM,EAAE,UAAU,MAAM,SAAS,mBAAmB,MAAM,KAAK;EAE/D,OAAO,QAAQ;GAAE;GAAU;GAAM;EAAK,GAAoB,MAAM;CAClE;CAEA,MAAM,qBAAqB,OAAO,OAAyB,WAAyB;EAClF,MAAM,EAAE,UAAU,cAAc,uBAAuB,MAAM,KAAK;EAElE,OAAO,QAAQ;GAAE;GAAU,MAAM,WAAW;GAAU;EAAU,GAAoB,MAAM;CAC5F;CAEA,MAAM,0BAA0B,OAAO,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAoBA,OAAO;EAAE;EAAgB;EAAoB;EAAyB,MAAA;GAdpE,OAAO,OAAO,WAAyB;IACrC,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACtE,OAAO;GACT;GACA,QAAQ,OAAO,OAAwB,WAAyB;IAC9D,MAAM,OAAO,sBAAsB,MAAM,KAAK;IAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;IACnF,OAAO;GACT;GACA,SAAS,OAAO,IAA2B,WAAyB;IAClE,MAAM,OAAO,OAAO,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;GAC5E;EAGuE;CAAE;AAC7E;;;ACnDA,MAAa,0BAA0BC,IAAE,OAAO,EAC9C,OAAOA,IAAE,MAAM,EACjB,CAAC;AAED,MAAa,mBAAmBA,IAAE,OAAO;CAEvC,OAAOA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CACnC,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAGzC,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC1C,CAAC;AAED,MAAa,oBAAoBA,IAAE,OAAO;CACxC,iBAAiBA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAC7C,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIzC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC/C,CAAC;;;ACjBD,MAAa,kBAAkB,WAAmC;CAGhE,MAAM,eAAe,OAAO,OAA0B,WAAyB;EAC7E,MAAM,OAAO,wBAAwB,MAAM,KAAK;EAChD,MAAM,OAAO,KAAK,mCAAmC,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC3E;CAIA,MAAM,QAAQ,OAAO,OAAmB,WAAyB;EAG/D,MAAM,OAAO,iBAAiB,MAAM,KAAK;EACzC,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACnE;CAKA,MAAM,SAAS,OAAO,OAA4B,WAAyB;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACpE;CAEA,OAAO;EAAE;EAAc;EAAO;CAAO;AACvC;;;;;;;;;;;ACZA,MAAM,kBAAkB,YACtB,OAAO,YAAY,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,SAAS,IAAI,CAAC;;AAGjF,MAAM,WAAW,UAAiF;CAChG,IAAI,SAAS,MAAM,OAAO,KAAA;CAE1B,MAAM,UAAU,eAAe;EAAE,UAAU,MAAM;EAAU,UAAU,MAAM;CAAS,CAAC;CACrF,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,UAAU,KAAA;AACrD;AAIA,MAAM,gBAAgB,EAAE,MAAM,WAAW,aACtC;CACC;CACA,GAAG,eAAe;EAAE;EAAW,OAAO,QAAQ,KAAK;CAAE,CAAC;AACxD;AAEF,MAAM,kBAAkB,EAAE,WAAW,YACnC,eAAe;CAAE;CAAW,OAAO,QAAQ,KAAK;AAAE,CAAC;AAErD,MAAa,aAAa,WAAmC;CAC3D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAuB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;EAC5F,OAAO;CACT;;;;;;CAOA,MAAM,WAAW,OAAO,QAA0B,CAAC,GAAG,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,yBACA,EAAE,MAAM,eAAe,KAAK,EAAE,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAyB,WAAyB;EACtE,MAAM,OAAO,OAAO,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;CACvE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAQ;CAAO;AAC5C;;;ACnEA,MAAa,cAAc,WAAmC;CAC5D,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,uBAAuB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC9E,OAAO;CACT;CAEA,OAAO,EAAE,SAAS;AACpB;;;ACPA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAsB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC/E,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAyB,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,0BAA0B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACjF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAS;AAC5B;;;ACZA,MAAa,iBAAiB,WAAmC;CAC/D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,WAA2C,WAAyB;EACxF,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;CAC1F;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,OAAO,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;CACzD;CAEA,OAAO;EAAE;EAAQ;EAAQ;CAAU;AACrC;;;ACfA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAgB,WAAyB;EAK7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iBACA,EAAQ,KAA+B,GACvC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAU;AAC7B;;;ACnBA,MAAa,eAAe,WAAmC;CAC7D,MAAM,UAAU,OAAO,cAAsB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA,EAAE,MAAM,EAAE,aAAa,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,aAAa,OAAO,OAAgB,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA,CAAC,GACD;GAAE;GAAQ,SAAS,QAAQ,GAAG,WAAW,gBAAgB,UAAU,QAAQ,IAAI,KAAA;EAAU,CAC3F;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAuB,WAAyB;EACpE,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACjE;CAEA,OAAO;EAAE;EAAS;EAAY;CAAO;AACvC;;;AC3BA,MAAa,kBAAkB,WAAmC;CAChE,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,WAAyB;EACtD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;EAEvF,OAAO;CACT;CAEA,MAAM,WAAW,OACf,EAAE,YAAY,aAAa,MAAM,sBAAsB,SACvD,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,8BACA,EAAE,MAAM;GAAE;GAAY;GAAY;EAAoB,EAAE,GACxD,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAIA,MAAM,SAAS,OAAO,EAAE,IAAI,GAAG,SAA8B,WAAyB;EACpF,MAAM,OAAO,OAAO,0BAA0B;GAAE,MAAM,EAAE,GAAG;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;CACnF;CAEA,OAAO;EAAE;EAAQ;EAAiB;EAAU;CAAO;AACrD;;;AClBA,MAAa,oBAAoB,EAAE,SAAS,kBAAyC;CACnF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,gBAAgB;CAClB,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAC7C;EACA;EACA,gBAAgB;CAClB,CAAC;CAKD,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA,OAAO,YAAY,MAAM;EACzB,KAAK,UAAU,MAAM;EACrB,UAAU,eAAe,MAAM;EAC/B,MAAM,WAAW,MAAM;EACvB,KAAK,UAAU,MAAM;EACrB,QAAQ,aAAa,MAAM;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,WAAW,MAAM;EACvB,SAAS,cAAc,MAAM;EAC7B,OAAO,YAAY,MAAM;EACzB,UAAU,eAAe,MAAM;CACjC;AACF"}

package/dist/authClient-_PpvGgZJ.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"authClient-_PpvGgZJ.cjs","names":["z","z","z","HttpHeader","createOpenapiFetchClient","validateConnectionStatus","createGenericFetchClient"],"sources":["../src/clients/auth/device/device.ts","../src/clients/auth/login/schemas.ts","../src/clients/auth/login/login.ts","../src/clients/auth/mfa/schemas.ts","../src/clients/auth/mfa/mfa.ts","../src/clients/auth/password/schemas.ts","../src/clients/auth/password/password.ts","../src/clients/auth/pat/pat.ts","../src/clients/auth/pkce/pkce.ts","../src/clients/auth/saml/saml.ts","../src/clients/auth/session/session.ts","../src/clients/auth/sudo/sudo.ts","../src/clients/auth/token/token.ts","../src/clients/auth/webauthn/webauthn.ts","../src/clients/auth/authClient.ts"],"sourcesContent":["import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  ApproveDeviceAuthorizationBody,\n  CreateDeviceAuthorizationBody,\n  GetDeviceAuthorizationTokenBody,\n} from './types';\n\nexport const createDevice = (client: AuthOpenApiFetchClient) => {\n  const create = async (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device', { body }, { signal });\n    return data;\n  };\n\n  const approve = async (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/approve', { body }, { signal });\n    return data;\n  };\n\n  const getToken = async (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/device/token', { body }, { signal });\n    return data;\n  };\n\n  return { create, approve, getToken };\n};\n","import * as z from 'zod';\n\nexport const loginInputSchema = z.object({\n  email: z.email(),\n  password: z.string().min(1, 'Required'),\n});\n\nexport const oidcInputSchema = z.object({\n  grantType: z.enum(['google', 'microsoft']),\n  idToken: z.string().min(1, 'Required'),\n});\n\nexport type LoginInput = z.infer<typeof loginInputSchema>;\nexport type OidcInput = z.infer<typeof oidcInputSchema>;\n\nconst userSchema = z.object({\n  id: z.number(),\n  email: z.string(),\n  name: z.string(),\n});\n\n// Success shape. The backend omits `mfaRequired` here, so we inject a `false`\n// literal to make the outcome a discriminated union on `mfaRequired`.\nexport const loginSuccessSchema = z.object({\n  mfaRequired: z.literal(false).default(false),\n  accessToken: z.string(),\n  refreshToken: z.string(),\n  tokenType: z.string(),\n  expiresIn: z.number(),\n  sessionId: z.string(),\n  user: userSchema,\n});\n\n/**\n * MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.\n *\n * - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy\n *   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch\n *   and handle the unknown case themselves.\n * - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey\n *   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it\n *   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate\n *   present, `null` and absent alike.\n * - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody\n *   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely\n *   out of the passkey path. Whoever runs the ceremony validates it properly instead.\n */\nexport const mfaChallengeSchema = z.object({\n  mfaRequired: z.literal(true),\n  mfaType: z.string(),\n  mfaToken: z.string(),\n  expiresIn: z.number(),\n  allowedMethods: z.array(z.string()),\n  // `.optional()` explicitly: zod 4 dropped zod 3's implicit optionality for `z.unknown()`, so\n  // without it a TOTP challenge — which omits the key — fails to parse and blocks sign-in.\n  webauthn: z.unknown().optional(),\n});\n\nexport const loginResultSchema = z.union([loginSuccessSchema, mfaChallengeSchema]);\n\nexport type LoginUser = z.infer<typeof userSchema>;\nexport type LoginSuccess = z.infer<typeof loginSuccessSchema>;\nexport type MfaChallenge = z.infer<typeof mfaChallengeSchema>;\nexport type LoginResult = z.infer<typeof loginResultSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { LoginInput, OidcInput } from './schemas';\nimport { loginInputSchema, loginResultSchema, oidcInputSchema } from './schemas';\nimport type { LoginBody } from './types';\n\nexport const createLogin = (client: AuthOpenApiFetchClient) => {\n  const _login = async (body: LoginBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/login', { body }, { signal });\n    return data;\n  };\n\n  const withPassword = async (input: LoginInput, signal?: AbortSignal) => {\n    const { email, password } = loginInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType: 'password', email, password } as LoginBody, signal);\n    // Validate against our own schema — the generated response type is unreliable,\n    // and this narrows the outcome to a discriminated union on `mfaRequired`.\n    return loginResultSchema.parse(data);\n  };\n\n  const withOidc = async (input: OidcInput, signal?: AbortSignal) => {\n    const { grantType, idToken } = oidcInputSchema.parse(input);\n    // Cast: omit fields outside the grant — the backend rejects null.\n    const data = await _login({ grantType, idToken } as LoginBody, signal);\n    return loginResultSchema.parse(data);\n  };\n\n  // Unauthenticated. Carries the public OAuth client ids `withOidc` callers mint an id token with.\n  const methods = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/methods', {}, { signal });\n    return data;\n  };\n\n  return { withPassword, withOidc, methods };\n};\n","import * as z from 'zod';\n\nimport type { components } from '../__generated__/schema';\n\n/**\n * The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in\n * `mfaType` / `allowedMethods`.\n *\n * - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.\n * - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or\n *   drops a method fails the build here rather than at runtime mid-sign-in.\n * - A challenge may still name a method absent from here, so the wire fields stay `string`.\n */\nexport const MFA_METHOD = {\n  totp: 'totp',\n  webauthn: 'webauthn',\n  recoveryCode: 'recovery_code',\n} as const satisfies Record<string, components['schemas']['MfaRequest']['type']>;\n\nexport type MfaMethod = (typeof MFA_METHOD)[keyof typeof MFA_METHOD];\n\nexport const mfaCodeInputSchema = z.object({\n  mfaToken: z.string(),\n  type: z.enum([MFA_METHOD.totp, MFA_METHOD.recoveryCode]),\n  code: z.string().min(1, 'Required'),\n});\n\nexport const mfaWebauthnInputSchema = z.object({\n  mfaToken: z.string(),\n  assertion: z.string(),\n});\n\nexport const totpVerifyInputSchema = z.object({\n  code: z.string().min(1, 'Required'),\n  // Optional in the spec, but `openapi-typescript` emits every `default`-bearing property as\n  // required — the schema fills in the backend's own default so callers may still omit it. Set true\n  // to sign the admin out everywhere else as part of enrolling.\n  revokeOtherSessions: z.boolean().default(false),\n});\n\nexport type MfaCodeInput = z.infer<typeof mfaCodeInputSchema>;\nexport type MfaWebauthnInput = z.infer<typeof mfaWebauthnInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type TotpVerifyInput = z.input<typeof totpVerifyInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { MfaCodeInput, MfaWebauthnInput, TotpVerifyInput } from './schemas';\nimport {\n  MFA_METHOD,\n  mfaCodeInputSchema,\n  mfaWebauthnInputSchema,\n  totpVerifyInputSchema,\n} from './schemas';\nimport type { DisableTotpPath, VerifyMfaBody } from './types';\n\nexport const createMfa = (client: AuthOpenApiFetchClient) => {\n  const _verify = async (body: VerifyMfaBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa', { body }, { signal });\n    return data;\n  };\n\n  const verifyWithCode = async (input: MfaCodeInput, signal?: AbortSignal) => {\n    const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type, code } as VerifyMfaBody, signal);\n  };\n\n  const verifyWithWebauthn = async (input: MfaWebauthnInput, signal?: AbortSignal) => {\n    const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);\n    // Cast: omit fields outside the type — the backend rejects null.\n    return _verify({ mfaToken, type: MFA_METHOD.webauthn, assertion } as VerifyMfaBody, signal);\n  };\n\n  const regenerateRecoveryCodes = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/mfa/recovery-codes', {}, { signal });\n    return data;\n  };\n\n  // TOTP enrollment for the signed-in user (account MFA management). `setup` returns the shared\n  // secret + `otpauthUri` to render as a QR; `verify` confirms the first code and hands back the\n  // one-time recovery codes plus the new factor `id`; `disable` removes a factor by that `id`.\n  const totp = {\n    setup: async (signal?: AbortSignal) => {\n      const { data } = await client.post('/v1/auth/mfa/totp', {}, { signal });\n      return data;\n    },\n    verify: async (input: TotpVerifyInput, signal?: AbortSignal) => {\n      const body = totpVerifyInputSchema.parse(input);\n      const { data } = await client.post('/v1/auth/mfa/totp/verify', { body }, { signal });\n      return data;\n    },\n    disable: async (id: DisableTotpPath['id'], signal?: AbortSignal) => {\n      await client.delete('/v1/auth/mfa/totp/{id}', { path: { id } }, { signal });\n    },\n  };\n\n  return { verifyWithCode, verifyWithWebauthn, regenerateRecoveryCodes, totp };\n};\n","import * as z from 'zod';\n\nexport const resetRequestInputSchema = z.object({\n  email: z.email(),\n});\n\nexport const resetInputSchema = z.object({\n  // The single-use reset token (`kbc_pr_…`) delivered by e-mail.\n  token: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every session after the reset. Defaults to true (the backend's own default), so callers\n  // may omit it; set false only to keep existing sessions alive. Password policy is backend-enforced.\n  revokeSessions: z.boolean().default(true),\n});\n\nexport const changeInputSchema = z.object({\n  currentPassword: z.string().min(1, 'Required'),\n  newPassword: z.string().min(1, 'Required'),\n  // Revoke every other session once the password changes. The schema fills in `true` on parse, so\n  // the SDK always sends the field (matching the backend's own default); callers may omit it. Set\n  // false only to keep the other sessions alive.\n  revokeOtherSessions: z.boolean().default(true),\n});\n\nexport type ResetRequestInput = z.infer<typeof resetRequestInputSchema>;\n// `z.input`, not `z.infer`: callers may omit `revokeSessions` (the default fills it in on parse).\nexport type ResetInput = z.input<typeof resetInputSchema>;\n// `z.input`: callers may omit `revokeOtherSessions` (the default fills it in on parse).\nexport type ChangePasswordInput = z.input<typeof changeInputSchema>;\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { ChangePasswordInput, ResetInput, ResetRequestInput } from './schemas';\nimport { changeInputSchema, resetInputSchema, resetRequestInputSchema } from './schemas';\n\nexport const createPassword = (client: AuthOpenApiFetchClient) => {\n  // Fire-and-forget from the caller's view: the backend always answers 202 and reveals nothing about\n  // whether the account exists. Resolves on 202; rejects on 429 (rate limited) or 400.\n  const resetRequest = async (input: ResetRequestInput, signal?: AbortSignal) => {\n    const body = resetRequestInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset-request', { body }, { signal });\n  };\n\n  // Applies the new password for the given reset token. Resolves on 204; rejects on 400 (invalid or\n  // expired token, or a password that violates the policy).\n  const reset = async (input: ResetInput, signal?: AbortSignal) => {\n    // `revokeSessions` is defaulted by the schema, so the parsed body always carries all three\n    // fields the endpoint requires — no field omission, no type assertion.\n    const body = resetInputSchema.parse(input);\n    await client.post('/v1/auth/password/reset', { body }, { signal });\n  };\n\n  // Changes the password for the signed-in user (bearer session). Resolves on 204; rejects on 400\n  // (wrong current password, or a new password that violates the policy). Password policy is\n  // backend-enforced.\n  const change = async (input: ChangePasswordInput, signal?: AbortSignal) => {\n    const body = changeInputSchema.parse(input);\n    await client.post('/v1/auth/password/change', { body }, { signal });\n  };\n\n  return { resetRequest, reset, change };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  CreatePatBodyRaw,\n  CreatePatInput,\n  ExchangePatBodyRaw,\n  ExchangePatInput,\n  PatScopeInput,\n  RevokePatPath,\n} from './types';\n\n/**\n * Drop the keys whose value is `null` or `undefined`, and only those — an empty array or string is\n * a value the caller meant.\n *\n * The spec documents each optional PAT field as \"Omit (do not send `null`)\". Callers hold nullables\n * either way — an empty expiry picker, an untouched switch — so the rule lives here rather than at\n * every call site, where one of them would forget it.\n */\nconst withoutNullish = (entries: Record<string, unknown>): Record<string, unknown> =>\n  Object.fromEntries(Object.entries(entries).filter(([, value]) => value != null));\n\n/** `undefined` for a scope that narrows nothing — which is what an absent `scope` already asks for. */\nconst toScope = (scope: PatScopeInput | null | undefined): Record<string, unknown> | undefined => {\n  if (scope == null) return undefined;\n\n  const payload = withoutNullish({ projects: scope.projects, readOnly: scope.readOnly });\n  return Object.keys(payload).length > 0 ? payload : undefined;\n};\n\n// `as unknown as` at these two boundaries: `CreatePatBodyRaw` and `ExchangePatBodyRaw` both demand\n// the keys the endpoint documents as omittable, so the honest body is not expressible in either.\nconst toCreateBody = ({ name, expiresIn, scope }: CreatePatInput): CreatePatBodyRaw =>\n  ({\n    name,\n    ...withoutNullish({ expiresIn, scope: toScope(scope) }),\n  }) as unknown as CreatePatBodyRaw;\n\nconst toExchangeBody = ({ expiresIn, scope }: ExchangePatInput): ExchangePatBodyRaw =>\n  withoutNullish({ expiresIn, scope: toScope(scope) }) as unknown as ExchangePatBodyRaw;\n\nexport const createPat = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/pat', {}, { signal });\n    return data;\n  };\n\n  const create = async (input: CreatePatInput, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pat', { body: toCreateBody(input) }, { signal });\n    return data;\n  };\n\n  /**\n   * Issue a child token from the one this request is authorized with.\n   *\n   * A child only ever attenuates its parent, so an empty input is a full-inheritance copy.\n   */\n  const exchange = async (input: ExchangePatInput = {}, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/pat/exchange',\n      { body: toExchangeBody(input) },\n      { signal },\n    );\n    return data;\n  };\n\n  const revoke = async (id: RevokePatPath['id'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/pat/{id}', { path: { id } }, { signal });\n  };\n\n  return { create, exchange, revoke, getAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { GetPkceTokenBody } from './types';\n\nexport const createPkce = (client: AuthOpenApiFetchClient) => {\n  const getToken = async (body: GetPkceTokenBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/pkce/token', { body }, { signal });\n    return data;\n  };\n\n  return { getToken };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { AssertSamlBody, InitiateSamlBody } from './types';\n\nexport const createSaml = (client: AuthOpenApiFetchClient) => {\n  const assert = async (body: AssertSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/assert', { body }, { signal });\n    return data;\n  };\n\n  const initiate = async (body?: InitiateSamlBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/saml/initiate', { body }, { signal });\n    return data;\n  };\n\n  return { assert, initiate };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeSessionPath } from './types';\n\nexport const createSession = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/sessions', {}, { signal });\n    return data;\n  };\n\n  const revoke = async (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions/{sessionId}', { path: { sessionId } }, { signal });\n  };\n\n  const revokeAll = async (signal?: AbortSignal) => {\n    await client.delete('/v1/auth/sessions', {}, { signal });\n  };\n\n  return { getAll, revoke, revokeAll };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { SudoBody, SudoBodyRaw } from './types';\n\nexport const createSudo = (client: AuthOpenApiFetchClient) => {\n  const verify = async (body: SudoBody, signal?: AbortSignal) => {\n    // The generated request body (`SudoBodyRaw`) describes a payload the endpoint rejects — see the\n    // `SudoBody` docs. Assert at this one boundary rather than making every caller send the invalid\n    // shape; the real fix is the `#[OA\\Schema]`-vs-object mismatch on the backend, upstream of the\n    // generated schema. Same pattern as `syncActionsClient`'s `PostActionsBodyRaw`.\n    const { data } = await client.post(\n      '/v1/auth/sudo',\n      { body: body as unknown as SudoBodyRaw },\n      { signal },\n    );\n    return data;\n  };\n\n  const challenge = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/sudo/challenge', {}, { signal });\n    return data;\n  };\n\n  return { verify, challenge };\n};\n","import { HttpHeader } from '../../../fetchClient';\nimport type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type { RevokeTokenBody } from './types';\n\nexport const createToken = (client: AuthOpenApiFetchClient) => {\n  const refresh = async (refreshToken: string, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/v1/auth/token/refresh',\n      { body: { refreshToken } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Introspects an authenticated session token.\n   *\n   * @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.\n   */\n  const introspect = async (token?: string, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/v1/auth/token/introspect',\n      {},\n      { signal, headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : undefined },\n    );\n    return data;\n  };\n\n  const revoke = async (body: RevokeTokenBody, signal?: AbortSignal) => {\n    await client.post('/v1/auth/token/revoke', { body }, { signal });\n  };\n\n  return { refresh, introspect, revoke };\n};\n","import type { AuthOpenApiFetchClient } from '../authClient';\n\nimport type {\n  RegisterWebauthnInput,\n  RegisterWebauthnOptionsResult,\n  RemoveWebauthnInput,\n} from './types';\n\nexport const createWebauthn = (client: AuthOpenApiFetchClient) => {\n  const getAll = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/v1/auth/webauthn', {}, { signal });\n    return data;\n  };\n\n  const registerOptions = async (signal?: AbortSignal) => {\n    const { data } = await client.post('/v1/auth/webauthn/register/options', {}, { signal });\n    // Cast: the spec types the free-form `options` object as `Record<string, never>`.\n    return data as RegisterWebauthnOptionsResult;\n  };\n\n  const register = async (\n    { credential, deviceName = null, revokeOtherSessions = false }: RegisterWebauthnInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.post(\n      '/v1/auth/webauthn/register',\n      { body: { credential, deviceName, revokeOtherSessions } },\n      { signal },\n    );\n    return data;\n  };\n\n  // `revokeOtherSessions` signs every other session out along with the credential — the calling\n  // session and personal access tokens survive. Omitted means the backend's own `false`.\n  const remove = async ({ id, ...query }: RemoveWebauthnInput, signal?: AbortSignal) => {\n    await client.delete('/v1/auth/webauthn/{id}', { path: { id }, query }, { signal });\n  };\n\n  return { getAll, registerOptions, register, remove };\n};\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport type { ClientInitOptions } from '../types';\nimport { validateConnectionStatus } from '../validateConnectionStatus';\n\nimport type { paths } from './__generated__/schema';\nimport { createDevice } from './device';\nimport { createLogin } from './login';\nimport { createMfa } from './mfa';\nimport { createPassword } from './password';\nimport { createPat } from './pat';\nimport { createPkce } from './pkce';\nimport { createSaml } from './saml';\nimport { createSession } from './session';\nimport { createSudo } from './sudo';\nimport { createToken } from './token';\nimport { createWebauthn } from './webauthn';\n\nexport type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;\n\nexport type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;\n\nexport const createAuthClient = ({ baseUrl, middlewares }: AuthClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n  const genericClient = createGenericFetchClient({\n    baseUrl,\n    middlewares,\n    validateStatus: validateConnectionStatus,\n  });\n\n  // Host-level: Connection serves the storage, management and auth APIs off one baseUrl, so this\n  // probes the host, not this API's prefix — `/v2/storage/health-check`, `/manage/health-check`\n  // and `/v1/auth/health-check` all 404.\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    login: createLogin(client),\n    mfa: createMfa(client),\n    password: createPassword(client),\n    saml: createSaml(client),\n    pat: createPat(client),\n    device: createDevice(client),\n    sudo: createSudo(client),\n    pkce: createPkce(client),\n    session: createSession(client),\n    token: createToken(client),\n    webauthn: createWebauthn(client),\n  };\n};\n"],"mappings":";;;;;;;;AAQA,MAAa,gBAAgB,WAAmC;CAC9D,MAAM,SAAS,OAAO,MAAqC,WAAyB;EAClF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,mBAAmB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC1E,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,MAAsC,WAAyB;EACpF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAuC,WAAyB;EACtF,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;EAAS;CAAS;AACrC;;;ACvBA,MAAa,mBAAmBA,IAAE,OAAO;CACvC,OAAOA,IAAE,MAAM;CACf,UAAUA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACxC,CAAC;AAED,MAAa,kBAAkBA,IAAE,OAAO;CACtC,WAAWA,IAAE,KAAK,CAAC,UAAU,WAAW,CAAC;CACzC,SAASA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACvC,CAAC;AAKD,MAAM,aAAaA,IAAE,OAAO;CAC1B,IAAIA,IAAE,OAAO;CACb,OAAOA,IAAE,OAAO;CAChB,MAAMA,IAAE,OAAO;AACjB,CAAC;AAID,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK;CAC3C,aAAaA,IAAE,OAAO;CACtB,cAAcA,IAAE,OAAO;CACvB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,WAAWA,IAAE,OAAO;CACpB,MAAM;AACR,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,qBAAqBA,IAAE,OAAO;CACzC,aAAaA,IAAE,QAAQ,IAAI;CAC3B,SAASA,IAAE,OAAO;CAClB,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;CACpB,gBAAgBA,IAAE,MAAMA,IAAE,OAAO,CAAC;CAGlC,UAAUA,IAAE,QAAQ,CAAC,CAAC,SAAS;AACjC,CAAC;AAED,MAAa,oBAAoBA,IAAE,MAAM,CAAC,oBAAoB,kBAAkB,CAAC;;;ACpDjF,MAAa,eAAe,WAAmC;CAC7D,MAAM,SAAS,OAAO,MAAiB,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,kBAAkB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACzE,OAAO;CACT;CAEA,MAAM,eAAe,OAAO,OAAmB,WAAyB;EACtE,MAAM,EAAE,OAAO,aAAa,iBAAiB,MAAM,KAAK;EAExD,MAAM,OAAO,MAAM,OAAO;GAAE,WAAW;GAAY;GAAO;EAAS,GAAgB,MAAM;EAGzF,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAEA,MAAM,WAAW,OAAO,OAAkB,WAAyB;EACjE,MAAM,EAAE,WAAW,YAAY,gBAAgB,MAAM,KAAK;EAE1D,MAAM,OAAO,MAAM,OAAO;GAAE;GAAW;EAAQ,GAAgB,MAAM;EACrE,OAAO,kBAAkB,MAAM,IAAI;CACrC;CAGA,MAAM,UAAU,OAAO,WAAyB;EAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;EACpE,OAAO;CACT;CAEA,OAAO;EAAE;EAAc;EAAU;CAAQ;AAC3C;;;;;;;;;;;;ACtBA,MAAa,aAAa;CACxB,MAAM;CACN,UAAU;CACV,cAAc;AAChB;AAIA,MAAa,qBAAqBC,IAAE,OAAO;CACzC,UAAUA,IAAE,OAAO;CACnB,MAAMA,IAAE,KAAK,CAAC,WAAW,MAAM,WAAW,YAAY,CAAC;CACvD,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;AACpC,CAAC;AAED,MAAa,yBAAyBA,IAAE,OAAO;CAC7C,UAAUA,IAAE,OAAO;CACnB,WAAWA,IAAE,OAAO;AACtB,CAAC;AAED,MAAa,wBAAwBA,IAAE,OAAO;CAC5C,MAAMA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIlC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;AAChD,CAAC;;;AC3BD,MAAa,aAAa,WAAmC;CAC3D,MAAM,UAAU,OAAO,MAAqB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACvE,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAO,OAAqB,WAAyB;EAC1E,MAAM,EAAE,UAAU,MAAM,SAAS,mBAAmB,MAAM,KAAK;EAE/D,OAAO,QAAQ;GAAE;GAAU;GAAM;EAAK,GAAoB,MAAM;CAClE;CAEA,MAAM,qBAAqB,OAAO,OAAyB,WAAyB;EAClF,MAAM,EAAE,UAAU,cAAc,uBAAuB,MAAM,KAAK;EAElE,OAAO,QAAQ;GAAE;GAAU,MAAM,WAAW;GAAU;EAAU,GAAoB,MAAM;CAC5F;CAEA,MAAM,0BAA0B,OAAO,WAAyB;EAC9D,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC;EAChF,OAAO;CACT;CAoBA,OAAO;EAAE;EAAgB;EAAoB;EAAyB,MAAA;GAdpE,OAAO,OAAO,WAAyB;IACrC,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACtE,OAAO;GACT;GACA,QAAQ,OAAO,OAAwB,WAAyB;IAC9D,MAAM,OAAO,sBAAsB,MAAM,KAAK;IAC9C,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;IACnF,OAAO;GACT;GACA,SAAS,OAAO,IAA2B,WAAyB;IAClE,MAAM,OAAO,OAAO,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;GAC5E;EAGuE;CAAE;AAC7E;;;ACnDA,MAAa,0BAA0BC,IAAE,OAAO,EAC9C,OAAOA,IAAE,MAAM,EACjB,CAAC;AAED,MAAa,mBAAmBA,IAAE,OAAO;CAEvC,OAAOA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CACnC,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAGzC,gBAAgBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC1C,CAAC;AAED,MAAa,oBAAoBA,IAAE,OAAO;CACxC,iBAAiBA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAC7C,aAAaA,IAAE,OAAO,CAAC,CAAC,IAAI,GAAG,UAAU;CAIzC,qBAAqBA,IAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AAC/C,CAAC;;;ACjBD,MAAa,kBAAkB,WAAmC;CAGhE,MAAM,eAAe,OAAO,OAA0B,WAAyB;EAC7E,MAAM,OAAO,wBAAwB,MAAM,KAAK;EAChD,MAAM,OAAO,KAAK,mCAAmC,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CAC3E;CAIA,MAAM,QAAQ,OAAO,OAAmB,WAAyB;EAG/D,MAAM,OAAO,iBAAiB,MAAM,KAAK;EACzC,MAAM,OAAO,KAAK,2BAA2B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACnE;CAKA,MAAM,SAAS,OAAO,OAA4B,WAAyB;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,MAAM,OAAO,KAAK,4BAA4B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACpE;CAEA,OAAO;EAAE;EAAc;EAAO;CAAO;AACvC;;;;;;;;;;;ACZA,MAAM,kBAAkB,YACtB,OAAO,YAAY,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,SAAS,IAAI,CAAC;;AAGjF,MAAM,WAAW,UAAiF;CAChG,IAAI,SAAS,MAAM,OAAO,KAAA;CAE1B,MAAM,UAAU,eAAe;EAAE,UAAU,MAAM;EAAU,UAAU,MAAM;CAAS,CAAC;CACrF,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,UAAU,KAAA;AACrD;AAIA,MAAM,gBAAgB,EAAE,MAAM,WAAW,aACtC;CACC;CACA,GAAG,eAAe;EAAE;EAAW,OAAO,QAAQ,KAAK;CAAE,CAAC;AACxD;AAEF,MAAM,kBAAkB,EAAE,WAAW,YACnC,eAAe;CAAE;CAAW,OAAO,QAAQ,KAAK;AAAE,CAAC;AAErD,MAAa,aAAa,WAAmC;CAC3D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAuB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;EAC5F,OAAO;CACT;;;;;;CAOA,MAAM,WAAW,OAAO,QAA0B,CAAC,GAAG,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,yBACA,EAAE,MAAM,eAAe,KAAK,EAAE,GAC9B,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,IAAyB,WAAyB;EACtE,MAAM,OAAO,OAAO,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC;CACvE;CAEA,OAAO;EAAE;EAAQ;EAAU;EAAQ;CAAO;AAC5C;;;ACnEA,MAAa,cAAc,WAAmC;CAC5D,MAAM,WAAW,OAAO,MAAwB,WAAyB;EACvE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,uBAAuB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC9E,OAAO;CACT;CAEA,OAAO,EAAE,SAAS;AACpB;;;ACPA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAsB,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAC/E,OAAO;CACT;CAEA,MAAM,WAAW,OAAO,MAAyB,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,0BAA0B,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EACjF,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAS;AAC5B;;;ACZA,MAAa,iBAAiB,WAAmC;CAC/D,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,WAA2C,WAAyB;EACxF,MAAM,OAAO,OAAO,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;CAC1F;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,OAAO,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;CACzD;CAEA,OAAO;EAAE;EAAQ;EAAQ;CAAU;AACrC;;;ACfA,MAAa,cAAc,WAAmC;CAC5D,MAAM,SAAS,OAAO,MAAgB,WAAyB;EAK7D,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,iBACA,EAAQ,KAA+B,GACvC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,WAAyB;EAChD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC;EAC5E,OAAO;CACT;CAEA,OAAO;EAAE;EAAQ;CAAU;AAC7B;;;ACnBA,MAAa,eAAe,WAAmC;CAC7D,MAAM,UAAU,OAAO,cAAsB,WAAyB;EACpE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,0BACA,EAAE,MAAM,EAAE,aAAa,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,aAAa,OAAO,OAAgB,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA,CAAC,GACD;GAAE;GAAQ,SAAS,QAAQ,GAAGC,0BAAAA,WAAW,gBAAgB,UAAU,QAAQ,IAAI,KAAA;EAAU,CAC3F;EACA,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,MAAuB,WAAyB;EACpE,MAAM,OAAO,KAAK,yBAAyB,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;CACjE;CAEA,OAAO;EAAE;EAAS;EAAY;CAAO;AACvC;;;AC3BA,MAAa,kBAAkB,WAAmC;CAChE,MAAM,SAAS,OAAO,WAAyB;EAC7C,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,kBAAkB,OAAO,WAAyB;EACtD,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,sCAAsC,CAAC,GAAG,EAAE,OAAO,CAAC;EAEvF,OAAO;CACT;CAEA,MAAM,WAAW,OACf,EAAE,YAAY,aAAa,MAAM,sBAAsB,SACvD,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,8BACA,EAAE,MAAM;GAAE;GAAY;GAAY;EAAoB,EAAE,GACxD,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAIA,MAAM,SAAS,OAAO,EAAE,IAAI,GAAG,SAA8B,WAAyB;EACpF,MAAM,OAAO,OAAO,0BAA0B;GAAE,MAAM,EAAE,GAAG;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;CACnF;CAEA,OAAO;EAAE;EAAQ;EAAiB;EAAU;CAAO;AACrD;;;AClBA,MAAa,oBAAoB,EAAE,SAAS,kBAAyC;CACnF,MAAM,SAASC,iCAAAA,yBAAgC;EAC7C;EACA;EACA,gBAAgBC,iCAAAA;CAClB,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAC7C;EACA;EACA,gBAAgBD,iCAAAA;CAClB,CAAC;CAKD,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA,OAAO,YAAY,MAAM;EACzB,KAAK,UAAU,MAAM;EACrB,UAAU,eAAe,MAAM;EAC/B,MAAM,WAAW,MAAM;EACvB,KAAK,UAAU,MAAM;EACrB,QAAQ,aAAa,MAAM;EAC3B,MAAM,WAAW,MAAM;EACvB,MAAM,WAAW,MAAM;EACvB,SAAS,cAAc,MAAM;EAC7B,OAAO,YAAY,MAAM;EACzB,UAAU,eAAe,MAAM;CACjC;AACF"}

package/dist/concurrent-CH9fbNr3.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"concurrent-CH9fbNr3.js","names":[],"sources":["../src/utils/async/concurrent.ts"],"sourcesContent":["// A sync return is accepted so callers don't have to wrap plain values (or a\n// conditional no-op) in `Promise.resolve` just to satisfy the signature.\ntype ProcessFn<T, R> = (item: T, index: number, arrayLength: number) => R | PromiseLike<R>;\nexport type MiddlewareFn<T, R> = (next: ProcessFn<T, R>) => ProcessFn<T, R>;\n\nexport type ConcurrentOptions<T, R> = {\n  items: T[];\n  process: ProcessFn<T, R>;\n  concurrency?: number;\n  middlewares?: MiddlewareFn<T, R>[];\n};\n\n/**\n * Executes a callback function on an array of items, processing multiple items concurrently with a specified concurrency limit.\n * It behaves similarly to Promise.all(), failing on the first rejected promise.\n * After the first rejection no further items are started: items already in flight run to\n * completion (they cannot be cancelled), but the rest of the queue is abandoned — nothing\n * keeps executing detached behind the caller's back after the returned promise has settled.\n * The order of the results matches the order of the promises.\n */\nexport const concurrent = async <T, R>({\n  items,\n  process,\n  concurrency = 2,\n  middlewares = [],\n}: ConcurrentOptions<T, R>): Promise<R[]> => {\n  if (concurrency < 1) throw new Error('Concurrency must be greater than 0');\n  if (items.length === 0) return [];\n  if (concurrency === Infinity)\n    return Promise.all(items.map((item, index) => process(item, index, items.length)));\n\n  const n = items.length;\n  const results: R[] = Array.from({ length: n });\n\n  const processWithMiddlewares = middlewares.reduceRight(\n    (next, middleware) => middleware(next),\n    process,\n  );\n\n  const queue = items.map((item, index) => async () => {\n    results[index] = await processWithMiddlewares(item, index, items.length);\n  });\n\n  const workers = Array.from(\n    { length: Math.min(concurrency, items.length) },\n    async function processQueue() {\n      while (queue.length) {\n        try {\n          await queue.shift()?.();\n        } catch (error) {\n          // The rejection settles the whole call, so starting more items would be\n          // detached work the caller can neither observe nor cancel.\n          queue.length = 0;\n          throw error;\n        }\n      }\n    },\n  );\n\n  await Promise.all(workers);\n  return results;\n};\n"],"mappings":";;;;;;;;;AAoBA,MAAa,aAAa,OAAa,EACrC,OACA,SACA,cAAc,GACd,cAAc,CAAC,QAC4B;CAC3C,IAAI,cAAc,GAAG,MAAM,IAAI,MAAM,oCAAoC;CACzE,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;CAChC,IAAI,gBAAgB,UAClB,OAAO,QAAQ,IAAI,MAAM,KAAK,MAAM,UAAU,QAAQ,MAAM,OAAO,MAAM,MAAM,CAAC,CAAC;CAEnF,MAAM,IAAI,MAAM;CAChB,MAAM,UAAe,MAAM,KAAK,EAAE,QAAQ,EAAE,CAAC;CAE7C,MAAM,yBAAyB,YAAY,aACxC,MAAM,eAAe,WAAW,IAAI,GACrC,OACF;CAEA,MAAM,QAAQ,MAAM,KAAK,MAAM,UAAU,YAAY;EACnD,QAAQ,SAAS,MAAM,uBAAuB,MAAM,OAAO,MAAM,MAAM;CACzE,CAAC;CAED,MAAM,UAAU,MAAM,KACpB,EAAE,QAAQ,KAAK,IAAI,aAAa,MAAM,MAAM,EAAE,GAC9C,eAAe,eAAe;EAC5B,OAAO,MAAM,QACX,IAAI;GACF,MAAM,MAAM,MAAM,CAAC,GAAG;EACxB,SAAS,OAAO;GAGd,MAAM,SAAS;GACf,MAAM;EACR;CAEJ,CACF;CAEA,MAAM,QAAQ,IAAI,OAAO;CACzB,OAAO;AACT"}

package/dist/concurrent-tbiIa0UL.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"concurrent-tbiIa0UL.cjs","names":[],"sources":["../src/utils/async/concurrent.ts"],"sourcesContent":["// A sync return is accepted so callers don't have to wrap plain values (or a\n// conditional no-op) in `Promise.resolve` just to satisfy the signature.\ntype ProcessFn<T, R> = (item: T, index: number, arrayLength: number) => R | PromiseLike<R>;\nexport type MiddlewareFn<T, R> = (next: ProcessFn<T, R>) => ProcessFn<T, R>;\n\nexport type ConcurrentOptions<T, R> = {\n  items: T[];\n  process: ProcessFn<T, R>;\n  concurrency?: number;\n  middlewares?: MiddlewareFn<T, R>[];\n};\n\n/**\n * Executes a callback function on an array of items, processing multiple items concurrently with a specified concurrency limit.\n * It behaves similarly to Promise.all(), failing on the first rejected promise.\n * After the first rejection no further items are started: items already in flight run to\n * completion (they cannot be cancelled), but the rest of the queue is abandoned — nothing\n * keeps executing detached behind the caller's back after the returned promise has settled.\n * The order of the results matches the order of the promises.\n */\nexport const concurrent = async <T, R>({\n  items,\n  process,\n  concurrency = 2,\n  middlewares = [],\n}: ConcurrentOptions<T, R>): Promise<R[]> => {\n  if (concurrency < 1) throw new Error('Concurrency must be greater than 0');\n  if (items.length === 0) return [];\n  if (concurrency === Infinity)\n    return Promise.all(items.map((item, index) => process(item, index, items.length)));\n\n  const n = items.length;\n  const results: R[] = Array.from({ length: n });\n\n  const processWithMiddlewares = middlewares.reduceRight(\n    (next, middleware) => middleware(next),\n    process,\n  );\n\n  const queue = items.map((item, index) => async () => {\n    results[index] = await processWithMiddlewares(item, index, items.length);\n  });\n\n  const workers = Array.from(\n    { length: Math.min(concurrency, items.length) },\n    async function processQueue() {\n      while (queue.length) {\n        try {\n          await queue.shift()?.();\n        } catch (error) {\n          // The rejection settles the whole call, so starting more items would be\n          // detached work the caller can neither observe nor cancel.\n          queue.length = 0;\n          throw error;\n        }\n      }\n    },\n  );\n\n  await Promise.all(workers);\n  return results;\n};\n"],"mappings":";;;;;;;;;AAoBA,MAAa,aAAa,OAAa,EACrC,OACA,SACA,cAAc,GACd,cAAc,CAAC,QAC4B;CAC3C,IAAI,cAAc,GAAG,MAAM,IAAI,MAAM,oCAAoC;CACzE,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;CAChC,IAAI,gBAAgB,UAClB,OAAO,QAAQ,IAAI,MAAM,KAAK,MAAM,UAAU,QAAQ,MAAM,OAAO,MAAM,MAAM,CAAC,CAAC;CAEnF,MAAM,IAAI,MAAM;CAChB,MAAM,UAAe,MAAM,KAAK,EAAE,QAAQ,EAAE,CAAC;CAE7C,MAAM,yBAAyB,YAAY,aACxC,MAAM,eAAe,WAAW,IAAI,GACrC,OACF;CAEA,MAAM,QAAQ,MAAM,KAAK,MAAM,UAAU,YAAY;EACnD,QAAQ,SAAS,MAAM,uBAAuB,MAAM,OAAO,MAAM,MAAM;CACzE,CAAC;CAED,MAAM,UAAU,MAAM,KACpB,EAAE,QAAQ,KAAK,IAAI,aAAa,MAAM,MAAM,EAAE,GAC9C,eAAe,eAAe;EAC5B,OAAO,MAAM,QACX,IAAI;GACF,MAAM,MAAM,MAAM,CAAC,GAAG;EACxB,SAAS,OAAO;GAGd,MAAM,SAAS;GACf,MAAM;EACR;CAEJ,CACF;CAEA,MAAM,QAAQ,IAAI,OAAO;CACzB,OAAO;AACT"}

package/dist/configurations-BVvcimzo.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"configurations-BVvcimzo.js","names":[],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n *\n * @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are\n * organization-admin only and use that predicate; do not widen this one to\n * cover them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer — models and their\n * datasets, metrics, relationships, glossary terms and constraints in the\n * metastore.\n *\n * - A denylist, unlike `isKaiSettingsWriterRole` above: the metastore's\n *   project-level ACL admits ordinary project work, so every role that can edit\n *   configurations can edit the model. Only `readOnly` is refused.\n * - A limited (non-master) token carries no project role and its `admin` block is\n *   absent (AI-3593) — hence the optional chain. It is not denied here: the\n *   metastore, not this client, decides what such a token may do.\n * - Organization-scope promotion is a separate, narrower right the metastore\n *   answers with a 403; surface that error rather than pre-empting it here.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role !== AdminRole.ReadOnly;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACfA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAM,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,MAAM,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAM,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK,MAAM,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAM,UAAU;;;;;;;;;;AAW1F,MAAa,oBAAoB,cAC9B,OAAO,OAAO,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;AAsBjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAK,UAAU;EACf,KAAK,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;;AAQA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;;;;;;;AAgBA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAAS,UAAU;AAElC,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;ACrFA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/configurations-CyFF9Dtu.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"configurations-CyFF9Dtu.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all — distinct from\n * whether it may do any particular thing. A role failing this check is not\n * \"denied\", it's *unrecognized*: either Storage started returning a role this\n * client has never heard of, or something upstream is sending garbage. Callers\n * that deny-by-default on every predicate here (the common case) still want to\n * know about this distinction, because it never shows up as a failed request —\n * a caller should log it loudly rather than treat it as routine.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's **project-wide** settings (custom\n * instructions injected into every project member's system prompt).\n *\n * `admin` and `share` only. The value is a shared prompt-injection surface, so\n * changing it counts as project administration rather than project work:\n * `productionManager` and `guest` are read-only for project management in kbc-ui,\n * and `developer`/`reviewer` are denied because `agent_settings` is keyed by\n * `project_id` alone — editing it \"inside a dev branch\" writes production-visible\n * global config.\n *\n * An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist\n * would admit each new one silently with no test failing. Takes the raw role\n * string so a caller holding an unparsed `tokens.verify()` response can use it\n * without fabricating a `StorageToken`. AI-3671.\n *\n * @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are\n * organization-admin only and use that predicate; do not widen this one to\n * cover them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings. A limited\n * (non-master) token never may: it carries no project role at all, and its\n * `admin` block is absent despite the hand-authored type declaring it required\n * (AI-3593) — hence the optional chain.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer — models and their\n * datasets, metrics, relationships, glossary terms and constraints in the\n * metastore.\n *\n * - A denylist, unlike `isKaiSettingsWriterRole` above: the metastore's\n *   project-level ACL admits ordinary project work, so every role that can edit\n *   configurations can edit the model. Only `readOnly` is refused.\n * - A limited (non-master) token carries no project role and its `admin` block is\n *   absent (AI-3593) — hence the optional chain. It is not denied here: the\n *   metastore, not this client, decides what such a token may do.\n * - Organization-scope promotion is a separate, narrower right the metastore\n *   answers with a 403; surface that error rather than pre-empting it here.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role !== AdminRole.ReadOnly;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / update / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACfA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;;;;;AAW1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;AAsBjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;;AAQA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;;;;;;;AAgBA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAASA,mBAAAA,UAAU;AAElC,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;ACrFA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/configurations-VtNE0nrT.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"configurations-VtNE0nrT.js","names":["snowflakeCommon"],"sources":["../src/utils/isEmptyDeep.ts","../src/utils/schemaGuidedMerge.ts","../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../src/sdks/configurations/schemas/common/dbConfig.ts","../src/sdks/configurations/schemas/common/dbConnection.ts","../src/sdks/configurations/schemas/common/forbidden.ts","../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../src/sdks/configurations/schemas/common/sslSchema.ts","../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../src/sdks/configurations/schemas/googleAdsSchema.ts","../src/sdks/configurations/schemas/schedulerSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../src/sdks/configurations/createRegistry/createRegistry.ts","../src/sdks/configurations/registry.ts","../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { isPlainObject } from './isPlainObject';\n\n/**\n * Is `value` \"deeply empty\" — i.e. carries no leaf data? `null`/`undefined`, `{}`, `[]`, and\n * nested structures whose every leaf is itself empty (e.g. `{ parameters: {} }`) are empty.\n * Any present primitive (string, number, boolean — including `''`) counts as content.\n *\n * Used to skip a pointless encryption round-trip when a validated configuration has nothing\n * to encrypt.\n */\nexport const isEmptyDeep = (value: unknown): boolean => {\n  if (value == null) return true;\n  if (Array.isArray(value)) return value.every(isEmptyDeep);\n  if (isPlainObject(value)) return Object.values(value).every(isEmptyDeep);\n  return false;\n};\n","import { z } from 'zod';\n\nimport { isPlainObject } from './isPlainObject';\n\n/** Strip optional/nullable/default wrappers to reach the structural schema node. */\nconst unwrap = (schema: z.core.$ZodType): z.core.$ZodType =>\n  schema instanceof z.ZodOptional ||\n  schema instanceof z.ZodNullable ||\n  schema instanceof z.ZodDefault\n    ? unwrap(schema.unwrap())\n    : schema;\n\n/**\n * Merge `patch` into `base`, guided by `schema`: descend only through object schemas, merging\n * key-by-key. At every non-object node — a `z.union` (e.g. Snowflake's password|keypair auth),\n * an array, or a primitive — the patch REPLACES the base wholesale. That replace is what lets an\n * update *delete* keys the additive `deepMerge` cannot: switching a credential union to the other\n * variant drops the abandoned variant's secret, because the entire union subtree is swapped.\n *\n * Consequence: a union (or array) subtree is all-or-nothing — the caller must send the complete\n * block, since a partial patch replaces (and so loses) the omitted siblings.\n *\n * Object keys present only in `base` (e.g. `storage`, `processors`, anything the schema omits) are\n * preserved at every level; `undefined` patch values are skipped. Assumes `patch` is already\n * schema-validated (so every object-valued patch key has a matching schema node). Pure — neither\n * argument is mutated.\n */\nexport const schemaGuidedMerge = <T extends Record<string, unknown>>(\n  schema: z.core.$ZodType,\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const node = unwrap(schema);\n  if (!(node instanceof z.ZodObject) || !isPlainObject(base)) return patch as T;\n\n  const out: Record<string, unknown> = { ...base };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const child = node.shape[key];\n    const current = out[key];\n    out[key] =\n      child && isPlainObject(current) && isPlainObject(value)\n        ? schemaGuidedMerge(child, current, value)\n        : value;\n  }\n\n  return out as T;\n};\n","import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials — host/port/user/#password/database + optional SSH tunnel, the\n * same `parameters.db` block the writers use. Tunnel support mirrors kbc-ui's `hasSshTunnel` /\n * `hasSsl` (`apps/kbc-ui/src/scripts/modules/ex-db-generic/helpers.ts`): most drivers accept an\n * SSH tunnel, only pgsql/mysql/mssql also accept SSL, and a handful accept neither. This shared\n * schema covers the generic SSH-only drivers: redshift, db2(-bata), mssql-cdata, impala,\n * hive(-csas, -csas-test). SSL-capable pgsql and the tunnel-less progress-db get their own\n * schema, as do drivers with extra/renamed fields.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { createDefaultBranch } from '../../domain/defaultBranch';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — schema-guided deep merge: object fields patch individually, while a\n *   credential union or array subtree is replaced wholesale (so switching auth variants deletes\n *   the abandoned secret). Untouched leaves and out-of-schema keys are preserved. Reads the\n *   current config first to merge onto.\n * - `'replace'` — store exactly what the caller sends (after validation + encryption); no read,\n *   no merge. Completeness is on the caller — any field or sibling key (e.g. `storage`) it omits\n *   is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,eAAe,UAA4B;CACtD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,MAAM,WAAW;CACxD,IAAI,cAAc,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,WAAW;CACvE,OAAO;AACT;;;;ACVA,MAAM,UAAU,WACd,kBAAkB,EAAE,eACpB,kBAAkB,EAAE,eACpB,kBAAkB,EAAE,aAChB,OAAO,OAAO,OAAO,CAAC,IACtB;;;;;;;;;;;;;;;;AAiBN,MAAa,qBACX,QACA,MACA,UACM;CACN,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,EAAE,gBAAgB,EAAE,cAAc,CAAC,cAAc,IAAI,GAAG,OAAO;CAEnE,MAAM,MAA+B,EAAE,GAAG,KAAK;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OACF,SAAS,cAAc,OAAO,KAAK,cAAc,KAAK,IAClD,kBAAkB,OAAO,SAAS,KAAK,IACvC;CACR;CAEA,OAAO;AACT;;;;;;;;ACxCA,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO,EACnB,IAAI,EAAE,OAAO,EACX,aAAa,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;;ACVD,MAAa,YAAkC,OAC7C,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;;ACI3C,MAAa,qBAAqB,EAAE,OAAO;CACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;;ACLD,MAAa,YAAY,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;;ACFhD,MAAa,2BAA2B,EAAE,OAAO,EAC/C,WAAW,EAAE,OAAO;CAClB,IAAI,EAAE,OAAO;CACb,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;;ACVD,MAAa,kBAAkB,EAAE,OAAO;CACtC,SAAS,EAAE,QAAQ;CACnB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAM,EACH,OAAO;EACN,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;ACZD,MAAa,YAAY,EAAE,OAAO;CAChC,SAAS,EAAE,QAAQ;CACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;;ACAD,MAAM,gBAAgB,EAAE,OAAO;CAC7B,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,iBAAiB,EAAE,OAAO;CAC1B,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+B,EAAE,OAAO,EACnD,YAAY,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoB,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuB,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;;ACfD,MAAM,qBAAqB,EACxB,OAAO;CACN,WAAW,EAAE,QAAQ,aAAa;CAClC,aAAa,EAAE,OAAO;CACtB,oBAAoB,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAc,EACjB,OAAO;CACN,WAAW,EAAE,QAAQ,MAAM;CAC3B,WAAW,EAAE,OAAO;CACpB,UAAU,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgB,EAC1B,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;;AChCT,MAAa,oBAAoB,EAC9B,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;;ACVT,MAAa,wBAAwB,EAClC,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;ACZT,MAAM,gBAAgB,EAAE,OAAO;CAC7B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,gBAAgB,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAU,EAAE,OAAO;CACnB,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAc,EACxB,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;;AC/BT,MAAa,eAAe,EACzB,OAAO,EACN,YAAY,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;;;;;ACDT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2B,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACTA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,MAAM,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO;AAAE,CAAC,CAC5E;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAY,EAAE,OAAO;CACrB,UAAU,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;;ACDA,MAAMA,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACNA,kBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5EA,kBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;ACdA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CACP,WAAW,EAAE,OAAO;CACpB,QAAQ,EAAE,OAAO;CACjB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;;ACfA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,MAAM,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAU,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqB,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgB,EAAE,OAAO;CAC7B,OAAO,EAAE,OAAO;CAChB,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoB,EAAE,OAAO;CACjC,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO;CACnB,SAAS,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAM,EAAE,OAAO;EAAE,OAAO,EAAE,OAAO;EAAG,aAAa,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;;ACjED,MAAa,oBAAoB,EAAE,OAAO;CACxC,eAAe;CACf,YAAY,EAAE,OAAO;EACnB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;EAC9B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;;ACJD,MAAa,kBAAkB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO;EACjB,SAAS,EAAE,OAAO;EAGlB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAO,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQ,EAAE,OAAO;EACf,aAAa,EAAE,OAAO;EACtB,iBAAiB,EAAE,OAAO;EAC1B,MAAM,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAY,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAW,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;;ACGA,MAAM,aAAa,EAAE,OAAO;CAC1B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5B,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkB,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;;ACjBA,MAAa,mBAAmB,SAC9B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;CACnB,gBAAgB,EAAE,OAAO;CACzB,uBAAuB,EAAE,OAAO;CAChC,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgB,EAAE,OAAO;CACzB,kBAAkB,EAAE,OAAO;CAC3B,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAAS,EAAE,OAAO;CAClB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CACH;;;;ACNA,MAAa,kBAAkB,SAC7B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkB,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkB,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAO,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiB,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAI,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAI,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAI,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAI,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAI,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAI,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAI,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAI,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAI,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAI,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAI,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAI,YAAY,SAAS,YAAY,CAAC,CACtC,IAAI,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAI,YAAY,aAAa,WAAW,CAAC,CACzC,IAAI,YAAY,WAAW,aAAa,CAAC,CACzC,IAAI,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAI,YAAY,6BAA6B,qBAAqB;;;AClErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}