@keboola/api-client 46.0.0 → 47.0.0

package/dist/chat/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-BksK2Eo0.cjs";
-import { A as components, C as UserAgentSettings, E as VoteRequest, S as UsageResponse, T as Vote, b as UpdateAgentSettingsRequest, d as GetVotesQuery, l as GetChatPath, o as ChatRequest, t as AgentSettings, u as GetHistoryQuery, x as UpdateUserAgentSettingsRequest, y as ToolsListResponse } from "../types-CFurl1xe.cjs";
+import { n as ClientInitOptions } from "../types-OkQWmonU.cjs";
+import { A as components, C as UserAgentSettings, E as VoteRequest, S as UsageResponse, T as Vote, b as UpdateAgentSettingsRequest, d as GetVotesQuery, l as GetChatPath, o as ChatRequest, t as AgentSettings, u as GetHistoryQuery, x as UpdateUserAgentSettingsRequest, y as ToolsListResponse } from "../types-BKIcow3B.cjs";
 import { d as SuggestionsApiResponse, f as SuggestionsRequestBody } from "../suggestions-BH3x7xU7.cjs";
 //#region src/clients/chat/chatClient.d.ts
 type ChatClientOptions = ClientInitOptions & {

package/dist/chat/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-BuKviWct.js";
-import { A as components, C as UserAgentSettings, E as VoteRequest, S as UsageResponse, T as Vote, b as UpdateAgentSettingsRequest, d as GetVotesQuery, l as GetChatPath, o as ChatRequest, t as AgentSettings, u as GetHistoryQuery, x as UpdateUserAgentSettingsRequest, y as ToolsListResponse } from "../types-DDjp9lXD.js";
+import { n as ClientInitOptions } from "../types-Cw9UISvM.js";
+import { A as components, C as UserAgentSettings, E as VoteRequest, S as UsageResponse, T as Vote, b as UpdateAgentSettingsRequest, d as GetVotesQuery, l as GetChatPath, o as ChatRequest, t as AgentSettings, u as GetHistoryQuery, x as UpdateUserAgentSettingsRequest, y as ToolsListResponse } from "../types-BXgINefw.js";
 import { d as SuggestionsApiResponse, f as SuggestionsRequestBody } from "../suggestions-BH3x7xU7.js";
 //#region src/clients/chat/chatClient.d.ts
 type ChatClientOptions = ClientInitOptions & {

package/dist/chat/index.js

@@ -1,6 +1,6 @@
-import { _ as KeboolaHttpHeader } from "../createFetchClient-DITkTV2k.js";
-import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-wq8iGLZM.js";
-import { t as createAuthHeaders } from "../auth-C6cHWIWx.js";
+import { _ as KeboolaHttpHeader } from "../createFetchClient-CkHdS_IG.js";
+import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-DXiMv9WL.js";
+import { t as createAuthHeaders } from "../auth-4coY1uwo.js";
 import { suggestionsApiResponseSchema } from "./suggestions.js";
 import { z } from "zod";
 //#region src/clients/chat/chatClient.ts

package/dist/chat/types.d.cts

@@ -1,2 +1,2 @@
-import { C as UserAgentSettings, D as VotesResponse, E as VoteRequest, O as approvalGoneReasonSchema, S as UsageResponse, T as Vote, _ as ToolInfo, a as ChatMessage, b as UpdateAgentSettingsRequest, c as ChatWithMessages, d as GetVotesQuery, f as HistoryResponse, g as TextPart, h as ProjectToolPolicyValue, i as Chat, k as askUserQuestionAnswersSchema, l as GetChatPath, m as ProjectToolPolicy, n as ApprovalGoneReason, o as ChatRequest, p as MessageStatus, r as AskUserQuestionAnswers, s as ChatWithMessage, t as AgentSettings, u as GetHistoryQuery, v as ToolPermissionValue, w as UserMessage, x as UpdateUserAgentSettingsRequest, y as ToolsListResponse } from "../types-CFurl1xe.cjs";
+import { C as UserAgentSettings, D as VotesResponse, E as VoteRequest, O as approvalGoneReasonSchema, S as UsageResponse, T as Vote, _ as ToolInfo, a as ChatMessage, b as UpdateAgentSettingsRequest, c as ChatWithMessages, d as GetVotesQuery, f as HistoryResponse, g as TextPart, h as ProjectToolPolicyValue, i as Chat, k as askUserQuestionAnswersSchema, l as GetChatPath, m as ProjectToolPolicy, n as ApprovalGoneReason, o as ChatRequest, p as MessageStatus, r as AskUserQuestionAnswers, s as ChatWithMessage, t as AgentSettings, u as GetHistoryQuery, v as ToolPermissionValue, w as UserMessage, x as UpdateUserAgentSettingsRequest, y as ToolsListResponse } from "../types-BKIcow3B.cjs";
 export { AgentSettings, ApprovalGoneReason, AskUserQuestionAnswers, Chat, ChatMessage, ChatRequest, ChatWithMessage, ChatWithMessages, GetChatPath, GetHistoryQuery, GetVotesQuery, HistoryResponse, MessageStatus, ProjectToolPolicy, ProjectToolPolicyValue, TextPart, ToolInfo, ToolPermissionValue, ToolsListResponse, UpdateAgentSettingsRequest, UpdateUserAgentSettingsRequest, UsageResponse, UserAgentSettings, UserMessage, Vote, VoteRequest, VotesResponse, approvalGoneReasonSchema, askUserQuestionAnswersSchema };

package/dist/chat/types.d.ts

@@ -1,2 +1,2 @@
-import { C as UserAgentSettings, D as VotesResponse, E as VoteRequest, O as approvalGoneReasonSchema, S as UsageResponse, T as Vote, _ as ToolInfo, a as ChatMessage, b as UpdateAgentSettingsRequest, c as ChatWithMessages, d as GetVotesQuery, f as HistoryResponse, g as TextPart, h as ProjectToolPolicyValue, i as Chat, k as askUserQuestionAnswersSchema, l as GetChatPath, m as ProjectToolPolicy, n as ApprovalGoneReason, o as ChatRequest, p as MessageStatus, r as AskUserQuestionAnswers, s as ChatWithMessage, t as AgentSettings, u as GetHistoryQuery, v as ToolPermissionValue, w as UserMessage, x as UpdateUserAgentSettingsRequest, y as ToolsListResponse } from "../types-DDjp9lXD.js";
+import { C as UserAgentSettings, D as VotesResponse, E as VoteRequest, O as approvalGoneReasonSchema, S as UsageResponse, T as Vote, _ as ToolInfo, a as ChatMessage, b as UpdateAgentSettingsRequest, c as ChatWithMessages, d as GetVotesQuery, f as HistoryResponse, g as TextPart, h as ProjectToolPolicyValue, i as Chat, k as askUserQuestionAnswersSchema, l as GetChatPath, m as ProjectToolPolicy, n as ApprovalGoneReason, o as ChatRequest, p as MessageStatus, r as AskUserQuestionAnswers, s as ChatWithMessage, t as AgentSettings, u as GetHistoryQuery, v as ToolPermissionValue, w as UserMessage, x as UpdateUserAgentSettingsRequest, y as ToolsListResponse } from "../types-BXgINefw.js";
 export { AgentSettings, ApprovalGoneReason, AskUserQuestionAnswers, Chat, ChatMessage, ChatRequest, ChatWithMessage, ChatWithMessages, GetChatPath, GetHistoryQuery, GetVotesQuery, HistoryResponse, MessageStatus, ProjectToolPolicy, ProjectToolPolicyValue, TextPart, ToolInfo, ToolPermissionValue, ToolsListResponse, UpdateAgentSettingsRequest, UpdateUserAgentSettingsRequest, UsageResponse, UserAgentSettings, UserMessage, Vote, VoteRequest, VotesResponse, approvalGoneReasonSchema, askUserQuestionAnswersSchema };

package/dist/{collect-97WhfEpt.js → collectByOffset-2XzJqmvr.js}

@@ -1,5 +1,5 @@
 import { t as createAbortError } from "./createAbortError-BxupOt-6.js";
-//#region src/utils/async/collect.ts
+//#region src/utils/async/collectByOffset.ts
 /**
 * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when
 * `limit` is omitted. Calls `fetchFrom` sequentially with the offset advancing by the number of
@@ -9,10 +9,10 @@ import { t as createAbortError } from "./createAbortError-BxupOt-6.js";
 * empty page. Passing it therefore saves the trailing request, at the cost of stopping early if the
 * endpoint returns fewer items per page than asked for.
 */
-const collect = async ({ fetchFrom, pageSize, limit, signal }) => {
+const collectByOffset = async ({ fetchFrom, pageSize, limit, signal }) => {
 	if (signal?.aborted) throw createAbortError(signal.reason);
-	if (limit !== void 0 && limit < 0) throw new Error("Invalid collect limit");
-	if (pageSize !== void 0 && pageSize < 1) throw new Error("Invalid collect pageSize");
+	if (limit !== void 0 && limit < 0) throw new Error("Invalid collectByOffset limit");
+	if (pageSize !== void 0 && pageSize < 1) throw new Error("Invalid collectByOffset pageSize");
 	const items = [];
 	if (limit === 0) return items;
 	let offset = 0;
@@ -25,6 +25,6 @@ const collect = async ({ fetchFrom, pageSize, limit, signal }) => {
 	}
 };
 //#endregion
-export { collect as t };
+export { collectByOffset as t };
 
-//# sourceMappingURL=collect-97WhfEpt.js.map
+//# sourceMappingURL=collectByOffset-2XzJqmvr.js.map

package/dist/collectByOffset-2XzJqmvr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectByOffset-2XzJqmvr.js","names":[],"sources":["../src/utils/async/collectByOffset.ts"],"sourcesContent":["import { createAbortError } from '../createAbortError';\n\nexport type CollectByOffsetOptions<T> = {\n  fetchFrom: (offset: number, pageSize?: number, signal?: AbortSignal) => Promise<T[]>;\n  pageSize?: number;\n  limit?: number;\n  signal?: AbortSignal;\n};\n\n/**\n * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when\n * `limit` is omitted. Calls `fetchFrom` sequentially with the offset advancing by the number of\n * items received, and hands it `pageSize` so the request and the traversal agree on one value.\n *\n * Traversal ends on a page shorter than `pageSize`, or — when `pageSize` is omitted — only on an\n * empty page. Passing it therefore saves the trailing request, at the cost of stopping early if the\n * endpoint returns fewer items per page than asked for.\n */\nexport const collectByOffset = async <T>({\n  fetchFrom,\n  pageSize,\n  limit,\n  signal,\n}: CollectByOffsetOptions<T>): Promise<T[]> => {\n  if (signal?.aborted) throw createAbortError(signal.reason);\n  if (limit !== undefined && limit < 0) throw new Error('Invalid collectByOffset limit');\n  if (pageSize !== undefined && pageSize < 1) throw new Error('Invalid collectByOffset pageSize');\n\n  const items: T[] = [];\n\n  if (limit === 0) return items;\n\n  let offset = 0;\n\n  while (true) {\n    const batch = await fetchFrom(offset, pageSize, signal);\n\n    items.push(...batch);\n    offset += batch.length;\n\n    if (limit !== undefined && items.length >= limit) return items.slice(0, limit);\n    if (pageSize === undefined ? batch.length === 0 : batch.length < pageSize) return items;\n  }\n};\n"],"mappings":";;;;;;;;;;;AAkBA,MAAa,kBAAkB,OAAU,EACvC,WACA,UACA,OACA,aAC6C;CAC7C,IAAI,QAAQ,SAAS,MAAM,iBAAiB,OAAO,MAAM;CACzD,IAAI,UAAU,KAAA,KAAa,QAAQ,GAAG,MAAM,IAAI,MAAM,+BAA+B;CACrF,IAAI,aAAa,KAAA,KAAa,WAAW,GAAG,MAAM,IAAI,MAAM,kCAAkC;CAE9F,MAAM,QAAa,CAAC;CAEpB,IAAI,UAAU,GAAG,OAAO;CAExB,IAAI,SAAS;CAEb,OAAO,MAAM;EACX,MAAM,QAAQ,MAAM,UAAU,QAAQ,UAAU,MAAM;EAEtD,MAAM,KAAK,GAAG,KAAK;EACnB,UAAU,MAAM;EAEhB,IAAI,UAAU,KAAA,KAAa,MAAM,UAAU,OAAO,OAAO,MAAM,MAAM,GAAG,KAAK;EAC7E,IAAI,aAAa,KAAA,IAAY,MAAM,WAAW,IAAI,MAAM,SAAS,UAAU,OAAO;CACpF;AACF"}

package/dist/{collect-B5TCNiT1.cjs → collectByOffset-DQsqtmJg.cjs}

@@ -1,5 +1,5 @@
 const require_createAbortError = require("./createAbortError-RendOpo7.cjs");
-//#region src/utils/async/collect.ts
+//#region src/utils/async/collectByOffset.ts
 /**
 * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when
 * `limit` is omitted. Calls `fetchFrom` sequentially with the offset advancing by the number of
@@ -9,10 +9,10 @@ const require_createAbortError = require("./createAbortError-RendOpo7.cjs");
 * empty page. Passing it therefore saves the trailing request, at the cost of stopping early if the
 * endpoint returns fewer items per page than asked for.
 */
-const collect = async ({ fetchFrom, pageSize, limit, signal }) => {
+const collectByOffset = async ({ fetchFrom, pageSize, limit, signal }) => {
 	if (signal?.aborted) throw require_createAbortError.createAbortError(signal.reason);
-	if (limit !== void 0 && limit < 0) throw new Error("Invalid collect limit");
-	if (pageSize !== void 0 && pageSize < 1) throw new Error("Invalid collect pageSize");
+	if (limit !== void 0 && limit < 0) throw new Error("Invalid collectByOffset limit");
+	if (pageSize !== void 0 && pageSize < 1) throw new Error("Invalid collectByOffset pageSize");
 	const items = [];
 	if (limit === 0) return items;
 	let offset = 0;
@@ -25,11 +25,11 @@ const collect = async ({ fetchFrom, pageSize, limit, signal }) => {
 	}
 };
 //#endregion
-Object.defineProperty(exports, "collect", {
+Object.defineProperty(exports, "collectByOffset", {
 	enumerable: true,
 	get: function() {
-		return collect;
+		return collectByOffset;
 	}
 });
 
-//# sourceMappingURL=collect-B5TCNiT1.cjs.map
+//# sourceMappingURL=collectByOffset-DQsqtmJg.cjs.map

package/dist/collectByOffset-DQsqtmJg.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectByOffset-DQsqtmJg.cjs","names":["createAbortError"],"sources":["../src/utils/async/collectByOffset.ts"],"sourcesContent":["import { createAbortError } from '../createAbortError';\n\nexport type CollectByOffsetOptions<T> = {\n  fetchFrom: (offset: number, pageSize?: number, signal?: AbortSignal) => Promise<T[]>;\n  pageSize?: number;\n  limit?: number;\n  signal?: AbortSignal;\n};\n\n/**\n * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when\n * `limit` is omitted. Calls `fetchFrom` sequentially with the offset advancing by the number of\n * items received, and hands it `pageSize` so the request and the traversal agree on one value.\n *\n * Traversal ends on a page shorter than `pageSize`, or — when `pageSize` is omitted — only on an\n * empty page. Passing it therefore saves the trailing request, at the cost of stopping early if the\n * endpoint returns fewer items per page than asked for.\n */\nexport const collectByOffset = async <T>({\n  fetchFrom,\n  pageSize,\n  limit,\n  signal,\n}: CollectByOffsetOptions<T>): Promise<T[]> => {\n  if (signal?.aborted) throw createAbortError(signal.reason);\n  if (limit !== undefined && limit < 0) throw new Error('Invalid collectByOffset limit');\n  if (pageSize !== undefined && pageSize < 1) throw new Error('Invalid collectByOffset pageSize');\n\n  const items: T[] = [];\n\n  if (limit === 0) return items;\n\n  let offset = 0;\n\n  while (true) {\n    const batch = await fetchFrom(offset, pageSize, signal);\n\n    items.push(...batch);\n    offset += batch.length;\n\n    if (limit !== undefined && items.length >= limit) return items.slice(0, limit);\n    if (pageSize === undefined ? batch.length === 0 : batch.length < pageSize) return items;\n  }\n};\n"],"mappings":";;;;;;;;;;;AAkBA,MAAa,kBAAkB,OAAU,EACvC,WACA,UACA,OACA,aAC6C;CAC7C,IAAI,QAAQ,SAAS,MAAMA,yBAAAA,iBAAiB,OAAO,MAAM;CACzD,IAAI,UAAU,KAAA,KAAa,QAAQ,GAAG,MAAM,IAAI,MAAM,+BAA+B;CACrF,IAAI,aAAa,KAAA,KAAa,WAAW,GAAG,MAAM,IAAI,MAAM,kCAAkC;CAE9F,MAAM,QAAa,CAAC;CAEpB,IAAI,UAAU,GAAG,OAAO;CAExB,IAAI,SAAS;CAEb,OAAO,MAAM;EACX,MAAM,QAAQ,MAAM,UAAU,QAAQ,UAAU,MAAM;EAEtD,MAAM,KAAK,GAAG,KAAK;EACnB,UAAU,MAAM;EAEhB,IAAI,UAAU,KAAA,KAAa,MAAM,UAAU,OAAO,OAAO,MAAM,MAAM,GAAG,KAAK;EAC7E,IAAI,aAAa,KAAA,IAAY,MAAM,WAAW,IAAI,MAAM,SAAS,UAAU,OAAO;CACpF;AACF"}

package/dist/componentsMcp/index.cjs

@@ -0,0 +1,3 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_componentsMcp = require("../componentsMcp-pG-PcQrg.cjs");
+exports.createComponentsMcpClient = require_componentsMcp.createComponentsMcpClient;

package/dist/componentsMcp/index.d.cts

@@ -0,0 +1,2 @@
+import { i as StoredConnectorCredentials, n as Connector, r as ConnectorsResponse, t as createComponentsMcpClient } from "../index-URgNfi5L.cjs";
+export { type Connector, type ConnectorsResponse, type StoredConnectorCredentials, createComponentsMcpClient };

package/dist/componentsMcp/index.d.ts

@@ -0,0 +1,2 @@
+import { i as StoredConnectorCredentials, n as Connector, r as ConnectorsResponse, t as createComponentsMcpClient } from "../index-B_MzjCeE.js";
+export { type Connector, type ConnectorsResponse, type StoredConnectorCredentials, createComponentsMcpClient };

package/dist/componentsMcp/index.js

@@ -0,0 +1,2 @@
+import { t as createComponentsMcpClient } from "../componentsMcp-CHobIsuU.js";
+export { createComponentsMcpClient };

package/dist/componentsMcp/types.d.cts

@@ -0,0 +1,2 @@
+import { n as SetConnectorCredentialsBody, r as SetConnectorCredentialsPath, t as GetConnectorsQuery } from "../types-4bSZLxq3.cjs";
+export { GetConnectorsQuery, SetConnectorCredentialsBody, SetConnectorCredentialsPath };

package/dist/componentsMcp/types.d.ts

@@ -0,0 +1,2 @@
+import { n as SetConnectorCredentialsBody, r as SetConnectorCredentialsPath, t as GetConnectorsQuery } from "../types-BIDKSQdc.js";
+export { GetConnectorsQuery, SetConnectorCredentialsBody, SetConnectorCredentialsPath };

package/dist/componentsMcp/types.js

@@ -0,0 +1 @@
+export {};

package/dist/componentsMcp-CHobIsuU.js

@@ -0,0 +1,57 @@
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-DXiMv9WL.js";
+import { t as createAuthHeaders } from "./auth-4coY1uwo.js";
+import { z } from "zod";
+//#region src/clients/componentsMcp/schemas.ts
+const connectorSchema = z.looseObject({
+	id: z.string(),
+	provider: z.string(),
+	display_name: z.string(),
+	description: z.string(),
+	has_stored_credentials: z.boolean(),
+	credentials_schema: z.record(z.string(), z.unknown())
+});
+const connectorsResponseSchema = z.looseObject({
+	providers: z.record(z.string(), z.number()),
+	connectors: z.array(connectorSchema)
+});
+const storedConnectorCredentialsSchema = z.looseObject({
+	connector: z.string(),
+	label: z.string(),
+	status: z.literal("stored")
+});
+//#endregion
+//#region src/clients/componentsMcp/componentsMcpClient.ts
+/**
+* Components MCP, the connector vault behind Kai's credential form.
+*/
+const createComponentsMcpClient = ({ baseUrl, middlewares, auth }) => {
+	const client = createOpenapiFetchClient({
+		baseUrl,
+		middlewares,
+		headers: createAuthHeaders(auth)
+	});
+	const healthCheck = async (signal) => {
+		const { data } = await client.get("/", {}, { signal });
+		return data;
+	};
+	const getConnectors = async (query = {}, signal) => {
+		const { data } = await client.get("/connectors", { query }, { signal });
+		return connectorsResponseSchema.parse(data);
+	};
+	const setConnectorCredentials = async (path, body, signal) => {
+		const { data } = await client.put("/connectors/{connector_id}/credentials", {
+			path,
+			body
+		}, { signal });
+		return storedConnectorCredentialsSchema.parse(data);
+	};
+	return {
+		healthCheck,
+		getConnectors,
+		setConnectorCredentials
+	};
+};
+//#endregion
+export { createComponentsMcpClient as t };
+
+//# sourceMappingURL=componentsMcp-CHobIsuU.js.map

package/dist/componentsMcp-CHobIsuU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentsMcp-CHobIsuU.js","names":[],"sources":["../src/clients/componentsMcp/schemas.ts","../src/clients/componentsMcp/componentsMcpClient.ts"],"sourcesContent":["import { z } from 'zod';\n\n// The spec publishes both responses as an open object; shapes follow keboola/components-mcp\n// (`Connector.describe()` in src/connectors/base.py, the route handlers in src/app.py).\nconst connectorSchema = z.looseObject({\n  id: z.string(),\n  provider: z.string(),\n  display_name: z.string(),\n  description: z.string(),\n  has_stored_credentials: z.boolean(),\n  // A JSON schema; `required` empty means the connector takes no stored credentials.\n  credentials_schema: z.record(z.string(), z.unknown()),\n});\n\nexport const connectorsResponseSchema = z.looseObject({\n  providers: z.record(z.string(), z.number()),\n  connectors: z.array(connectorSchema),\n});\n\nexport const storedConnectorCredentialsSchema = z.looseObject({\n  connector: z.string(),\n  label: z.string(),\n  status: z.literal('stored'),\n});\n\nexport type Connector = z.infer<typeof connectorSchema>;\nexport type ConnectorsResponse = z.infer<typeof connectorsResponseSchema>;\nexport type StoredConnectorCredentials = z.infer<typeof storedConnectorCredentialsSchema>;\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { ConnectorsResponse, StoredConnectorCredentials } from './schemas';\nimport { connectorsResponseSchema, storedConnectorCredentialsSchema } from './schemas';\nimport type {\n  GetConnectorsQuery,\n  SetConnectorCredentialsBody,\n  SetConnectorCredentialsPath,\n} from './types';\n\n/**\n * Components MCP, the connector vault behind Kai's credential form.\n */\nexport const createComponentsMcpClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/', {}, { signal });\n\n    return data;\n  };\n\n  const getConnectors = async (\n    query: GetConnectorsQuery = {},\n    signal?: AbortSignal,\n  ): Promise<ConnectorsResponse> => {\n    const { data } = await client.get('/connectors', { query }, { signal });\n\n    return connectorsResponseSchema.parse(data);\n  };\n\n  // `connector` in the response is the canonical id; an alias in the path is stored under it.\n  const setConnectorCredentials = async (\n    path: SetConnectorCredentialsPath,\n    body: SetConnectorCredentialsBody,\n    signal?: AbortSignal,\n  ): Promise<StoredConnectorCredentials> => {\n    const { data } = await client.put(\n      '/connectors/{connector_id}/credentials',\n      { path, body },\n      { signal },\n    );\n\n    return storedConnectorCredentialsSchema.parse(data);\n  };\n\n  return {\n    healthCheck,\n    getConnectors,\n    setConnectorCredentials,\n  };\n};\n"],"mappings":";;;;AAIA,MAAM,kBAAkB,EAAE,YAAY;CACpC,IAAI,EAAE,OAAO;CACb,UAAU,EAAE,OAAO;CACnB,cAAc,EAAE,OAAO;CACvB,aAAa,EAAE,OAAO;CACtB,wBAAwB,EAAE,QAAQ;CAElC,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AACtD,CAAC;AAED,MAAa,2BAA2B,EAAE,YAAY;CACpD,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;CAC1C,YAAY,EAAE,MAAM,eAAe;AACrC,CAAC;AAED,MAAa,mCAAmC,EAAE,YAAY;CAC5D,WAAW,EAAE,OAAO;CACpB,OAAO,EAAE,OAAO;CAChB,QAAQ,EAAE,QAAQ,QAAQ;AAC5B,CAAC;;;;;;ACPD,MAAa,6BAA6B,EAAE,SAAS,aAAa,WAA8B;CAC9F,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CAED,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,gBAAgB,OACpB,QAA4B,CAAC,GAC7B,WACgC;EAChC,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,eAAe,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EAEtE,OAAO,yBAAyB,MAAM,IAAI;CAC5C;CAGA,MAAM,0BAA0B,OAC9B,MACA,MACA,WACwC;EACxC,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,0CACA;GAAE;GAAM;EAAK,GACb,EAAE,OAAO,CACX;EAEA,OAAO,iCAAiC,MAAM,IAAI;CACpD;CAEA,OAAO;EACL;EACA;EACA;CACF;AACF"}

package/dist/componentsMcp-pG-PcQrg.cjs

@@ -0,0 +1,62 @@
+const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-DHYo_k3t.cjs");
+const require_auth = require("./auth-C8Pjl0Mu.cjs");
+let zod = require("zod");
+//#region src/clients/componentsMcp/schemas.ts
+const connectorSchema = zod.z.looseObject({
+	id: zod.z.string(),
+	provider: zod.z.string(),
+	display_name: zod.z.string(),
+	description: zod.z.string(),
+	has_stored_credentials: zod.z.boolean(),
+	credentials_schema: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+const connectorsResponseSchema = zod.z.looseObject({
+	providers: zod.z.record(zod.z.string(), zod.z.number()),
+	connectors: zod.z.array(connectorSchema)
+});
+const storedConnectorCredentialsSchema = zod.z.looseObject({
+	connector: zod.z.string(),
+	label: zod.z.string(),
+	status: zod.z.literal("stored")
+});
+//#endregion
+//#region src/clients/componentsMcp/componentsMcpClient.ts
+/**
+* Components MCP, the connector vault behind Kai's credential form.
+*/
+const createComponentsMcpClient = ({ baseUrl, middlewares, auth }) => {
+	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({
+		baseUrl,
+		middlewares,
+		headers: require_auth.createAuthHeaders(auth)
+	});
+	const healthCheck = async (signal) => {
+		const { data } = await client.get("/", {}, { signal });
+		return data;
+	};
+	const getConnectors = async (query = {}, signal) => {
+		const { data } = await client.get("/connectors", { query }, { signal });
+		return connectorsResponseSchema.parse(data);
+	};
+	const setConnectorCredentials = async (path, body, signal) => {
+		const { data } = await client.put("/connectors/{connector_id}/credentials", {
+			path,
+			body
+		}, { signal });
+		return storedConnectorCredentialsSchema.parse(data);
+	};
+	return {
+		healthCheck,
+		getConnectors,
+		setConnectorCredentials
+	};
+};
+//#endregion
+Object.defineProperty(exports, "createComponentsMcpClient", {
+	enumerable: true,
+	get: function() {
+		return createComponentsMcpClient;
+	}
+});
+
+//# sourceMappingURL=componentsMcp-pG-PcQrg.cjs.map

package/dist/componentsMcp-pG-PcQrg.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentsMcp-pG-PcQrg.cjs","names":["z","createOpenapiFetchClient","createAuthHeaders"],"sources":["../src/clients/componentsMcp/schemas.ts","../src/clients/componentsMcp/componentsMcpClient.ts"],"sourcesContent":["import { z } from 'zod';\n\n// The spec publishes both responses as an open object; shapes follow keboola/components-mcp\n// (`Connector.describe()` in src/connectors/base.py, the route handlers in src/app.py).\nconst connectorSchema = z.looseObject({\n  id: z.string(),\n  provider: z.string(),\n  display_name: z.string(),\n  description: z.string(),\n  has_stored_credentials: z.boolean(),\n  // A JSON schema; `required` empty means the connector takes no stored credentials.\n  credentials_schema: z.record(z.string(), z.unknown()),\n});\n\nexport const connectorsResponseSchema = z.looseObject({\n  providers: z.record(z.string(), z.number()),\n  connectors: z.array(connectorSchema),\n});\n\nexport const storedConnectorCredentialsSchema = z.looseObject({\n  connector: z.string(),\n  label: z.string(),\n  status: z.literal('stored'),\n});\n\nexport type Connector = z.infer<typeof connectorSchema>;\nexport type ConnectorsResponse = z.infer<typeof connectorsResponseSchema>;\nexport type StoredConnectorCredentials = z.infer<typeof storedConnectorCredentialsSchema>;\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { ConnectorsResponse, StoredConnectorCredentials } from './schemas';\nimport { connectorsResponseSchema, storedConnectorCredentialsSchema } from './schemas';\nimport type {\n  GetConnectorsQuery,\n  SetConnectorCredentialsBody,\n  SetConnectorCredentialsPath,\n} from './types';\n\n/**\n * Components MCP, the connector vault behind Kai's credential form.\n */\nexport const createComponentsMcpClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/', {}, { signal });\n\n    return data;\n  };\n\n  const getConnectors = async (\n    query: GetConnectorsQuery = {},\n    signal?: AbortSignal,\n  ): Promise<ConnectorsResponse> => {\n    const { data } = await client.get('/connectors', { query }, { signal });\n\n    return connectorsResponseSchema.parse(data);\n  };\n\n  // `connector` in the response is the canonical id; an alias in the path is stored under it.\n  const setConnectorCredentials = async (\n    path: SetConnectorCredentialsPath,\n    body: SetConnectorCredentialsBody,\n    signal?: AbortSignal,\n  ): Promise<StoredConnectorCredentials> => {\n    const { data } = await client.put(\n      '/connectors/{connector_id}/credentials',\n      { path, body },\n      { signal },\n    );\n\n    return storedConnectorCredentialsSchema.parse(data);\n  };\n\n  return {\n    healthCheck,\n    getConnectors,\n    setConnectorCredentials,\n  };\n};\n"],"mappings":";;;;AAIA,MAAM,kBAAkBA,IAAAA,EAAE,YAAY;CACpC,IAAIA,IAAAA,EAAE,OAAO;CACb,UAAUA,IAAAA,EAAE,OAAO;CACnB,cAAcA,IAAAA,EAAE,OAAO;CACvB,aAAaA,IAAAA,EAAE,OAAO;CACtB,wBAAwBA,IAAAA,EAAE,QAAQ;CAElC,oBAAoBA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,QAAQ,CAAC;AACtD,CAAC;AAED,MAAa,2BAA2BA,IAAAA,EAAE,YAAY;CACpD,WAAWA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,OAAO,CAAC;CAC1C,YAAYA,IAAAA,EAAE,MAAM,eAAe;AACrC,CAAC;AAED,MAAa,mCAAmCA,IAAAA,EAAE,YAAY;CAC5D,WAAWA,IAAAA,EAAE,OAAO;CACpB,OAAOA,IAAAA,EAAE,OAAO;CAChB,QAAQA,IAAAA,EAAE,QAAQ,QAAQ;AAC5B,CAAC;;;;;;ACPD,MAAa,6BAA6B,EAAE,SAAS,aAAa,WAA8B;CAC9F,MAAM,SAASC,iCAAAA,yBAAgC;EAC7C;EACA;EACA,SAASC,aAAAA,kBAAkB,IAAI;CACjC,CAAC;CAED,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,gBAAgB,OACpB,QAA4B,CAAC,GAC7B,WACgC;EAChC,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,eAAe,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EAEtE,OAAO,yBAAyB,MAAM,IAAI;CAC5C;CAGA,MAAM,0BAA0B,OAC9B,MACA,MACA,WACwC;EACxC,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,0CACA;GAAE;GAAM;EAAK,GACb,EAAE,OAAO,CACX;EAEA,OAAO,iCAAiC,MAAM,IAAI;CACpD;CAEA,OAAO;EACL;EACA;EACA;CACF;AACF"}

package/dist/configurations-BTRHVSRq.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"configurations-BTRHVSRq.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin` or `productionManager` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * - Dev branch → developer or reviewer; production → production manager.\n * - Purge is admin-only in any branch mode; its `ctx` is ignored.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` on any branch other than the default (`isDefault`) one.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACRA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAASA,mBAAAA,UAAU,SAAS,MAAM,OAAO,SAASA,mBAAAA,UAAU;AAE3E,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;AC/FA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}
+{"version":3,"file":"configurations-BTRHVSRq.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): AdminRole | null => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin` or `productionManager` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * - Dev branch → developer or reviewer; production → production manager.\n * - Purge is admin-only in any branch mode; its `ctx` is ignored.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` on any branch other than the default (`isDefault`) one.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACRA,MAAM,QAAQ,UAA0C,MAAM,MAAM;AAEpE,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAASA,mBAAAA,UAAU,SAAS,MAAM,OAAO,SAASA,mBAAAA,UAAU;AAE3E,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;AC/FA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/configurations-Chg_JwJ1.js.map

@@ -1 +1 @@
-{"version":3,"file":"configurations-Chg_JwJ1.js","names":[],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin` or `productionManager` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * - Dev branch → developer or reviewer; production → production manager.\n * - Purge is admin-only in any branch mode; its `ctx` is ignored.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` on any branch other than the default (`isDefault`) one.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACRA,MAAM,QAAQ,UAAgC,MAAM,MAAM;AAE1D,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAM,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,MAAM,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAM,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK,MAAM,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAM,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAO,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAK,UAAU;EACf,KAAK,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAAS,UAAU,SAAS,MAAM,OAAO,SAAS,UAAU;AAE3E,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;AC/FA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}
+{"version":3,"file":"configurations-Chg_JwJ1.js","names":[],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): AdminRole | null => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin` or `productionManager` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * - Dev branch → developer or reviewer; production → production manager.\n * - Purge is admin-only in any branch mode; its `ctx` is ignored.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` on any branch other than the default (`isDefault`) one.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACRA,MAAM,QAAQ,UAA0C,MAAM,MAAM;AAEpE,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAM,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,MAAM,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAM,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK,MAAM,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAM,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAO,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAK,UAAU;EACf,KAAK,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAAS,UAAU,SAAS,MAAM,OAAO,SAAS,UAAU;AAE3E,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;AC/FA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/constants/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_constants = require("../constants-BDGRQqij.cjs");
+const require_constants = require("../constants-a0jswUeK.cjs");
 const require_adminRoles = require("../adminRoles-CO7J5qAy.cjs");
 const require_componentId = require("../componentId-D4jp6a13.cjs");
 exports.AdminRole = require_adminRoles.AdminRole;

package/dist/constants/index.d.cts

@@ -1,5 +1,4 @@
-import { t as ServiceId } from "../serviceIds-DRcoTnSd.cjs";
-import { t as AdminRole } from "../adminRoles-C696kD_U.cjs";
+import { a as STACKS, c as ServiceId, i as Provider, n as Continent, o as ProjectFeature, r as KeboolaStack, s as ComponentId, t as URLS } from "../index-8ZjY7YD8.cjs";
+import { t as AdminRole } from "../adminRoles-DGM8SuuF.cjs";
 import { t as Backend } from "../backends-DKBz5OxE.cjs";
-import { a as STACKS, i as Provider, n as Continent, o as ProjectFeature, r as KeboolaStack, s as ComponentId, t as URLS } from "../index-DeQDdut6.cjs";
 export { AdminRole, Backend, ComponentId, Continent, type KeboolaStack, ProjectFeature, Provider, STACKS, ServiceId, URLS };

package/dist/constants/index.d.ts

@@ -1,5 +1,4 @@
-import { t as ServiceId } from "../serviceIds-DRcoTnSd.js";
-import { t as AdminRole } from "../adminRoles-C696kD_U.js";
+import { a as STACKS, c as ServiceId, i as Provider, n as Continent, o as ProjectFeature, r as KeboolaStack, s as ComponentId, t as URLS } from "../index-BnPmXDVP.js";
+import { t as AdminRole } from "../adminRoles-CvdIUkiC.js";
 import { t as Backend } from "../backends-DKBz5OxE.js";
-import { a as STACKS, i as Provider, n as Continent, o as ProjectFeature, r as KeboolaStack, s as ComponentId, t as URLS } from "../index-DeQDdut6.js";
 export { AdminRole, Backend, ComponentId, Continent, type KeboolaStack, ProjectFeature, Provider, STACKS, ServiceId, URLS };

package/dist/constants/index.js

@@ -1,4 +1,4 @@
-import { a as ServiceId, i as STACKS, n as Continent, o as Backend, r as Provider, s as ProjectFeature, t as URLS } from "../constants-Cifrqsls.js";
+import { a as Backend, i as STACKS, n as Continent, o as ServiceId, r as Provider, s as ProjectFeature, t as URLS } from "../constants-CA4UN2Xv.js";
 import { t as AdminRole } from "../adminRoles-B40yBcmq.js";
 import { t as ComponentId } from "../componentId-DmHwHG5V.js";
 export { AdminRole, Backend, ComponentId, Continent, ProjectFeature, Provider, STACKS, ServiceId, URLS };

package/dist/{constants-Cifrqsls.js → constants-CA4UN2Xv.js}

@@ -5,18 +5,12 @@ const ProjectFeature = {
 	StorageBranches: "storage-branches"
 };
 //#endregion
-//#region src/constants/backends.ts
-const Backend = {
-	Snowflake: "snowflake",
-	Bigquery: "bigquery"
-};
-//#endregion
 //#region src/constants/serviceIds.ts
 /**
 * Every service a Keboola stack can announce in its `GET /v2/storage` index.
 *
-* - The values are the `id`s the stack reports; `Service['id']` and the service-client registry
-*   both narrow on them.
+* - The values are the `id`s the stack reports; the service-client registry and `createStack`'s
+*   lookups narrow on them. The index itself stays `string` — a stack may announce more.
 * - Callers enumerate them at runtime — a test double announcing every service, for one.
 */
 const ServiceId = {
@@ -32,6 +26,7 @@ const ServiceId = {
 	Queue: "queue",
 	KaiAssistant: "kai-assistant",
 	KaiAgent: "kai-agent",
+	ComponentsMcp: "components-mcp",
 	SyncActions: "sync-actions",
 	Stream: "stream",
 	Notification: "notification",
@@ -40,6 +35,12 @@ const ServiceId = {
 	Billing: "billing"
 };
 //#endregion
+//#region src/constants/backends.ts
+const Backend = {
+	Snowflake: "snowflake",
+	Bigquery: "bigquery"
+};
+//#endregion
 //#region src/constants/stacks.ts
 const Provider = {
 	Aws: "aws",
@@ -224,6 +225,6 @@ const URLS = {
 	CLIENT_DEVIN_DESKTOP: "https://docs.devin.ai/desktop/getting-started"
 };
 //#endregion
-export { ServiceId as a, STACKS as i, Continent as n, Backend as o, Provider as r, ProjectFeature as s, URLS as t };
+export { Backend as a, STACKS as i, Continent as n, ServiceId as o, Provider as r, ProjectFeature as s, URLS as t };
 
-//# sourceMappingURL=constants-Cifrqsls.js.map
+//# sourceMappingURL=constants-CA4UN2Xv.js.map

package/dist/constants-CA4UN2Xv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants-CA4UN2Xv.js","names":[],"sources":["../src/constants/projectFeatures.ts","../src/constants/serviceIds.ts","../src/constants/backends.ts","../src/constants/stacks.ts","../src/constants/index.ts"],"sourcesContent":["export const ProjectFeature = {\n  DisableLegacyBucketPrefix: 'disable-legacy-bucket-prefix',\n  SoxProtectedDefaultBranch: 'protected-default-branch',\n  StorageBranches: 'storage-branches',\n} as const;\n\nexport type ProjectFeature = (typeof ProjectFeature)[keyof typeof ProjectFeature];\n","/**\n * Every service a Keboola stack can announce in its `GET /v2/storage` index.\n *\n * - The values are the `id`s the stack reports; the service-client registry and `createStack`'s\n *   lookups narrow on them. The index itself stays `string` — a stack may announce more.\n * - Callers enumerate them at runtime — a test double announcing every service, for one.\n */\nexport const ServiceId = {\n  Vault: 'vault',\n  DataScience: 'data-science',\n  Encryption: 'encryption',\n  Telemetry: 'telemetry',\n  Ai: 'ai',\n  Editor: 'editor',\n  Import: 'import',\n  Oauth: 'oauth',\n  Query: 'query',\n  Queue: 'queue',\n  KaiAssistant: 'kai-assistant',\n  KaiAgent: 'kai-agent',\n  ComponentsMcp: 'components-mcp',\n  SyncActions: 'sync-actions',\n  Stream: 'stream',\n  Notification: 'notification',\n  Scheduler: 'scheduler',\n  Metastore: 'metastore',\n  Billing: 'billing',\n} as const;\n\nexport type ServiceId = (typeof ServiceId)[keyof typeof ServiceId];\n","export const Backend = {\n  Snowflake: 'snowflake',\n  Bigquery: 'bigquery',\n} as const;\n\nexport type Backend = (typeof Backend)[keyof typeof Backend];\n","export const Provider = {\n  Aws: 'aws',\n  Azure: 'azure',\n  Gcp: 'gcp',\n} as const;\n\nexport type Provider = (typeof Provider)[keyof typeof Provider];\n\nexport const Continent = {\n  Us: 'us',\n  Europe: 'europe',\n} as const;\n\nexport type Continent = (typeof Continent)[keyof typeof Continent];\n\nexport type KeboolaStack = {\n  id: string;\n  host: string;\n  isSingleTenant?: boolean;\n  isTesting?: boolean;\n  isPayg?: boolean;\n  provider?: Provider;\n  continent?: Continent;\n  region?: string;\n  isCanary?: boolean;\n};\n\nconst stacks = {\n  NORTH_EUROPE_AZURE: {\n    id: 'com-keboola-azure-north-europe',\n    region: 'north-europe',\n    host: 'connection.north-europe.azure.keboola.com',\n    provider: 'azure',\n    continent: 'europe',\n    isPayg: true,\n  },\n  EU_CENTRAL_1_AWS: {\n    id: 'kbc-eu-central-1',\n    region: 'eu-central-1',\n    host: 'connection.eu-central-1.keboola.com',\n    provider: 'aws',\n    continent: 'europe',\n  },\n  US_EAST_1_AWS: {\n    id: 'kbc-us-east-1',\n    region: 'us-east-1',\n    host: 'connection.keboola.com',\n    provider: 'aws',\n    continent: 'us',\n  },\n  EUROPE_WEST3_GCP: {\n    id: 'com-keboola-gcp-europe-west3',\n    region: 'europe-west3',\n    host: 'connection.europe-west3.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'europe',\n  },\n  US_EAST_4_GCP: {\n    id: 'com-keboola-gcp-us-east4',\n    region: 'us-east4',\n    host: 'connection.us-east4.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'us',\n    isPayg: true,\n  },\n\n  /* PRIVATE SINGLE TENANT STACKS\n     ---------------------------- */\n  HCI: {\n    id: 'cloud-keboola-hci',\n    host: 'connection.hci.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_PROD: {\n    id: 'cloud-keboola-cs',\n    host: 'connection.cs.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_TEST: {\n    id: 'cloud-keboola-cs-test',\n    host: 'connection.cs-test.keboola.cloud',\n    isSingleTenant: true,\n  },\n  INNOGY: {\n    id: 'cloud-keboola-innogy-hub',\n    host: 'connection.innogy-hub.keboola.cloud',\n    isSingleTenant: true,\n  },\n  GROUPON: {\n    id: 'cloud-keboola-groupon',\n    host: 'connection.groupon.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CREDIT_INFO: {\n    id: 'cloud-keboola-creditinfo',\n    host: 'connection.creditinfo.keboola.cloud',\n    isSingleTenant: true,\n  },\n  COATES: {\n    id: 'cloud-keboola-coates',\n    host: 'connection.coates.keboola.cloud',\n    isSingleTenant: true,\n  },\n  SLSP: {\n    id: 'cloud-keboola-slsp',\n    host: 'connection.slsp.keboola.cloud',\n    isSingleTenant: true,\n  },\n  HCKZ: {\n    id: 'cloud-keboola-hckz',\n    host: 'connection.hckz.keboola.cloud',\n    isSingleTenant: true,\n  },\n  PASHA: {\n    id: 'cloud-keboola-pasha',\n    host: 'connection.pasha.keboola.cloud',\n    isSingleTenant: true,\n  },\n  RBI: {\n    id: 'cloud-keboola-rbi',\n    host: 'connection.rbi.keboola.cloud',\n    isSingleTenant: true,\n  },\n  NAH: {\n    id: 'cloud-keboola-nah',\n    host: 'connection.nah.keboola.cloud',\n    isSingleTenant: true,\n    provider: 'azure',\n    continent: 'us',\n  },\n\n  /* DEV STACKS\n     ---------------------------- */\n  DEV_US_CENTRAL_1_GCP: {\n    id: 'dev-keboola-gcp-us-central1',\n    region: 'us-central1',\n    host: 'connection.us-central1.gcp.keboola.dev',\n    provider: 'gcp',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_EU_WEST_1_AWS: {\n    id: 'dev-keboola-aws-eu-west-1',\n    region: 'eu-west-1',\n    host: 'connection.eu-west-1.aws.keboola.dev',\n    provider: 'aws',\n    continent: 'europe',\n    isTesting: true,\n  },\n  DEV_US_EAST_1_AWS_E2E: {\n    id: 'dev-keboola-aws-us-east-1-e2e',\n    region: 'us-east-1',\n    host: 'connection.e2e.us-east-1.aws.keboola.dev',\n    provider: 'aws',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_US_EAST_2_AZURE: {\n    id: 'kbc-testing-azure-east-us-2',\n    region: 'east-us-2',\n    host: 'connection.east-us-2.azure.keboola-testing.com',\n    provider: 'azure',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_KEBOOLA_CANARY_ORION: {\n    id: 'dev-keboola-canary-orion',\n    region: 'europe-west3',\n    host: 'connection.canary-orion.keboola.dev',\n    provider: 'gcp',\n    continent: 'europe',\n    isCanary: true,\n  },\n} satisfies Record<string, Readonly<KeboolaStack>>;\n\n/**\n * Every stack the platform knows, keyed by name.\n *\n * - The key set is literal, so a name that is not in the object is a compile error at the call site\n *   rather than an `undefined` to fall back from.\n * - The value type stays the uniform `KeboolaStack`, so `stack.isCanary` reads on any entry, not\n *   only on the ones that carry the flag.\n */\nexport const STACKS: Record<keyof typeof stacks, Readonly<KeboolaStack>> = stacks;\n","export { ComponentId } from './componentId';\nexport { ProjectFeature } from './projectFeatures';\nexport { Backend } from './backends';\nexport { AdminRole } from './adminRoles';\nexport { ServiceId } from './serviceIds';\nexport { Continent, Provider, STACKS } from './stacks';\nexport type { KeboolaStack } from './stacks';\n\nexport const URLS = {\n  USER_DOCUMENTATION: 'https://help.keboola.com',\n  COMPONENTS: 'https://components.keboola.com',\n  DEVELOPERS_DOCUMENTATION: 'https://developers.keboola.com',\n  ACADEMY: 'https://academy.keboola.com',\n  SALES_CONTACT_FORM: 'https://keboola.com/contact',\n  SNOWFLAKE: 'https://www.snowflake.com',\n  SNOWFLAKE_DOCS: 'https://docs.snowflake.com',\n  MCP: 'https://www.keboola.com/mcp',\n  CLI: 'https://www.keboola.com/cli',\n  NODE_JS: 'https://nodejs.org/en',\n  CLAUDE_CONNECTORS: 'https://claude.ai/customize/connectors',\n  // Vendor \"how do I get this client\" pages linked from the connect surfaces.\n  CLIENT_CLAUDE_CODE_QUICKSTART: 'https://code.claude.com/docs/en/quickstart',\n  CLIENT_CLAUDE_AI: 'https://claude.ai',\n  CLIENT_CLAUDE_DESKTOP_DOWNLOAD: 'https://claude.com/download',\n  CLIENT_CURSOR_QUICKSTART: 'https://cursor.com/docs/get-started/quickstart',\n  CLIENT_VS_CODE_SETUP: 'https://code.visualstudio.com/docs/setup/setup-overview',\n  CLIENT_CODEX_QUICKSTART: 'https://developers.openai.com/codex/cli',\n  CLIENT_CHATGPT_DOWNLOAD: 'https://chatgpt.com/download',\n  CLIENT_MAKE_GET_STARTED: 'https://help.make.com/get-started',\n  CLIENT_DEVIN_DESKTOP: 'https://docs.devin.ai/desktop/getting-started',\n} as const;\n"],"mappings":";AAAA,MAAa,iBAAiB;CAC5B,2BAA2B;CAC3B,2BAA2B;CAC3B,iBAAiB;AACnB;;;;;;;;;;ACGA,MAAa,YAAY;CACvB,OAAO;CACP,aAAa;CACb,YAAY;CACZ,WAAW;CACX,IAAI;CACJ,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,OAAO;CACP,OAAO;CACP,cAAc;CACd,UAAU;CACV,eAAe;CACf,aAAa;CACb,QAAQ;CACR,cAAc;CACd,WAAW;CACX,WAAW;CACX,SAAS;AACX;;;AC3BA,MAAa,UAAU;CACrB,WAAW;CACX,UAAU;AACZ;;;ACHA,MAAa,WAAW;CACtB,KAAK;CACL,OAAO;CACP,KAAK;AACP;AAIA,MAAa,YAAY;CACvB,IAAI;CACJ,QAAQ;AACV;;;;;;;;;AA4KA,MAAa,SAA8D;CA3JzE,oBAAoB;EAClB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,QAAQ;CACV;CACA,kBAAkB;EAChB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,eAAe;EACb,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,kBAAkB;EAChB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,eAAe;EACb,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,QAAQ;CACV;CAIA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,WAAW;EACT,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,WAAW;EACT,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,SAAS;EACP,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,aAAa;EACX,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,OAAO;EACL,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;EAChB,UAAU;EACV,WAAW;CACb;CAIA,sBAAsB;EACpB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,mBAAmB;EACjB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,uBAAuB;EACrB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,qBAAqB;EACnB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,0BAA0B;EACxB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,UAAU;CACZ;AAWyE;;;AC/K3E,MAAa,OAAO;CAClB,oBAAoB;CACpB,YAAY;CACZ,0BAA0B;CAC1B,SAAS;CACT,oBAAoB;CACpB,WAAW;CACX,gBAAgB;CAChB,KAAK;CACL,KAAK;CACL,SAAS;CACT,mBAAmB;CAEnB,+BAA+B;CAC/B,kBAAkB;CAClB,gCAAgC;CAChC,0BAA0B;CAC1B,sBAAsB;CACtB,yBAAyB;CACzB,yBAAyB;CACzB,yBAAyB;CACzB,sBAAsB;AACxB"}

package/dist/{constants-BDGRQqij.cjs → constants-a0jswUeK.cjs}

@@ -5,18 +5,12 @@ const ProjectFeature = {
 	StorageBranches: "storage-branches"
 };
 //#endregion
-//#region src/constants/backends.ts
-const Backend = {
-	Snowflake: "snowflake",
-	Bigquery: "bigquery"
-};
-//#endregion
 //#region src/constants/serviceIds.ts
 /**
 * Every service a Keboola stack can announce in its `GET /v2/storage` index.
 *
-* - The values are the `id`s the stack reports; `Service['id']` and the service-client registry
-*   both narrow on them.
+* - The values are the `id`s the stack reports; the service-client registry and `createStack`'s
+*   lookups narrow on them. The index itself stays `string` — a stack may announce more.
 * - Callers enumerate them at runtime — a test double announcing every service, for one.
 */
 const ServiceId = {
@@ -32,6 +26,7 @@ const ServiceId = {
 	Queue: "queue",
 	KaiAssistant: "kai-assistant",
 	KaiAgent: "kai-agent",
+	ComponentsMcp: "components-mcp",
 	SyncActions: "sync-actions",
 	Stream: "stream",
 	Notification: "notification",
@@ -40,6 +35,12 @@ const ServiceId = {
 	Billing: "billing"
 };
 //#endregion
+//#region src/constants/backends.ts
+const Backend = {
+	Snowflake: "snowflake",
+	Bigquery: "bigquery"
+};
+//#endregion
 //#region src/constants/stacks.ts
 const Provider = {
 	Aws: "aws",
@@ -267,4 +268,4 @@ Object.defineProperty(exports, "URLS", {
 	}
 });
 
-//# sourceMappingURL=constants-BDGRQqij.cjs.map
+//# sourceMappingURL=constants-a0jswUeK.cjs.map