@keboola/api-client 39.0.0 → 40.0.0

package/dist/{configurations-CyFF9Dtu.cjs → configurations-BTRHVSRq.cjs}

@@ -3,18 +3,8 @@ const require_adminRoles = require("./adminRoles-CO7J5qAy.cjs");
 /**
 * @module domain/permissions/errors
 *
-* Stable error contract for permission denials.
-*
-* `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The
-* three public fields are part of the SDK's published contract — consumers
-* (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`
-* and surface `reason` in UI, so renames here are breaking changes.
-*
-* PII boundary on `subject`:
-*   `subject` is optional and intended for debugging hints only — admin id,
-*   role name, configuration id, branch id, etc. It MUST NOT carry the full
-*   `StorageToken`, raw tokens, secrets, or any value that could be logged or
-*   surfaced to a user without further redaction.
+* - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.
+* - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.
 */
 var PermissionDeniedError = class extends Error {
 	action;
@@ -37,34 +27,18 @@ const isProductionManager = (token) => role(token) === require_adminRoles.AdminR
 const isDeveloperOrReviewer = (token) => role(token) === require_adminRoles.AdminRole.Developer || role(token) === require_adminRoles.AdminRole.Reviewer;
 const isReadOnlyRole = (token) => role(token) === require_adminRoles.AdminRole.ReadOnly;
 /**
-* Whether a role string is a member of `AdminRole` at all — distinct from
-* whether it may do any particular thing. A role failing this check is not
-* "denied", it's *unrecognized*: either Storage started returning a role this
-* client has never heard of, or something upstream is sending garbage. Callers
-* that deny-by-default on every predicate here (the common case) still want to
-* know about this distinction, because it never shows up as a failed request —
-* a caller should log it loudly rather than treat it as routine.
+* Whether a role string is a member of `AdminRole` at all.
+*
+* - Failing it means *unrecognized*, not denied — log it loudly.
 */
 const isKnownAdminRole = (adminRole) => Object.values(require_adminRoles.AdminRole).includes(adminRole ?? "");
 /**
-* Whether an admin role may write Kai's **project-wide** settings (custom
-* instructions injected into every project member's system prompt).
+* Whether an admin role may write Kai's project-wide settings.
 *
-* `admin` and `share` only. The value is a shared prompt-injection surface, so
-* changing it counts as project administration rather than project work:
-* `productionManager` and `guest` are read-only for project management in kbc-ui,
-* and `developer`/`reviewer` are denied because `agent_settings` is keyed by
-* `project_id` alone — editing it "inside a dev branch" writes production-visible
-* global config.
-*
-* An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist
-* would admit each new one silently with no test failing. Takes the raw role
-* string so a caller holding an unparsed `tokens.verify()` response can use it
-* without fabricating a `StorageToken`. AI-3671.
-*
-* @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are
-* organization-admin only and use that predicate; do not widen this one to
-* cover them.
+* - `admin` and `share` only: a shared prompt-injection surface is project administration.
+* - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.
+* - An allowlist, so new upstream `AdminRole` members are denied by default.
+* - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.
 */
 const isKaiSettingsWriterRole = (adminRole) => {
 	switch (adminRole) {
@@ -74,10 +48,9 @@ const isKaiSettingsWriterRole = (adminRole) => {
 	}
 };
 /**
-* Whether this token may write Kai's project-wide settings. A limited
-* (non-master) token never may: it carries no project role at all, and its
-* `admin` block is absent despite the hand-authored type declaring it required
-* (AI-3593) — hence the optional chain.
+* Whether this token may write Kai's project-wide settings.
+*
+* - A limited (non-master) token never may; its `admin` block is absent despite the type.
 */
 const canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
 const assertCanWriteKaiSettings = (token) => {
@@ -87,20 +60,14 @@ const assertCanWriteKaiSettings = (token) => {
 	});
 };
 /**
-* Whether this token may write the project's semantic layer — models and their
-* datasets, metrics, relationships, glossary terms and constraints in the
-* metastore.
+* Whether this token may write the project's semantic layer in the metastore.
 *
-* - A denylist, unlike `isKaiSettingsWriterRole` above: the metastore's
-*   project-level ACL admits ordinary project work, so every role that can edit
-*   configurations can edit the model. Only `readOnly` is refused.
-* - A limited (non-master) token carries no project role and its `admin` block is
-*   absent (AI-3593) — hence the optional chain. It is not denied here: the
-*   metastore, not this client, decides what such a token may do.
-* - Organization-scope promotion is a separate, narrower right the metastore
-*   answers with a 403; surface that error rather than pre-empting it here.
+* - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):
+*   only a master token with the `admin` or `productionManager` role gets `project-admin`.
+* - Every other role, and a limited token (no `admin` block), gets a 403.
+* - Organization-scope promotion is left to the metastore's 403.
 */
-const canWriteSemanticLayer = (token) => token.admin?.role !== require_adminRoles.AdminRole.ReadOnly;
+const canWriteSemanticLayer = (token) => token.admin?.role === require_adminRoles.AdminRole.Admin || token.admin?.role === require_adminRoles.AdminRole.ProductionManager;
 const assertCanAdmin = (token) => {
 	if (!isAdmin(token)) throw new PermissionDeniedError({
 		action: "admin",
@@ -335,4 +302,4 @@ Object.defineProperty(exports, "isReadOnlyRole", {
 	}
 });
 
-//# sourceMappingURL=configurations-CyFF9Dtu.cjs.map
+//# sourceMappingURL=configurations-BTRHVSRq.cjs.map

package/dist/configurations-BTRHVSRq.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configurations-BTRHVSRq.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin` or `productionManager` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * - Dev branch → developer or reviewer; production → production manager.\n * - Purge is admin-only in any branch mode; its `ctx` is ignored.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` on any branch other than the default (`isDefault`) one.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACRA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAASA,mBAAAA,UAAU,SAAS,MAAM,OAAO,SAASA,mBAAAA,UAAU;AAE3E,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;AC/FA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/{configurations-BVvcimzo.js → configurations-Chg_JwJ1.js}

@@ -3,18 +3,8 @@ import { t as AdminRole } from "./adminRoles-B40yBcmq.js";
 /**
 * @module domain/permissions/errors
 *
-* Stable error contract for permission denials.
-*
-* `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The
-* three public fields are part of the SDK's published contract — consumers
-* (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`
-* and surface `reason` in UI, so renames here are breaking changes.
-*
-* PII boundary on `subject`:
-*   `subject` is optional and intended for debugging hints only — admin id,
-*   role name, configuration id, branch id, etc. It MUST NOT carry the full
-*   `StorageToken`, raw tokens, secrets, or any value that could be logged or
-*   surfaced to a user without further redaction.
+* - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.
+* - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.
 */
 var PermissionDeniedError = class extends Error {
 	action;
@@ -37,34 +27,18 @@ const isProductionManager = (token) => role(token) === AdminRole.ProductionManag
 const isDeveloperOrReviewer = (token) => role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;
 const isReadOnlyRole = (token) => role(token) === AdminRole.ReadOnly;
 /**
-* Whether a role string is a member of `AdminRole` at all — distinct from
-* whether it may do any particular thing. A role failing this check is not
-* "denied", it's *unrecognized*: either Storage started returning a role this
-* client has never heard of, or something upstream is sending garbage. Callers
-* that deny-by-default on every predicate here (the common case) still want to
-* know about this distinction, because it never shows up as a failed request —
-* a caller should log it loudly rather than treat it as routine.
+* Whether a role string is a member of `AdminRole` at all.
+*
+* - Failing it means *unrecognized*, not denied — log it loudly.
 */
 const isKnownAdminRole = (adminRole) => Object.values(AdminRole).includes(adminRole ?? "");
 /**
-* Whether an admin role may write Kai's **project-wide** settings (custom
-* instructions injected into every project member's system prompt).
+* Whether an admin role may write Kai's project-wide settings.
 *
-* `admin` and `share` only. The value is a shared prompt-injection surface, so
-* changing it counts as project administration rather than project work:
-* `productionManager` and `guest` are read-only for project management in kbc-ui,
-* and `developer`/`reviewer` are denied because `agent_settings` is keyed by
-* `project_id` alone — editing it "inside a dev branch" writes production-visible
-* global config.
-*
-* An allowlist, deliberately: `AdminRole` gains members upstream, and a denylist
-* would admit each new one silently with no test failing. Takes the raw role
-* string so a caller holding an unparsed `tokens.verify()` response can use it
-* without fabricating a `StorageToken`. AI-3671.
-*
-* @see ./organization#canWriteKaiSpendCaps — spend caps (AI-3738) are
-* organization-admin only and use that predicate; do not widen this one to
-* cover them.
+* - `admin` and `share` only: a shared prompt-injection surface is project administration.
+* - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.
+* - An allowlist, so new upstream `AdminRole` members are denied by default.
+* - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.
 */
 const isKaiSettingsWriterRole = (adminRole) => {
 	switch (adminRole) {
@@ -74,10 +48,9 @@ const isKaiSettingsWriterRole = (adminRole) => {
 	}
 };
 /**
-* Whether this token may write Kai's project-wide settings. A limited
-* (non-master) token never may: it carries no project role at all, and its
-* `admin` block is absent despite the hand-authored type declaring it required
-* (AI-3593) — hence the optional chain.
+* Whether this token may write Kai's project-wide settings.
+*
+* - A limited (non-master) token never may; its `admin` block is absent despite the type.
 */
 const canWriteKaiSettings = (token) => token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);
 const assertCanWriteKaiSettings = (token) => {
@@ -87,20 +60,14 @@ const assertCanWriteKaiSettings = (token) => {
 	});
 };
 /**
-* Whether this token may write the project's semantic layer — models and their
-* datasets, metrics, relationships, glossary terms and constraints in the
-* metastore.
+* Whether this token may write the project's semantic layer in the metastore.
 *
-* - A denylist, unlike `isKaiSettingsWriterRole` above: the metastore's
-*   project-level ACL admits ordinary project work, so every role that can edit
-*   configurations can edit the model. Only `readOnly` is refused.
-* - A limited (non-master) token carries no project role and its `admin` block is
-*   absent (AI-3593) — hence the optional chain. It is not denied here: the
-*   metastore, not this client, decides what such a token may do.
-* - Organization-scope promotion is a separate, narrower right the metastore
-*   answers with a 403; surface that error rather than pre-empting it here.
+* - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):
+*   only a master token with the `admin` or `productionManager` role gets `project-admin`.
+* - Every other role, and a limited token (no `admin` block), gets a 403.
+* - Organization-scope promotion is left to the metastore's 403.
 */
-const canWriteSemanticLayer = (token) => token.admin?.role !== AdminRole.ReadOnly;
+const canWriteSemanticLayer = (token) => token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;
 const assertCanAdmin = (token) => {
 	if (!isAdmin(token)) throw new PermissionDeniedError({
 		action: "admin",
@@ -174,4 +141,4 @@ const assertCanAssignFolder = (token, ctx) => {
 //#endregion
 export { isKaiSettingsWriterRole as C, PermissionDeniedError as D, isReadOnlyRole as E, isDeveloperOrReviewer as S, isProductionManager as T, assertCanWriteKaiSettings as _, assertCanPurgeConfiguration as a, isAdmin as b, canCopyConfiguration as c, canPurgeConfiguration as d, canUpdateConfiguration as f, assertCanProductionManage as g, assertCanDevelopOrReview as h, assertCanMigrateFromTemplate as i, canCreateConfiguration as l, assertCanAdminOrShare as m, assertCanCopyConfiguration as n, assertCanUpdateConfiguration as o, assertCanAdmin as p, assertCanCreateConfiguration as r, canAssignFolder as s, assertCanAssignFolder as t, canMigrateFromTemplate as u, canWriteKaiSettings as v, isKnownAdminRole as w, isAdminOrShare as x, canWriteSemanticLayer as y };
 
-//# sourceMappingURL=configurations-BVvcimzo.js.map
+//# sourceMappingURL=configurations-Chg_JwJ1.js.map

package/dist/configurations-Chg_JwJ1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configurations-Chg_JwJ1.js","names":[],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin` or `productionManager` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * - Dev branch → developer or reviewer; production → production manager.\n * - Purge is admin-only in any branch mode; its `ctx` is ignored.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` on any branch other than the default (`isDefault`) one.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACRA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAM,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,MAAM,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAM,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK,MAAM,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAM,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAO,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAK,UAAU;EACf,KAAK,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAAS,UAAU,SAAS,MAAM,OAAO,SAAS,UAAU;AAE3E,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;AC/FA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/{configurations-zkNjr73Q.cjs → configurations-IYyOvhI3.cjs}

@@ -1,6 +1,6 @@
 const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_configurations = require("./configurations-CyFF9Dtu.cjs");
-const require_componentId = require("./componentId-DkyQ8PM0.cjs");
+const require_configurations = require("./configurations-BTRHVSRq.cjs");
+const require_componentId = require("./componentId-57vjsa2i.cjs");
 let zod = require("zod");
 //#region src/utils/isEmptyDeep.ts
 /**
@@ -22,19 +22,13 @@ const isEmptyDeep = (value) => {
 /** Strip optional/nullable/default wrappers to reach the structural schema node. */
 const unwrap = (schema) => schema instanceof zod.z.ZodOptional || schema instanceof zod.z.ZodNullable || schema instanceof zod.z.ZodDefault ? unwrap(schema.unwrap()) : schema;
 /**
-* Merge `patch` into `base`, guided by `schema`: descend only through object schemas, merging
-* key-by-key. At every non-object node — a `z.union` (e.g. Snowflake's password|keypair auth),
-* an array, or a primitive — the patch REPLACES the base wholesale. That replace is what lets an
-* update *delete* keys the additive `deepMerge` cannot: switching a credential union to the other
-* variant drops the abandoned variant's secret, because the entire union subtree is swapped.
+* Merge `patch` into `base`, descending only through object schemas.
 *
-* Consequence: a union (or array) subtree is all-or-nothing — the caller must send the complete
-* block, since a partial patch replaces (and so loses) the omitted siblings.
-*
-* Object keys present only in `base` (e.g. `storage`, `processors`, anything the schema omits) are
-* preserved at every level; `undefined` patch values are skipped. Assumes `patch` is already
-* schema-validated (so every object-valued patch key has a matching schema node). Pure — neither
-* argument is mutated.
+* - At a non-object node (union, array, primitive) the patch replaces the base wholesale, so
+*   switching a union variant drops the old variant's secret.
+* - Hence a union or array subtree is all-or-nothing: send the complete block.
+* - Keys only in `base` are kept; `undefined` patch values are skipped.
+* - Assumes `patch` is schema-validated. Pure.
 */
 const schemaGuidedMerge = (schema, base, patch) => {
 	const node = unwrap(schema);
@@ -243,13 +237,10 @@ const exHttpSchema = zod.z.object({ parameters: zod.z.object({
 //#endregion
 //#region src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts
 /**
-* Default extractor credentials — host/port/user/#password/database + optional SSH tunnel, the
-* same `parameters.db` block the writers use. Tunnel support mirrors kbc-ui's `hasSshTunnel` /
-* `hasSsl` (`apps/kbc-ui/src/scripts/modules/ex-db-generic/helpers.ts`): most drivers accept an
-* SSH tunnel, only pgsql/mysql/mssql also accept SSL, and a handful accept neither. This shared
-* schema covers the generic SSH-only drivers: redshift, db2(-bata), mssql-cdata, impala,
-* hive(-csas, -csas-test). SSL-capable pgsql and the tunnel-less progress-db get their own
-* schema, as do drivers with extra/renamed fields.
+* Default extractor credentials with an optional SSH tunnel, for the generic SSH-only drivers.
+*
+* - Keep in sync with kbc-ui's `hasSshTunnel` / `hasSsl` (`ex-db-generic/helpers.ts`).
+* - SSL-capable, tunnel-less and extra-field drivers get their own schema.
 */
 const exDbDefaultSchema = dbConfig(dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }));
 //#endregion
@@ -445,6 +436,7 @@ const exGoogleAdsSchema = zod.z.object({
 	parameters: zod.z.object({
 		customerId: zod.z.array(zod.z.string()),
 		onlyEnabledCustomers: zod.z.boolean().optional(),
+		continueOnFailure: zod.z.boolean().optional(),
 		getAccountChildren: zod.z.boolean().optional()
 	})
 });
@@ -740,4 +732,4 @@ Object.defineProperty(exports, "schemaGuidedMerge", {
 	}
 });
 
-//# sourceMappingURL=configurations-zkNjr73Q.cjs.map
+//# sourceMappingURL=configurations-IYyOvhI3.cjs.map

package/dist/configurations-IYyOvhI3.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"configurations-IYyOvhI3.cjs","names":["isPlainObject","z","isPlainObject","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","snowflakeCommon","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","ComponentId"],"sources":["../src/utils/isEmptyDeep.ts","../src/utils/schemaGuidedMerge.ts","../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../src/sdks/configurations/schemas/common/dbConfig.ts","../src/sdks/configurations/schemas/common/dbConnection.ts","../src/sdks/configurations/schemas/common/forbidden.ts","../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../src/sdks/configurations/schemas/common/sslSchema.ts","../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../src/sdks/configurations/schemas/googleAdsSchema.ts","../src/sdks/configurations/schemas/schedulerSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../src/sdks/configurations/createRegistry/createRegistry.ts","../src/sdks/configurations/registry.ts","../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { isPlainObject } from './isPlainObject';\n\n/**\n * Is `value` \"deeply empty\" — i.e. carries no leaf data? `null`/`undefined`, `{}`, `[]`, and\n * nested structures whose every leaf is itself empty (e.g. `{ parameters: {} }`) are empty.\n * Any present primitive (string, number, boolean — including `''`) counts as content.\n *\n * Used to skip a pointless encryption round-trip when a validated configuration has nothing\n * to encrypt.\n */\nexport const isEmptyDeep = (value: unknown): boolean => {\n  if (value == null) return true;\n  if (Array.isArray(value)) return value.every(isEmptyDeep);\n  if (isPlainObject(value)) return Object.values(value).every(isEmptyDeep);\n  return false;\n};\n","import { z } from 'zod';\n\nimport { isPlainObject } from './isPlainObject';\n\n/** Strip optional/nullable/default wrappers to reach the structural schema node. */\nconst unwrap = (schema: z.core.$ZodType): z.core.$ZodType =>\n  schema instanceof z.ZodOptional ||\n  schema instanceof z.ZodNullable ||\n  schema instanceof z.ZodDefault\n    ? unwrap(schema.unwrap())\n    : schema;\n\n/**\n * Merge `patch` into `base`, descending only through object schemas.\n *\n * - At a non-object node (union, array, primitive) the patch replaces the base wholesale, so\n *   switching a union variant drops the old variant's secret.\n * - Hence a union or array subtree is all-or-nothing: send the complete block.\n * - Keys only in `base` are kept; `undefined` patch values are skipped.\n * - Assumes `patch` is schema-validated. Pure.\n */\nexport const schemaGuidedMerge = <T extends Record<string, unknown>>(\n  schema: z.core.$ZodType,\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const node = unwrap(schema);\n  if (!(node instanceof z.ZodObject) || !isPlainObject(base)) return patch as T;\n\n  const out: Record<string, unknown> = { ...base };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const child = node.shape[key];\n    const current = out[key];\n    out[key] =\n      child && isPlainObject(current) && isPlainObject(value)\n        ? schemaGuidedMerge(child, current, value)\n        : value;\n  }\n\n  return out as T;\n};\n","import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials with an optional SSH tunnel, for the generic SSH-only drivers.\n *\n * - Keep in sync with kbc-ui's `hasSshTunnel` / `hasSsl` (`ex-db-generic/helpers.ts`).\n * - SSL-capable, tunnel-less and extra-field drivers get their own schema.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    continueOnFailure: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { createDefaultBranch } from '../../domain/defaultBranch';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are\n *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.\n * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,\n *   e.g. `storage`, is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,eAAe,UAA4B;CACtD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,MAAM,WAAW;CACxD,IAAIA,sBAAAA,cAAc,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,WAAW;CACvE,OAAO;AACT;;;;ACVA,MAAM,UAAU,WACd,kBAAkBC,IAAAA,EAAE,eACpB,kBAAkBA,IAAAA,EAAE,eACpB,kBAAkBA,IAAAA,EAAE,aAChB,OAAO,OAAO,OAAO,CAAC,IACtB;;;;;;;;;;AAWN,MAAa,qBACX,QACA,MACA,UACM;CACN,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,EAAE,gBAAgBA,IAAAA,EAAE,cAAc,CAACC,sBAAAA,cAAc,IAAI,GAAG,OAAO;CAEnE,MAAM,MAA+B,EAAE,GAAG,KAAK;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OACF,SAASA,sBAAAA,cAAc,OAAO,KAAKA,sBAAAA,cAAc,KAAK,IAClD,kBAAkB,OAAO,SAAS,KAAK,IACvC;CACR;CAEA,OAAO;AACT;;;;;;;;AClCA,MAAa,uBAAuBC,IAAAA,EAAE,OAAO,EAC3C,YAAYA,IAAAA,EAAE,OAAO,EACnB,IAAIA,IAAAA,EAAE,OAAO,EACX,aAAaA,IAAAA,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;;ACVD,MAAa,YAAkC,OAC7CC,IAAAA,EAAE,OAAO,EAAE,YAAYA,IAAAA,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;;ACI3C,MAAa,qBAAqBC,IAAAA,EAAE,OAAO;CACzC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;;ACLD,MAAa,YAAYC,IAAAA,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;;ACFhD,MAAa,2BAA2BC,IAAAA,EAAE,OAAO,EAC/C,WAAWA,IAAAA,EAAE,OAAO;CAClB,IAAIA,IAAAA,EAAE,OAAO;CACb,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;;ACVD,MAAa,kBAAkBC,IAAAA,EAAE,OAAO;CACtC,SAASA,IAAAA,EAAE,QAAQ;CACnB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAMA,IAAAA,EACH,OAAO;EACN,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;ACZD,MAAa,YAAYC,IAAAA,EAAE,OAAO;CAChC,SAASA,IAAAA,EAAE,QAAQ;CACnB,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;;ACAD,MAAM,gBAAgBC,IAAAA,EAAE,OAAO;CAC7B,aAAaA,IAAAA,EAAE,OAAO;CACtB,aAAaA,IAAAA,EAAE,OAAO;CACtB,iBAAiBA,IAAAA,EAAE,OAAO;CAC1B,WAAWA,IAAAA,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+BA,IAAAA,EAAE,OAAO,EACnD,YAAYA,IAAAA,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoBA,IAAAA,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuBA,IAAAA,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;;ACfD,MAAM,qBAAqBC,IAAAA,EACxB,OAAO;CACN,WAAWA,IAAAA,EAAE,QAAQ,aAAa;CAClC,aAAaA,IAAAA,EAAE,OAAO;CACtB,oBAAoBA,IAAAA,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAcA,IAAAA,EACjB,OAAO;CACN,WAAWA,IAAAA,EAAE,QAAQ,MAAM;CAC3B,WAAWA,IAAAA,EAAE,OAAO;CACpB,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgBA,IAAAA,EAC1B,OAAO,EACN,YAAYA,IAAAA,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;;AChCT,MAAa,oBAAoBC,IAAAA,EAC9B,OAAO,EACN,YAAYA,IAAAA,EACT,OAAO;CACN,cAAcA,IAAAA,EAAE,OAAO;CACvB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,gBAAgBA,IAAAA,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;;ACVT,MAAa,wBAAwBC,IAAAA,EAClC,OAAO,EACN,YAAYA,IAAAA,EACT,OAAO;CACN,cAAcA,IAAAA,EAAE,OAAO;CACvB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;ACZT,MAAM,gBAAgBC,IAAAA,EAAE,OAAO;CAC7B,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,gBAAgBA,IAAAA,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAUA,IAAAA,EAAE,OAAO;CACnB,sBAAsBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAcA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAeA,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAcA,IAAAA,EACxB,OAAO,EACN,YAAYA,IAAAA,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;;AC/BT,MAAa,eAAeC,IAAAA,EACzB,OAAO,EACN,YAAYA,IAAAA,EAAE,OAAO;CAAE,SAASA,IAAAA,EAAE,OAAO;CAAG,cAAcA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;;ACJT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;;ACPA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2BA,IAAAA,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAMC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAMC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACTA,MAAa,qBAAqB,SAChCC,IAAAA,EAAE,OAAO;CAAE,QAAQA,IAAAA,EAAE,OAAO;CAAG,MAAMA,IAAAA,EAAE,OAAO;CAAG,aAAaA,IAAAA,EAAE,OAAO;AAAE,CAAC,CAC5E;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAYC,IAAAA,EAAE,OAAO;CACrB,UAAUA,IAAAA,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;;ACDA,MAAMC,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,MAAM,CACND,kBAAgB,OAAO;CAAE,aAAaC,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5ED,kBAAgB,OAAO;CAAE,eAAeC,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;ACdA,MAAa,qBAAqB,SAChCC,IAAAA,EAAE,OAAO;CACP,WAAWA,IAAAA,EAAE,OAAO;CACpB,QAAQA,IAAAA,EAAE,OAAO;CACjB,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,oBAAoBA,IAAAA,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAYA,IAAAA,EAAE,OAAO;CACrB,SAASA,IAAAA,EAAE,OAAO;CAClB,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;;ACfA,MAAM,iBAAiBC,IAAAA,EAAE,OAAO;CAC9B,MAAMA,IAAAA,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAUA,IAAAA,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAcA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAWA,IAAAA,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAeA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgBA,IAAAA,EAAE,OAAO;CAC7B,OAAOA,IAAAA,EAAE,OAAO;CAChB,UAAUA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAASA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoBA,IAAAA,EAAE,OAAO;CACjC,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAaA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuBA,IAAAA,EAAE,OAAO,EAC3C,YAAYA,IAAAA,EAAE,OAAO;CACnB,SAASA,IAAAA,EAAE,OAAO;EAAE,KAAKA,IAAAA,EAAE,OAAO;EAAG,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAMA,IAAAA,EAAE,OAAO;EAAE,OAAOA,IAAAA,EAAE,OAAO;EAAG,aAAaA,IAAAA,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAUA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAWA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAYA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;;ACjED,MAAa,oBAAoBC,IAAAA,EAAE,OAAO;CACxC,eAAe;CACf,YAAYA,IAAAA,EAAE,OAAO;EACnB,YAAYA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC;EAC9B,sBAAsBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,mBAAmBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EACxC,oBAAoBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;;ACLD,MAAa,kBAAkBC,IAAAA,EAAE,OAAO;CACtC,UAAUA,IAAAA,EAAE,OAAO;EACjB,SAASA,IAAAA,EAAE,OAAO;EAGlB,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAOA,IAAAA,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQA,IAAAA,EAAE,OAAO;EACf,aAAaA,IAAAA,EAAE,OAAO;EACtB,iBAAiBA,IAAAA,EAAE,OAAO;EAC1B,MAAMA,IAAAA,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAAA,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAWC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;;ACGA,MAAM,aAAaC,IAAAA,EAAE,OAAO;CAC1B,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,QAAQA,IAAAA,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5BA,IAAAA,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,kBAAkBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkBA,IAAAA,EAAE,OAAO;CAAG,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;;ACjBA,MAAa,mBAAmB,SAC9BC,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;CACtB,UAAUA,IAAAA,EAAE,OAAO;CACnB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,uBAAuBA,IAAAA,EAAE,OAAO;CAChC,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgBC,IAAAA,EAAE,OAAO;CACzB,kBAAkBA,IAAAA,EAAE,OAAO;CAC3B,QAAQA,IAAAA,EAAE,OAAO;CACjB,WAAWA,IAAAA,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAASA,IAAAA,EAAE,OAAO;CAClB,gBAAgBA,IAAAA,EAAE,OAAO;AAC3B,CAAC,CACH;;;;ACNA,MAAa,kBAAkB,SAC7BC,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAaA,IAAAA,EAAE,OAAO;CACtB,UAAUA,IAAAA,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAeA,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkBC,IAAAA,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkBA,IAAAA,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAOA,IAAAA,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiBA,IAAAA,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAUA,IAAAA,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAIC,oBAAAA,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAIA,oBAAAA,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAIA,oBAAAA,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAIA,oBAAAA,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAIA,oBAAAA,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAIA,oBAAAA,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAIA,oBAAAA,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAIA,oBAAAA,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAIA,oBAAAA,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAIA,oBAAAA,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAIA,oBAAAA,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAIA,oBAAAA,YAAY,SAAS,YAAY,CAAC,CACtC,IAAIA,oBAAAA,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAIA,oBAAAA,YAAY,aAAa,WAAW,CAAC,CACzC,IAAIA,oBAAAA,YAAY,WAAW,aAAa,CAAC,CACzC,IAAIA,oBAAAA,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAIA,oBAAAA,YAAY,6BAA6B,qBAAqB;;;ACrErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,uBAAA,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,uBAAA,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}

package/dist/constants/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_constants = require("../constants-C6xku_Vx.cjs");
 const require_adminRoles = require("../adminRoles-CO7J5qAy.cjs");
-const require_componentId = require("../componentId-DkyQ8PM0.cjs");
+const require_componentId = require("../componentId-57vjsa2i.cjs");
 exports.AdminRole = require_adminRoles.AdminRole;
 exports.Backend = require_constants.Backend;
 exports.ComponentId = require_componentId.ComponentId;

package/dist/constants/index.d.cts

@@ -1,5 +1,5 @@
 import { t as ServiceId } from "../serviceIds-DC-H6ZD9.cjs";
 import { t as AdminRole } from "../adminRoles-C696kD_U.cjs";
 import { t as Backend } from "../backends-DKBz5OxE.cjs";
-import { a as STACKS, i as Provider, n as Continent, o as ProjectFeature, r as KeboolaStack, s as ComponentId, t as URLS } from "../index-DBklbaTp.cjs";
+import { a as STACKS, i as Provider, n as Continent, o as ProjectFeature, r as KeboolaStack, s as ComponentId, t as URLS } from "../index-C8gRRWHL.cjs";
 export { AdminRole, Backend, ComponentId, Continent, type KeboolaStack, ProjectFeature, Provider, STACKS, ServiceId, URLS };

package/dist/constants/index.d.ts

@@ -1,5 +1,5 @@
 import { t as ServiceId } from "../serviceIds-DC-H6ZD9.js";
 import { t as AdminRole } from "../adminRoles-C696kD_U.js";
 import { t as Backend } from "../backends-DKBz5OxE.js";
-import { a as STACKS, i as Provider, n as Continent, o as ProjectFeature, r as KeboolaStack, s as ComponentId, t as URLS } from "../index-DBklbaTp.js";
+import { a as STACKS, i as Provider, n as Continent, o as ProjectFeature, r as KeboolaStack, s as ComponentId, t as URLS } from "../index-C8gRRWHL.js";
 export { AdminRole, Backend, ComponentId, Continent, type KeboolaStack, ProjectFeature, Provider, STACKS, ServiceId, URLS };

package/dist/constants/index.js

@@ -1,4 +1,4 @@
 import { a as ServiceId, i as STACKS, n as Continent, o as Backend, r as Provider, s as ProjectFeature, t as URLS } from "../constants-C2tYAJSj.js";
 import { t as AdminRole } from "../adminRoles-B40yBcmq.js";
-import { t as ComponentId } from "../componentId-vJz-kWs6.js";
+import { t as ComponentId } from "../componentId-C6WZa_R1.js";
 export { AdminRole, Backend, ComponentId, Continent, ProjectFeature, Provider, STACKS, ServiceId, URLS };

package/dist/{createFetchClient-BlgPbjFj.cjs → createFetchClient-Cwp8max9.cjs}

@@ -32,7 +32,9 @@ const KeboolaHttpHeader = {
 	STORAGE_API_URL: "x-storageapi-url",
 	PROJECT_ID: "X-KBC-ProjectId",
 	/** Storage job a request enqueued, reported on the response rather than in its body. */
-	STORAGE_API_JOB_ID: "X-StorageApi-Job-Id"
+	STORAGE_API_JOB_ID: "X-StorageApi-Job-Id",
+	/** Set to "1" to opt an auth call into browser/cookie mode. */
+	CSRF: "X-KBC-CSRF"
 };
 const HttpStatus = {
 	NO_CONTENT: 204,
@@ -195,14 +197,19 @@ const coreFetch = async ({ request, validateStatus, fetchFn = fetch, parseAs })
 	if (!boolOrError) throw new ApiError(apiResponse);
 	return apiResponse;
 };
-const createFetchClient = ({ middlewares = [], ...defaultOptions }) => {
+const createFetchClient = ({ middlewares = [], baseUrl: _baseUrl, ...defaultOptions }) => {
 	const fetchWithMiddlewares = middlewares.reduceRight((next, middleware) => middleware(next), coreFetch);
+	const resolveBaseUrl = async () => typeof _baseUrl === "function" ? _baseUrl() : _baseUrl;
 	const createFetchMethod = (method) => async (url, params, options = {}) => {
+		const baseUrl = await resolveBaseUrl();
 		const request = createFetchRequest({
 			url,
 			method,
 			params,
-			defaultOptions,
+			defaultOptions: {
+				...defaultOptions,
+				baseUrl
+			},
 			options
 		});
 		return (options?.middlewares ?? []).reduceRight((next, middleware) => middleware(next), fetchWithMiddlewares)(request);
@@ -313,4 +320,4 @@ Object.defineProperty(exports, "parseContentDispositionHeader", {
 	}
 });
 
-//# sourceMappingURL=createFetchClient-BlgPbjFj.cjs.map
+//# sourceMappingURL=createFetchClient-Cwp8max9.cjs.map