@keboola/api-client 4.0.0 → 6.0.0

package/dist/dataScience/index.cjs

@@ -1,17 +1,19 @@
 'use strict';
 
-var chunkRTD3XWBM_cjs = require('../chunk-RTD3XWBM.cjs');
-require('../chunk-MTFRH3R5.cjs');
+var chunkCFRR7QPR_cjs = require('../chunk-CFRR7QPR.cjs');
+require('../chunk-MRHQJNWF.cjs');
+require('../chunk-IDYRJ4K3.cjs');
+require('../chunk-R7MQGDLC.cjs');
 
 
 
 Object.defineProperty(exports, "createDataScienceClient", {
   enumerable: true,
-  get: function () { return chunkRTD3XWBM_cjs.createDataScienceClient; }
+  get: function () { return chunkCFRR7QPR_cjs.createDataScienceClient; }
 });
 Object.defineProperty(exports, "parseLogLines", {
   enumerable: true,
-  get: function () { return chunkRTD3XWBM_cjs.parseLogLines; }
+  get: function () { return chunkCFRR7QPR_cjs.parseLogLines; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/dataScience/index.d.cts

@@ -1,10 +1,10 @@
-import { C as ClientInitOptions, A as ApiResponse } from '../types-Bom8wyth.cjs';
-import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath } from '../utils-DE09pDTi.cjs';
-export { p as parseLogLines } from '../utils-DE09pDTi.cjs';
+import { C as ClientInitOptions, A as ApiResponse } from '../types-DxJD6LIN.cjs';
+import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath } from '../utils-JsCYFmHj.cjs';
+export { p as parseLogLines } from '../utils-JsCYFmHj.cjs';
 import 'qs';
-import '../types-C7mpAfq-.cjs';
+import '../types-jKnx7Tm_.cjs';
 
-declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOptions) => {
+declare const createDataScienceClient: ({ baseUrl, middlewares, token }: ClientInitOptions) => {
     getAppRuns: (appId: GetDataAppRunsPath["appId"], query?: GetDataAppRunsQuery, signal?: AbortSignal) => Promise<{
         state: "failed" | "starting" | "running" | "finished";
         id: string;
@@ -15,6 +15,11 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         startupLogs?: string | null;
         runtimeSize?: string | null;
         configVersion?: string | null;
+        failureReason?: {
+            reason?: string | null;
+            message?: string | null;
+        } | null;
+        mode: "prod" | "dev";
     }[]>;
     getAppRun: (appId: GetDataAppRunPath["appId"], runId: GetDataAppRunPath["runId"], signal?: AbortSignal) => Promise<{
         state: "failed" | "starting" | "running" | "finished";
@@ -26,6 +31,11 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         startupLogs?: string | null;
         runtimeSize?: string | null;
         configVersion?: string | null;
+        failureReason?: {
+            reason?: string | null;
+            message?: string | null;
+        } | null;
+        mode: "prod" | "dev";
     }>;
     getAppLogsDownload: (id: GetDataAppLogsDownloadPath["appId"], signal?: AbortSignal) => Promise<{
         logs: string;
@@ -48,6 +58,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -55,6 +66,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }[]>;
     getApp: (appId: GetDataAppPath["appId"], signal?: AbortSignal) => Promise<{
         id: string;
@@ -66,6 +78,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -73,6 +86,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }>;
     createApp: (body: CreateDataAppBody, signal?: AbortSignal) => Promise<{
         id: string;
@@ -84,6 +98,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -91,6 +106,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }>;
     patchApp: (appId: PatchDataAppPath["appId"], body: PatchDataAppBody, signal?: AbortSignal) => Promise<{
         id: string;
@@ -102,6 +118,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -109,8 +126,9 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }>;
-    deleteApp: (appId: DeleteDataAppPath["appId"], signal?: AbortSignal) => Promise<ApiResponse<unknown>>;
+    deleteApp: (appId: DeleteDataAppPath["appId"], signal?: AbortSignal) => Promise<ApiResponse<never>>;
     getAppPassword: (appId: GetDataAppPasswordPath["appId"], signal?: AbortSignal) => Promise<{
         password?: string;
     }>;
@@ -124,6 +142,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -131,6 +150,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }>;
     getRuntimes: (signal?: AbortSignal) => Promise<{
         description: string;

package/dist/dataScience/index.d.ts

@@ -1,10 +1,10 @@
-import { C as ClientInitOptions, A as ApiResponse } from '../types-Bom8wyth.js';
-import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath } from '../utils-BNQZiNOu.js';
-export { p as parseLogLines } from '../utils-BNQZiNOu.js';
+import { C as ClientInitOptions, A as ApiResponse } from '../types-DxJD6LIN.js';
+import { G as GetDataAppRunsPath, a as GetDataAppRunsQuery, b as GetDataAppRunPath, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, L as LogEntry, f as GetAppsQuery, g as GetDataAppPath, C as CreateDataAppBody, P as PatchDataAppPath, h as PatchDataAppBody, D as DeleteDataAppPath, i as GetDataAppPasswordPath, R as ResetDataAppPasswordPath, j as GetSandboxPath } from '../utils-Cl4emy8g.js';
+export { p as parseLogLines } from '../utils-Cl4emy8g.js';
 import 'qs';
-import '../types-C7mpAfq-.js';
+import '../types-jKnx7Tm_.js';
 
-declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOptions) => {
+declare const createDataScienceClient: ({ baseUrl, middlewares, token }: ClientInitOptions) => {
     getAppRuns: (appId: GetDataAppRunsPath["appId"], query?: GetDataAppRunsQuery, signal?: AbortSignal) => Promise<{
         state: "failed" | "starting" | "running" | "finished";
         id: string;
@@ -15,6 +15,11 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         startupLogs?: string | null;
         runtimeSize?: string | null;
         configVersion?: string | null;
+        failureReason?: {
+            reason?: string | null;
+            message?: string | null;
+        } | null;
+        mode: "prod" | "dev";
     }[]>;
     getAppRun: (appId: GetDataAppRunPath["appId"], runId: GetDataAppRunPath["runId"], signal?: AbortSignal) => Promise<{
         state: "failed" | "starting" | "running" | "finished";
@@ -26,6 +31,11 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         startupLogs?: string | null;
         runtimeSize?: string | null;
         configVersion?: string | null;
+        failureReason?: {
+            reason?: string | null;
+            message?: string | null;
+        } | null;
+        mode: "prod" | "dev";
     }>;
     getAppLogsDownload: (id: GetDataAppLogsDownloadPath["appId"], signal?: AbortSignal) => Promise<{
         logs: string;
@@ -48,6 +58,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -55,6 +66,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }[]>;
     getApp: (appId: GetDataAppPath["appId"], signal?: AbortSignal) => Promise<{
         id: string;
@@ -66,6 +78,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -73,6 +86,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }>;
     createApp: (body: CreateDataAppBody, signal?: AbortSignal) => Promise<{
         id: string;
@@ -84,6 +98,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -91,6 +106,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }>;
     patchApp: (appId: PatchDataAppPath["appId"], body: PatchDataAppBody, signal?: AbortSignal) => Promise<{
         id: string;
@@ -102,6 +118,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -109,8 +126,9 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }>;
-    deleteApp: (appId: DeleteDataAppPath["appId"], signal?: AbortSignal) => Promise<ApiResponse<unknown>>;
+    deleteApp: (appId: DeleteDataAppPath["appId"], signal?: AbortSignal) => Promise<ApiResponse<never>>;
     getAppPassword: (appId: GetDataAppPasswordPath["appId"], signal?: AbortSignal) => Promise<{
         password?: string;
     }>;
@@ -124,6 +142,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         configVersion: string;
         state: "created" | "starting" | "restarting" | "running" | "stopping" | "stopped" | "deleting" | "deleted";
         desiredState: "running" | "stopped" | "deleted";
+        mode: "prod" | "dev";
         lastRequestTimestamp: string | null;
         lastStartTimestamp?: string | null;
         url?: string | null;
@@ -131,6 +150,7 @@ declare const createDataScienceClient: ({ baseUrl, middlewares }: ClientInitOpti
         autoRestartEnabled?: boolean;
         size?: string | null;
         provisioningStrategy: "jobQueue" | "operator";
+        hasManagedGitRepo?: boolean;
     }>;
     getRuntimes: (signal?: AbortSignal) => Promise<{
         description: string;

package/dist/dataScience/index.js

@@ -1,4 +1,6 @@
-export { createDataScienceClient, parseLogLines } from '../chunk-RBGTWJ7G.js';
-import '../chunk-QXWPUKK2.js';
+export { createDataScienceClient, parseLogLines } from '../chunk-54N7LIDM.js';
+import '../chunk-MSI6FVGG.js';
+import '../chunk-D2SWTZFS.js';
+import '../chunk-SI5TFV5M.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/dataScience/types.d.cts

@@ -1,2 +1,2 @@
-import '../types-C7mpAfq-.cjs';
-export { C as CreateDataAppBody, k as DataApp, l as DataAppRun, D as DeleteDataAppPath, f as GetAppsQuery, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, i as GetDataAppPasswordPath, g as GetDataAppPath, b as GetDataAppRunPath, G as GetDataAppRunsPath, a as GetDataAppRunsQuery, j as GetSandboxPath, L as LogEntry, h as PatchDataAppBody, P as PatchDataAppPath, m as RawAppRun, R as ResetDataAppPasswordPath, n as Runtime, o as RuntimeImageKey, S as Sandbox } from '../utils-DE09pDTi.cjs';
+import '../types-jKnx7Tm_.cjs';
+export { C as CreateDataAppBody, k as DataApp, l as DataAppRun, D as DeleteDataAppPath, f as GetAppsQuery, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, i as GetDataAppPasswordPath, g as GetDataAppPath, b as GetDataAppRunPath, G as GetDataAppRunsPath, a as GetDataAppRunsQuery, j as GetSandboxPath, L as LogEntry, h as PatchDataAppBody, P as PatchDataAppPath, m as RawAppRun, R as ResetDataAppPasswordPath, n as Runtime, o as RuntimeImageKey, S as Sandbox } from '../utils-JsCYFmHj.cjs';

package/dist/dataScience/types.d.ts

@@ -1,2 +1,2 @@
-import '../types-C7mpAfq-.js';
-export { C as CreateDataAppBody, k as DataApp, l as DataAppRun, D as DeleteDataAppPath, f as GetAppsQuery, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, i as GetDataAppPasswordPath, g as GetDataAppPath, b as GetDataAppRunPath, G as GetDataAppRunsPath, a as GetDataAppRunsQuery, j as GetSandboxPath, L as LogEntry, h as PatchDataAppBody, P as PatchDataAppPath, m as RawAppRun, R as ResetDataAppPasswordPath, n as Runtime, o as RuntimeImageKey, S as Sandbox } from '../utils-BNQZiNOu.js';
+import '../types-jKnx7Tm_.js';
+export { C as CreateDataAppBody, k as DataApp, l as DataAppRun, D as DeleteDataAppPath, f as GetAppsQuery, c as GetDataAppLogsDownloadPath, d as GetDataAppLogsTailPath, e as GetDataAppLogsTailQuery, i as GetDataAppPasswordPath, g as GetDataAppPath, b as GetDataAppRunPath, G as GetDataAppRunsPath, a as GetDataAppRunsQuery, j as GetSandboxPath, L as LogEntry, h as PatchDataAppBody, P as PatchDataAppPath, m as RawAppRun, R as ResetDataAppPasswordPath, n as Runtime, o as RuntimeImageKey, S as Sandbox } from '../utils-Cl4emy8g.js';

package/dist/domain/permissions/index.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var chunkGF4XZK5N_cjs = require('../../chunk-GF4XZK5N.cjs');
+var chunkR7MQGDLC_cjs = require('../../chunk-R7MQGDLC.cjs');
 
 // src/domain/permissions/errors.ts
 var PermissionDeniedError = class extends Error {
@@ -17,18 +18,11 @@ var PermissionDeniedError = class extends Error {
 };
 
 // src/domain/permissions/admin.ts
-var AdminRoles = {
-  ADMIN: "admin",
-  SHARE: "share",
-  PRODUCTION_MANAGER: "productionManager",
-  DEVELOPER: "developer",
-  REVIEWER: "reviewer"
-};
 var role = (token) => token.admin.role;
-var isAdmin = (token) => role(token) === AdminRoles.ADMIN;
-var isAdminOrShare = (token) => role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;
-var isProductionManager = (token) => role(token) === AdminRoles.PRODUCTION_MANAGER;
-var isDeveloperOrReviewer = (token) => role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;
+var isAdmin = (token) => role(token) === chunkR7MQGDLC_cjs.AdminRoles.ADMIN;
+var isAdminOrShare = (token) => role(token) === chunkR7MQGDLC_cjs.AdminRoles.ADMIN || role(token) === chunkR7MQGDLC_cjs.AdminRoles.SHARE;
+var isProductionManager = (token) => role(token) === chunkR7MQGDLC_cjs.AdminRoles.PRODUCTION_MANAGER;
+var isDeveloperOrReviewer = (token) => role(token) === chunkR7MQGDLC_cjs.AdminRoles.DEVELOPER || role(token) === chunkR7MQGDLC_cjs.AdminRoles.REVIEWER;
 var assertCanAdmin = (token) => {
   if (!isAdmin(token)) {
     throw new PermissionDeniedError({

package/dist/domain/permissions/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;AChBA,IAAM,UAAA,GAAa;AAAA,EACjB,KAAA,EAAO,OAAA;AAAA,EACP,KAAA,EAAO,OAAA;AAAA,EACP,kBAAA,EAAoB,mBAAA;AAAA,EACpB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU;AACZ,CAAA;AAEA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACXA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { PermissionDeniedError } from './errors';\n\nconst AdminRoles = {\n  ADMIN: 'admin',\n  SHARE: 'share',\n  PRODUCTION_MANAGER: 'productionManager',\n  DEVELOPER: 'developer',\n  REVIEWER: 'reviewer',\n} as const;\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRoles"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,4BAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,4BAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRoles } from '../../constants';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/domain/permissions/index.d.cts

@@ -1,5 +1,6 @@
-import { S as StorageToken } from '../../types-DYMMsuU0.cjs';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-CYhB6rYN.cjs';
+import { S as StorageToken } from '../../types-DJbXfC2q.cjs';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-C_m_tOgy.cjs';
+import '../../types-jKnx7Tm_.cjs';
 
 /**
  * @module domain/permissions/errors

package/dist/domain/permissions/index.d.ts

@@ -1,5 +1,6 @@
-import { S as StorageToken } from '../../types-DYMMsuU0.js';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-Bzslbq4u.js';
+import { S as StorageToken } from '../../types-BG8yQyYt.js';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-DQLliCsX.js';
+import '../../types-jKnx7Tm_.js';
 
 /**
  * @module domain/permissions/errors

package/dist/domain/permissions/index.js

@@ -1,4 +1,5 @@
 export { hasAdminFeature, hasFeature } from '../../chunk-UABYNGBZ.js';
+import { AdminRoles } from '../../chunk-SI5TFV5M.js';
 
 // src/domain/permissions/errors.ts
 var PermissionDeniedError = class extends Error {
@@ -15,13 +16,6 @@ var PermissionDeniedError = class extends Error {
 };
 
 // src/domain/permissions/admin.ts
-var AdminRoles = {
-  ADMIN: "admin",
-  SHARE: "share",
-  PRODUCTION_MANAGER: "productionManager",
-  DEVELOPER: "developer",
-  REVIEWER: "reviewer"
-};
 var role = (token) => token.admin.role;
 var isAdmin = (token) => role(token) === AdminRoles.ADMIN;
 var isAdminOrShare = (token) => role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;

package/dist/domain/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;AChBA,IAAM,UAAA,GAAa;AAAA,EACjB,KAAA,EAAO,OAAA;AAAA,EACP,KAAA,EAAO,OAAA;AAAA,EACP,kBAAA,EAAoB,mBAAA;AAAA,EACpB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU;AACZ,CAAA;AAEA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACXA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { PermissionDeniedError } from './errors';\n\nconst AdminRoles = {\n  ADMIN: 'admin',\n  SHARE: 'share',\n  PRODUCTION_MANAGER: 'productionManager',\n  DEVELOPER: 'developer',\n  REVIEWER: 'reviewer',\n} as const;\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRoles } from '../../constants';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}