@keboola/api-client 46.0.0 → 48.0.0

package/dist/{collect-B5TCNiT1.cjs → collectByOffset-DQsqtmJg.cjs}

@@ -1,5 +1,5 @@
 const require_createAbortError = require("./createAbortError-RendOpo7.cjs");
-//#region src/utils/async/collect.ts
+//#region src/utils/async/collectByOffset.ts
 /**
 * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when
 * `limit` is omitted. Calls `fetchFrom` sequentially with the offset advancing by the number of
@@ -9,10 +9,10 @@ const require_createAbortError = require("./createAbortError-RendOpo7.cjs");
 * empty page. Passing it therefore saves the trailing request, at the cost of stopping early if the
 * endpoint returns fewer items per page than asked for.
 */
-const collect = async ({ fetchFrom, pageSize, limit, signal }) => {
+const collectByOffset = async ({ fetchFrom, pageSize, limit, signal }) => {
 	if (signal?.aborted) throw require_createAbortError.createAbortError(signal.reason);
-	if (limit !== void 0 && limit < 0) throw new Error("Invalid collect limit");
-	if (pageSize !== void 0 && pageSize < 1) throw new Error("Invalid collect pageSize");
+	if (limit !== void 0 && limit < 0) throw new Error("Invalid collectByOffset limit");
+	if (pageSize !== void 0 && pageSize < 1) throw new Error("Invalid collectByOffset pageSize");
 	const items = [];
 	if (limit === 0) return items;
 	let offset = 0;
@@ -25,11 +25,11 @@ const collect = async ({ fetchFrom, pageSize, limit, signal }) => {
 	}
 };
 //#endregion
-Object.defineProperty(exports, "collect", {
+Object.defineProperty(exports, "collectByOffset", {
 	enumerable: true,
 	get: function() {
-		return collect;
+		return collectByOffset;
 	}
 });
 
-//# sourceMappingURL=collect-B5TCNiT1.cjs.map
+//# sourceMappingURL=collectByOffset-DQsqtmJg.cjs.map

package/dist/collectByOffset-DQsqtmJg.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectByOffset-DQsqtmJg.cjs","names":["createAbortError"],"sources":["../src/utils/async/collectByOffset.ts"],"sourcesContent":["import { createAbortError } from '../createAbortError';\n\nexport type CollectByOffsetOptions<T> = {\n  fetchFrom: (offset: number, pageSize?: number, signal?: AbortSignal) => Promise<T[]>;\n  pageSize?: number;\n  limit?: number;\n  signal?: AbortSignal;\n};\n\n/**\n * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when\n * `limit` is omitted. Calls `fetchFrom` sequentially with the offset advancing by the number of\n * items received, and hands it `pageSize` so the request and the traversal agree on one value.\n *\n * Traversal ends on a page shorter than `pageSize`, or — when `pageSize` is omitted — only on an\n * empty page. Passing it therefore saves the trailing request, at the cost of stopping early if the\n * endpoint returns fewer items per page than asked for.\n */\nexport const collectByOffset = async <T>({\n  fetchFrom,\n  pageSize,\n  limit,\n  signal,\n}: CollectByOffsetOptions<T>): Promise<T[]> => {\n  if (signal?.aborted) throw createAbortError(signal.reason);\n  if (limit !== undefined && limit < 0) throw new Error('Invalid collectByOffset limit');\n  if (pageSize !== undefined && pageSize < 1) throw new Error('Invalid collectByOffset pageSize');\n\n  const items: T[] = [];\n\n  if (limit === 0) return items;\n\n  let offset = 0;\n\n  while (true) {\n    const batch = await fetchFrom(offset, pageSize, signal);\n\n    items.push(...batch);\n    offset += batch.length;\n\n    if (limit !== undefined && items.length >= limit) return items.slice(0, limit);\n    if (pageSize === undefined ? batch.length === 0 : batch.length < pageSize) return items;\n  }\n};\n"],"mappings":";;;;;;;;;;;AAkBA,MAAa,kBAAkB,OAAU,EACvC,WACA,UACA,OACA,aAC6C;CAC7C,IAAI,QAAQ,SAAS,MAAMA,yBAAAA,iBAAiB,OAAO,MAAM;CACzD,IAAI,UAAU,KAAA,KAAa,QAAQ,GAAG,MAAM,IAAI,MAAM,+BAA+B;CACrF,IAAI,aAAa,KAAA,KAAa,WAAW,GAAG,MAAM,IAAI,MAAM,kCAAkC;CAE9F,MAAM,QAAa,CAAC;CAEpB,IAAI,UAAU,GAAG,OAAO;CAExB,IAAI,SAAS;CAEb,OAAO,MAAM;EACX,MAAM,QAAQ,MAAM,UAAU,QAAQ,UAAU,MAAM;EAEtD,MAAM,KAAK,GAAG,KAAK;EACnB,UAAU,MAAM;EAEhB,IAAI,UAAU,KAAA,KAAa,MAAM,UAAU,OAAO,OAAO,MAAM,MAAM,GAAG,KAAK;EAC7E,IAAI,aAAa,KAAA,IAAY,MAAM,WAAW,IAAI,MAAM,SAAS,UAAU,OAAO;CACpF;AACF"}

package/dist/componentsMcp/index.cjs

@@ -0,0 +1,3 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_componentsMcp = require("../componentsMcp-pG-PcQrg.cjs");
+exports.createComponentsMcpClient = require_componentsMcp.createComponentsMcpClient;

package/dist/componentsMcp/index.d.cts

@@ -0,0 +1,2 @@
+import { i as StoredConnectorCredentials, n as Connector, r as ConnectorsResponse, t as createComponentsMcpClient } from "../index-Co2Cd-nw.cjs";
+export { type Connector, type ConnectorsResponse, type StoredConnectorCredentials, createComponentsMcpClient };

package/dist/componentsMcp/index.d.ts

@@ -0,0 +1,2 @@
+import { i as StoredConnectorCredentials, n as Connector, r as ConnectorsResponse, t as createComponentsMcpClient } from "../index-BLvmyehw.js";
+export { type Connector, type ConnectorsResponse, type StoredConnectorCredentials, createComponentsMcpClient };

package/dist/componentsMcp/index.js

@@ -0,0 +1,2 @@
+import { t as createComponentsMcpClient } from "../componentsMcp-CHobIsuU.js";
+export { createComponentsMcpClient };

package/dist/componentsMcp/types.d.cts

@@ -0,0 +1,2 @@
+import { n as SetConnectorCredentialsBody, r as SetConnectorCredentialsPath, t as GetConnectorsQuery } from "../types-BtS3DhGu.cjs";
+export { GetConnectorsQuery, SetConnectorCredentialsBody, SetConnectorCredentialsPath };

package/dist/componentsMcp/types.d.ts

@@ -0,0 +1,2 @@
+import { n as SetConnectorCredentialsBody, r as SetConnectorCredentialsPath, t as GetConnectorsQuery } from "../types-BXHZQvGy.js";
+export { GetConnectorsQuery, SetConnectorCredentialsBody, SetConnectorCredentialsPath };

package/dist/componentsMcp/types.js

@@ -0,0 +1 @@
+export {};

package/dist/componentsMcp-CHobIsuU.js

@@ -0,0 +1,57 @@
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-DXiMv9WL.js";
+import { t as createAuthHeaders } from "./auth-4coY1uwo.js";
+import { z } from "zod";
+//#region src/clients/componentsMcp/schemas.ts
+const connectorSchema = z.looseObject({
+	id: z.string(),
+	provider: z.string(),
+	display_name: z.string(),
+	description: z.string(),
+	has_stored_credentials: z.boolean(),
+	credentials_schema: z.record(z.string(), z.unknown())
+});
+const connectorsResponseSchema = z.looseObject({
+	providers: z.record(z.string(), z.number()),
+	connectors: z.array(connectorSchema)
+});
+const storedConnectorCredentialsSchema = z.looseObject({
+	connector: z.string(),
+	label: z.string(),
+	status: z.literal("stored")
+});
+//#endregion
+//#region src/clients/componentsMcp/componentsMcpClient.ts
+/**
+* Components MCP, the connector vault behind Kai's credential form.
+*/
+const createComponentsMcpClient = ({ baseUrl, middlewares, auth }) => {
+	const client = createOpenapiFetchClient({
+		baseUrl,
+		middlewares,
+		headers: createAuthHeaders(auth)
+	});
+	const healthCheck = async (signal) => {
+		const { data } = await client.get("/", {}, { signal });
+		return data;
+	};
+	const getConnectors = async (query = {}, signal) => {
+		const { data } = await client.get("/connectors", { query }, { signal });
+		return connectorsResponseSchema.parse(data);
+	};
+	const setConnectorCredentials = async (path, body, signal) => {
+		const { data } = await client.put("/connectors/{connector_id}/credentials", {
+			path,
+			body
+		}, { signal });
+		return storedConnectorCredentialsSchema.parse(data);
+	};
+	return {
+		healthCheck,
+		getConnectors,
+		setConnectorCredentials
+	};
+};
+//#endregion
+export { createComponentsMcpClient as t };
+
+//# sourceMappingURL=componentsMcp-CHobIsuU.js.map

package/dist/componentsMcp-CHobIsuU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentsMcp-CHobIsuU.js","names":[],"sources":["../src/clients/componentsMcp/schemas.ts","../src/clients/componentsMcp/componentsMcpClient.ts"],"sourcesContent":["import { z } from 'zod';\n\n// The spec publishes both responses as an open object; shapes follow keboola/components-mcp\n// (`Connector.describe()` in src/connectors/base.py, the route handlers in src/app.py).\nconst connectorSchema = z.looseObject({\n  id: z.string(),\n  provider: z.string(),\n  display_name: z.string(),\n  description: z.string(),\n  has_stored_credentials: z.boolean(),\n  // A JSON schema; `required` empty means the connector takes no stored credentials.\n  credentials_schema: z.record(z.string(), z.unknown()),\n});\n\nexport const connectorsResponseSchema = z.looseObject({\n  providers: z.record(z.string(), z.number()),\n  connectors: z.array(connectorSchema),\n});\n\nexport const storedConnectorCredentialsSchema = z.looseObject({\n  connector: z.string(),\n  label: z.string(),\n  status: z.literal('stored'),\n});\n\nexport type Connector = z.infer<typeof connectorSchema>;\nexport type ConnectorsResponse = z.infer<typeof connectorsResponseSchema>;\nexport type StoredConnectorCredentials = z.infer<typeof storedConnectorCredentialsSchema>;\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { ConnectorsResponse, StoredConnectorCredentials } from './schemas';\nimport { connectorsResponseSchema, storedConnectorCredentialsSchema } from './schemas';\nimport type {\n  GetConnectorsQuery,\n  SetConnectorCredentialsBody,\n  SetConnectorCredentialsPath,\n} from './types';\n\n/**\n * Components MCP, the connector vault behind Kai's credential form.\n */\nexport const createComponentsMcpClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/', {}, { signal });\n\n    return data;\n  };\n\n  const getConnectors = async (\n    query: GetConnectorsQuery = {},\n    signal?: AbortSignal,\n  ): Promise<ConnectorsResponse> => {\n    const { data } = await client.get('/connectors', { query }, { signal });\n\n    return connectorsResponseSchema.parse(data);\n  };\n\n  // `connector` in the response is the canonical id; an alias in the path is stored under it.\n  const setConnectorCredentials = async (\n    path: SetConnectorCredentialsPath,\n    body: SetConnectorCredentialsBody,\n    signal?: AbortSignal,\n  ): Promise<StoredConnectorCredentials> => {\n    const { data } = await client.put(\n      '/connectors/{connector_id}/credentials',\n      { path, body },\n      { signal },\n    );\n\n    return storedConnectorCredentialsSchema.parse(data);\n  };\n\n  return {\n    healthCheck,\n    getConnectors,\n    setConnectorCredentials,\n  };\n};\n"],"mappings":";;;;AAIA,MAAM,kBAAkB,EAAE,YAAY;CACpC,IAAI,EAAE,OAAO;CACb,UAAU,EAAE,OAAO;CACnB,cAAc,EAAE,OAAO;CACvB,aAAa,EAAE,OAAO;CACtB,wBAAwB,EAAE,QAAQ;CAElC,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AACtD,CAAC;AAED,MAAa,2BAA2B,EAAE,YAAY;CACpD,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;CAC1C,YAAY,EAAE,MAAM,eAAe;AACrC,CAAC;AAED,MAAa,mCAAmC,EAAE,YAAY;CAC5D,WAAW,EAAE,OAAO;CACpB,OAAO,EAAE,OAAO;CAChB,QAAQ,EAAE,QAAQ,QAAQ;AAC5B,CAAC;;;;;;ACPD,MAAa,6BAA6B,EAAE,SAAS,aAAa,WAA8B;CAC9F,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CAED,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,gBAAgB,OACpB,QAA4B,CAAC,GAC7B,WACgC;EAChC,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,eAAe,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EAEtE,OAAO,yBAAyB,MAAM,IAAI;CAC5C;CAGA,MAAM,0BAA0B,OAC9B,MACA,MACA,WACwC;EACxC,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,0CACA;GAAE;GAAM;EAAK,GACb,EAAE,OAAO,CACX;EAEA,OAAO,iCAAiC,MAAM,IAAI;CACpD;CAEA,OAAO;EACL;EACA;EACA;CACF;AACF"}

package/dist/componentsMcp-pG-PcQrg.cjs

@@ -0,0 +1,62 @@
+const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-DHYo_k3t.cjs");
+const require_auth = require("./auth-C8Pjl0Mu.cjs");
+let zod = require("zod");
+//#region src/clients/componentsMcp/schemas.ts
+const connectorSchema = zod.z.looseObject({
+	id: zod.z.string(),
+	provider: zod.z.string(),
+	display_name: zod.z.string(),
+	description: zod.z.string(),
+	has_stored_credentials: zod.z.boolean(),
+	credentials_schema: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+const connectorsResponseSchema = zod.z.looseObject({
+	providers: zod.z.record(zod.z.string(), zod.z.number()),
+	connectors: zod.z.array(connectorSchema)
+});
+const storedConnectorCredentialsSchema = zod.z.looseObject({
+	connector: zod.z.string(),
+	label: zod.z.string(),
+	status: zod.z.literal("stored")
+});
+//#endregion
+//#region src/clients/componentsMcp/componentsMcpClient.ts
+/**
+* Components MCP, the connector vault behind Kai's credential form.
+*/
+const createComponentsMcpClient = ({ baseUrl, middlewares, auth }) => {
+	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({
+		baseUrl,
+		middlewares,
+		headers: require_auth.createAuthHeaders(auth)
+	});
+	const healthCheck = async (signal) => {
+		const { data } = await client.get("/", {}, { signal });
+		return data;
+	};
+	const getConnectors = async (query = {}, signal) => {
+		const { data } = await client.get("/connectors", { query }, { signal });
+		return connectorsResponseSchema.parse(data);
+	};
+	const setConnectorCredentials = async (path, body, signal) => {
+		const { data } = await client.put("/connectors/{connector_id}/credentials", {
+			path,
+			body
+		}, { signal });
+		return storedConnectorCredentialsSchema.parse(data);
+	};
+	return {
+		healthCheck,
+		getConnectors,
+		setConnectorCredentials
+	};
+};
+//#endregion
+Object.defineProperty(exports, "createComponentsMcpClient", {
+	enumerable: true,
+	get: function() {
+		return createComponentsMcpClient;
+	}
+});
+
+//# sourceMappingURL=componentsMcp-pG-PcQrg.cjs.map

package/dist/componentsMcp-pG-PcQrg.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"componentsMcp-pG-PcQrg.cjs","names":["z","createOpenapiFetchClient","createAuthHeaders"],"sources":["../src/clients/componentsMcp/schemas.ts","../src/clients/componentsMcp/componentsMcpClient.ts"],"sourcesContent":["import { z } from 'zod';\n\n// The spec publishes both responses as an open object; shapes follow keboola/components-mcp\n// (`Connector.describe()` in src/connectors/base.py, the route handlers in src/app.py).\nconst connectorSchema = z.looseObject({\n  id: z.string(),\n  provider: z.string(),\n  display_name: z.string(),\n  description: z.string(),\n  has_stored_credentials: z.boolean(),\n  // A JSON schema; `required` empty means the connector takes no stored credentials.\n  credentials_schema: z.record(z.string(), z.unknown()),\n});\n\nexport const connectorsResponseSchema = z.looseObject({\n  providers: z.record(z.string(), z.number()),\n  connectors: z.array(connectorSchema),\n});\n\nexport const storedConnectorCredentialsSchema = z.looseObject({\n  connector: z.string(),\n  label: z.string(),\n  status: z.literal('stored'),\n});\n\nexport type Connector = z.infer<typeof connectorSchema>;\nexport type ConnectorsResponse = z.infer<typeof connectorsResponseSchema>;\nexport type StoredConnectorCredentials = z.infer<typeof storedConnectorCredentialsSchema>;\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { ConnectorsResponse, StoredConnectorCredentials } from './schemas';\nimport { connectorsResponseSchema, storedConnectorCredentialsSchema } from './schemas';\nimport type {\n  GetConnectorsQuery,\n  SetConnectorCredentialsBody,\n  SetConnectorCredentialsPath,\n} from './types';\n\n/**\n * Components MCP, the connector vault behind Kai's credential form.\n */\nexport const createComponentsMcpClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/', {}, { signal });\n\n    return data;\n  };\n\n  const getConnectors = async (\n    query: GetConnectorsQuery = {},\n    signal?: AbortSignal,\n  ): Promise<ConnectorsResponse> => {\n    const { data } = await client.get('/connectors', { query }, { signal });\n\n    return connectorsResponseSchema.parse(data);\n  };\n\n  // `connector` in the response is the canonical id; an alias in the path is stored under it.\n  const setConnectorCredentials = async (\n    path: SetConnectorCredentialsPath,\n    body: SetConnectorCredentialsBody,\n    signal?: AbortSignal,\n  ): Promise<StoredConnectorCredentials> => {\n    const { data } = await client.put(\n      '/connectors/{connector_id}/credentials',\n      { path, body },\n      { signal },\n    );\n\n    return storedConnectorCredentialsSchema.parse(data);\n  };\n\n  return {\n    healthCheck,\n    getConnectors,\n    setConnectorCredentials,\n  };\n};\n"],"mappings":";;;;AAIA,MAAM,kBAAkBA,IAAAA,EAAE,YAAY;CACpC,IAAIA,IAAAA,EAAE,OAAO;CACb,UAAUA,IAAAA,EAAE,OAAO;CACnB,cAAcA,IAAAA,EAAE,OAAO;CACvB,aAAaA,IAAAA,EAAE,OAAO;CACtB,wBAAwBA,IAAAA,EAAE,QAAQ;CAElC,oBAAoBA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,QAAQ,CAAC;AACtD,CAAC;AAED,MAAa,2BAA2BA,IAAAA,EAAE,YAAY;CACpD,WAAWA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,OAAO,CAAC;CAC1C,YAAYA,IAAAA,EAAE,MAAM,eAAe;AACrC,CAAC;AAED,MAAa,mCAAmCA,IAAAA,EAAE,YAAY;CAC5D,WAAWA,IAAAA,EAAE,OAAO;CACpB,OAAOA,IAAAA,EAAE,OAAO;CAChB,QAAQA,IAAAA,EAAE,QAAQ,QAAQ;AAC5B,CAAC;;;;;;ACPD,MAAa,6BAA6B,EAAE,SAAS,aAAa,WAA8B;CAC9F,MAAM,SAASC,iCAAAA,yBAAgC;EAC7C;EACA;EACA,SAASC,aAAAA,kBAAkB,IAAI;CACjC,CAAC;CAED,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,gBAAgB,OACpB,QAA4B,CAAC,GAC7B,WACgC;EAChC,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,eAAe,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EAEtE,OAAO,yBAAyB,MAAM,IAAI;CAC5C;CAGA,MAAM,0BAA0B,OAC9B,MACA,MACA,WACwC;EACxC,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,0CACA;GAAE;GAAM;EAAK,GACb,EAAE,OAAO,CACX;EAEA,OAAO,iCAAiC,MAAM,IAAI;CACpD;CAEA,OAAO;EACL;EACA;EACA;CACF;AACF"}

package/dist/{configurations-D_Rbs0Wl.cjs → configurations-B2O8AAy0.cjs}

@@ -1,5 +1,5 @@
 const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_configurations = require("./configurations-BTRHVSRq.cjs");
+const require_configurations = require("./configurations-D9J3jh3g.cjs");
 const require_componentId = require("./componentId-D4jp6a13.cjs");
 let zod = require("zod");
 //#region src/utils/isEmptyDeep.ts
@@ -732,4 +732,4 @@ Object.defineProperty(exports, "schemaGuidedMerge", {
 	}
 });
 
-//# sourceMappingURL=configurations-D_Rbs0Wl.cjs.map
+//# sourceMappingURL=configurations-B2O8AAy0.cjs.map

package/dist/{configurations-D_Rbs0Wl.cjs.map → configurations-B2O8AAy0.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"configurations-D_Rbs0Wl.cjs","names":["isPlainObject","z","isPlainObject","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","snowflakeCommon","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","ComponentId"],"sources":["../src/utils/isEmptyDeep.ts","../src/utils/schemaGuidedMerge.ts","../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../src/sdks/configurations/schemas/common/dbConfig.ts","../src/sdks/configurations/schemas/common/dbConnection.ts","../src/sdks/configurations/schemas/common/forbidden.ts","../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../src/sdks/configurations/schemas/common/sslSchema.ts","../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../src/sdks/configurations/schemas/googleAdsSchema.ts","../src/sdks/configurations/schemas/schedulerSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../src/sdks/configurations/createRegistry/createRegistry.ts","../src/sdks/configurations/registry.ts","../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { isPlainObject } from './isPlainObject';\n\n/**\n * Is `value` \"deeply empty\" — i.e. carries no leaf data? `null`/`undefined`, `{}`, `[]`, and\n * nested structures whose every leaf is itself empty (e.g. `{ parameters: {} }`) are empty.\n * Any present primitive (string, number, boolean — including `''`) counts as content.\n *\n * Used to skip a pointless encryption round-trip when a validated configuration has nothing\n * to encrypt.\n */\nexport const isEmptyDeep = (value: unknown): boolean => {\n  if (value == null) return true;\n  if (Array.isArray(value)) return value.every(isEmptyDeep);\n  if (isPlainObject(value)) return Object.values(value).every(isEmptyDeep);\n  return false;\n};\n","import { z } from 'zod';\n\nimport { isPlainObject } from './isPlainObject';\n\n/** Strip optional/nullable/default wrappers to reach the structural schema node. */\nconst unwrap = (schema: z.core.$ZodType): z.core.$ZodType =>\n  schema instanceof z.ZodOptional ||\n  schema instanceof z.ZodNullable ||\n  schema instanceof z.ZodDefault\n    ? unwrap(schema.unwrap())\n    : schema;\n\n/**\n * Merge `patch` into `base`, descending only through object schemas.\n *\n * - At a non-object node (union, array, primitive) the patch replaces the base wholesale, so\n *   switching a union variant drops the old variant's secret.\n * - Hence a union or array subtree is all-or-nothing: send the complete block.\n * - Keys only in `base` are kept; `undefined` patch values are skipped.\n * - Assumes `patch` is schema-validated. Pure.\n */\nexport const schemaGuidedMerge = <T extends Record<string, unknown>>(\n  schema: z.core.$ZodType,\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const node = unwrap(schema);\n  if (!(node instanceof z.ZodObject) || !isPlainObject(base)) return patch as T;\n\n  const out: Record<string, unknown> = { ...base };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const child = node.shape[key];\n    const current = out[key];\n    out[key] =\n      child && isPlainObject(current) && isPlainObject(value)\n        ? schemaGuidedMerge(child, current, value)\n        : value;\n  }\n\n  return out as T;\n};\n","import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials with an optional SSH tunnel, for the generic SSH-only drivers.\n *\n * - Keep in sync with kbc-ui's `hasSshTunnel` / `hasSsl` (`ex-db-generic/helpers.ts`).\n * - SSL-capable, tunnel-less and extra-field drivers get their own schema.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    continueOnFailure: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { createDefaultBranch } from '../../domain/defaultBranch';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are\n *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.\n * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,\n *   e.g. `storage`, is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,eAAe,UAA4B;CACtD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,MAAM,WAAW;CACxD,IAAIA,sBAAAA,cAAc,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,WAAW;CACvE,OAAO;AACT;;;;ACVA,MAAM,UAAU,WACd,kBAAkBC,IAAAA,EAAE,eACpB,kBAAkBA,IAAAA,EAAE,eACpB,kBAAkBA,IAAAA,EAAE,aAChB,OAAO,OAAO,OAAO,CAAC,IACtB;;;;;;;;;;AAWN,MAAa,qBACX,QACA,MACA,UACM;CACN,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,EAAE,gBAAgBA,IAAAA,EAAE,cAAc,CAACC,sBAAAA,cAAc,IAAI,GAAG,OAAO;CAEnE,MAAM,MAA+B,EAAE,GAAG,KAAK;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OACF,SAASA,sBAAAA,cAAc,OAAO,KAAKA,sBAAAA,cAAc,KAAK,IAClD,kBAAkB,OAAO,SAAS,KAAK,IACvC;CACR;CAEA,OAAO;AACT;;;;;;;;AClCA,MAAa,uBAAuBC,IAAAA,EAAE,OAAO,EAC3C,YAAYA,IAAAA,EAAE,OAAO,EACnB,IAAIA,IAAAA,EAAE,OAAO,EACX,aAAaA,IAAAA,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;;ACVD,MAAa,YAAkC,OAC7CC,IAAAA,EAAE,OAAO,EAAE,YAAYA,IAAAA,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;;ACI3C,MAAa,qBAAqBC,IAAAA,EAAE,OAAO;CACzC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;;ACLD,MAAa,YAAYC,IAAAA,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;;ACFhD,MAAa,2BAA2BC,IAAAA,EAAE,OAAO,EAC/C,WAAWA,IAAAA,EAAE,OAAO;CAClB,IAAIA,IAAAA,EAAE,OAAO;CACb,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;;ACVD,MAAa,kBAAkBC,IAAAA,EAAE,OAAO;CACtC,SAASA,IAAAA,EAAE,QAAQ;CACnB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAMA,IAAAA,EACH,OAAO;EACN,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;ACZD,MAAa,YAAYC,IAAAA,EAAE,OAAO;CAChC,SAASA,IAAAA,EAAE,QAAQ;CACnB,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;;ACAD,MAAM,gBAAgBC,IAAAA,EAAE,OAAO;CAC7B,aAAaA,IAAAA,EAAE,OAAO;CACtB,aAAaA,IAAAA,EAAE,OAAO;CACtB,iBAAiBA,IAAAA,EAAE,OAAO;CAC1B,WAAWA,IAAAA,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+BA,IAAAA,EAAE,OAAO,EACnD,YAAYA,IAAAA,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoBA,IAAAA,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuBA,IAAAA,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;;ACfD,MAAM,qBAAqBC,IAAAA,EACxB,OAAO;CACN,WAAWA,IAAAA,EAAE,QAAQ,aAAa;CAClC,aAAaA,IAAAA,EAAE,OAAO;CACtB,oBAAoBA,IAAAA,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAcA,IAAAA,EACjB,OAAO;CACN,WAAWA,IAAAA,EAAE,QAAQ,MAAM;CAC3B,WAAWA,IAAAA,EAAE,OAAO;CACpB,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgBA,IAAAA,EAC1B,OAAO,EACN,YAAYA,IAAAA,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;;AChCT,MAAa,oBAAoBC,IAAAA,EAC9B,OAAO,EACN,YAAYA,IAAAA,EACT,OAAO;CACN,cAAcA,IAAAA,EAAE,OAAO;CACvB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,gBAAgBA,IAAAA,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;;ACVT,MAAa,wBAAwBC,IAAAA,EAClC,OAAO,EACN,YAAYA,IAAAA,EACT,OAAO;CACN,cAAcA,IAAAA,EAAE,OAAO;CACvB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;ACZT,MAAM,gBAAgBC,IAAAA,EAAE,OAAO;CAC7B,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,gBAAgBA,IAAAA,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAUA,IAAAA,EAAE,OAAO;CACnB,sBAAsBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAcA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAeA,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAcA,IAAAA,EACxB,OAAO,EACN,YAAYA,IAAAA,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;;AC/BT,MAAa,eAAeC,IAAAA,EACzB,OAAO,EACN,YAAYA,IAAAA,EAAE,OAAO;CAAE,SAASA,IAAAA,EAAE,OAAO;CAAG,cAAcA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;;ACJT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;;ACPA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2BA,IAAAA,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAMC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAMC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACTA,MAAa,qBAAqB,SAChCC,IAAAA,EAAE,OAAO;CAAE,QAAQA,IAAAA,EAAE,OAAO;CAAG,MAAMA,IAAAA,EAAE,OAAO;CAAG,aAAaA,IAAAA,EAAE,OAAO;AAAE,CAAC,CAC5E;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAYC,IAAAA,EAAE,OAAO;CACrB,UAAUA,IAAAA,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;;ACDA,MAAMC,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,MAAM,CACND,kBAAgB,OAAO;CAAE,aAAaC,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5ED,kBAAgB,OAAO;CAAE,eAAeC,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;ACdA,MAAa,qBAAqB,SAChCC,IAAAA,EAAE,OAAO;CACP,WAAWA,IAAAA,EAAE,OAAO;CACpB,QAAQA,IAAAA,EAAE,OAAO;CACjB,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,oBAAoBA,IAAAA,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAYA,IAAAA,EAAE,OAAO;CACrB,SAASA,IAAAA,EAAE,OAAO;CAClB,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;;ACfA,MAAM,iBAAiBC,IAAAA,EAAE,OAAO;CAC9B,MAAMA,IAAAA,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAUA,IAAAA,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAcA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAWA,IAAAA,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAeA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgBA,IAAAA,EAAE,OAAO;CAC7B,OAAOA,IAAAA,EAAE,OAAO;CAChB,UAAUA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAASA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoBA,IAAAA,EAAE,OAAO;CACjC,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAaA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuBA,IAAAA,EAAE,OAAO,EAC3C,YAAYA,IAAAA,EAAE,OAAO;CACnB,SAASA,IAAAA,EAAE,OAAO;EAAE,KAAKA,IAAAA,EAAE,OAAO;EAAG,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAMA,IAAAA,EAAE,OAAO;EAAE,OAAOA,IAAAA,EAAE,OAAO;EAAG,aAAaA,IAAAA,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAUA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAWA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAYA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;;ACjED,MAAa,oBAAoBC,IAAAA,EAAE,OAAO;CACxC,eAAe;CACf,YAAYA,IAAAA,EAAE,OAAO;EACnB,YAAYA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC;EAC9B,sBAAsBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,mBAAmBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EACxC,oBAAoBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;;ACLD,MAAa,kBAAkBC,IAAAA,EAAE,OAAO;CACtC,UAAUA,IAAAA,EAAE,OAAO;EACjB,SAASA,IAAAA,EAAE,OAAO;EAGlB,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAOA,IAAAA,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQA,IAAAA,EAAE,OAAO;EACf,aAAaA,IAAAA,EAAE,OAAO;EACtB,iBAAiBA,IAAAA,EAAE,OAAO;EAC1B,MAAMA,IAAAA,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAAA,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAWC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;;ACGA,MAAM,aAAaC,IAAAA,EAAE,OAAO;CAC1B,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,QAAQA,IAAAA,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5BA,IAAAA,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,kBAAkBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkBA,IAAAA,EAAE,OAAO;CAAG,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;;ACjBA,MAAa,mBAAmB,SAC9BC,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;CACtB,UAAUA,IAAAA,EAAE,OAAO;CACnB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,uBAAuBA,IAAAA,EAAE,OAAO;CAChC,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgBC,IAAAA,EAAE,OAAO;CACzB,kBAAkBA,IAAAA,EAAE,OAAO;CAC3B,QAAQA,IAAAA,EAAE,OAAO;CACjB,WAAWA,IAAAA,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAASA,IAAAA,EAAE,OAAO;CAClB,gBAAgBA,IAAAA,EAAE,OAAO;AAC3B,CAAC,CACH;;;;ACNA,MAAa,kBAAkB,SAC7BC,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAaA,IAAAA,EAAE,OAAO;CACtB,UAAUA,IAAAA,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAeA,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkBC,IAAAA,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkBA,IAAAA,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAOA,IAAAA,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiBA,IAAAA,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAUA,IAAAA,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAIC,oBAAAA,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAIA,oBAAAA,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAIA,oBAAAA,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAIA,oBAAAA,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAIA,oBAAAA,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAIA,oBAAAA,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAIA,oBAAAA,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAIA,oBAAAA,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAIA,oBAAAA,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAIA,oBAAAA,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAIA,oBAAAA,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAIA,oBAAAA,YAAY,SAAS,YAAY,CAAC,CACtC,IAAIA,oBAAAA,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAIA,oBAAAA,YAAY,aAAa,WAAW,CAAC,CACzC,IAAIA,oBAAAA,YAAY,WAAW,aAAa,CAAC,CACzC,IAAIA,oBAAAA,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAIA,oBAAAA,YAAY,6BAA6B,qBAAqB;;;ACrErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,uBAAA,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,uBAAA,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}
+{"version":3,"file":"configurations-B2O8AAy0.cjs","names":["isPlainObject","z","isPlainObject","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","snowflakeCommon","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","z","ComponentId"],"sources":["../src/utils/isEmptyDeep.ts","../src/utils/schemaGuidedMerge.ts","../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../src/sdks/configurations/schemas/common/dbConfig.ts","../src/sdks/configurations/schemas/common/dbConnection.ts","../src/sdks/configurations/schemas/common/forbidden.ts","../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../src/sdks/configurations/schemas/common/sslSchema.ts","../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../src/sdks/configurations/schemas/googleAdsSchema.ts","../src/sdks/configurations/schemas/schedulerSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../src/sdks/configurations/createRegistry/createRegistry.ts","../src/sdks/configurations/registry.ts","../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { isPlainObject } from './isPlainObject';\n\n/**\n * Is `value` \"deeply empty\" — i.e. carries no leaf data? `null`/`undefined`, `{}`, `[]`, and\n * nested structures whose every leaf is itself empty (e.g. `{ parameters: {} }`) are empty.\n * Any present primitive (string, number, boolean — including `''`) counts as content.\n *\n * Used to skip a pointless encryption round-trip when a validated configuration has nothing\n * to encrypt.\n */\nexport const isEmptyDeep = (value: unknown): boolean => {\n  if (value == null) return true;\n  if (Array.isArray(value)) return value.every(isEmptyDeep);\n  if (isPlainObject(value)) return Object.values(value).every(isEmptyDeep);\n  return false;\n};\n","import { z } from 'zod';\n\nimport { isPlainObject } from './isPlainObject';\n\n/** Strip optional/nullable/default wrappers to reach the structural schema node. */\nconst unwrap = (schema: z.core.$ZodType): z.core.$ZodType =>\n  schema instanceof z.ZodOptional ||\n  schema instanceof z.ZodNullable ||\n  schema instanceof z.ZodDefault\n    ? unwrap(schema.unwrap())\n    : schema;\n\n/**\n * Merge `patch` into `base`, descending only through object schemas.\n *\n * - At a non-object node (union, array, primitive) the patch replaces the base wholesale, so\n *   switching a union variant drops the old variant's secret.\n * - Hence a union or array subtree is all-or-nothing: send the complete block.\n * - Keys only in `base` are kept; `undefined` patch values are skipped.\n * - Assumes `patch` is schema-validated. Pure.\n */\nexport const schemaGuidedMerge = <T extends Record<string, unknown>>(\n  schema: z.core.$ZodType,\n  base: T,\n  patch: Record<string, unknown>,\n): T => {\n  const node = unwrap(schema);\n  if (!(node instanceof z.ZodObject) || !isPlainObject(base)) return patch as T;\n\n  const out: Record<string, unknown> = { ...base };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === undefined) continue;\n    const child = node.shape[key];\n    const current = out[key];\n    out[key] =\n      child && isPlainObject(current) && isPlainObject(value)\n        ? schemaGuidedMerge(child, current, value)\n        : value;\n  }\n\n  return out as T;\n};\n","import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials with an optional SSH tunnel, for the generic SSH-only drivers.\n *\n * - Keep in sync with kbc-ui's `hasSshTunnel` / `hasSsl` (`ex-db-generic/helpers.ts`).\n * - SSL-capable, tunnel-less and extra-field drivers get their own schema.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    continueOnFailure: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { createDefaultBranch } from '../../domain/defaultBranch';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are\n *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.\n * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,\n *   e.g. `storage`, is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,eAAe,UAA4B;CACtD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,MAAM,WAAW;CACxD,IAAIA,sBAAAA,cAAc,KAAK,GAAG,OAAO,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,WAAW;CACvE,OAAO;AACT;;;;ACVA,MAAM,UAAU,WACd,kBAAkBC,IAAAA,EAAE,eACpB,kBAAkBA,IAAAA,EAAE,eACpB,kBAAkBA,IAAAA,EAAE,aAChB,OAAO,OAAO,OAAO,CAAC,IACtB;;;;;;;;;;AAWN,MAAa,qBACX,QACA,MACA,UACM;CACN,MAAM,OAAO,OAAO,MAAM;CAC1B,IAAI,EAAE,gBAAgBA,IAAAA,EAAE,cAAc,CAACC,sBAAAA,cAAc,IAAI,GAAG,OAAO;CAEnE,MAAM,MAA+B,EAAE,GAAG,KAAK;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,QAAQ,KAAK,MAAM;EACzB,MAAM,UAAU,IAAI;EACpB,IAAI,OACF,SAASA,sBAAAA,cAAc,OAAO,KAAKA,sBAAAA,cAAc,KAAK,IAClD,kBAAkB,OAAO,SAAS,KAAK,IACvC;CACR;CAEA,OAAO;AACT;;;;;;;;AClCA,MAAa,uBAAuBC,IAAAA,EAAE,OAAO,EAC3C,YAAYA,IAAAA,EAAE,OAAO,EACnB,IAAIA,IAAAA,EAAE,OAAO,EACX,aAAaA,IAAAA,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;;ACVD,MAAa,YAAkC,OAC7CC,IAAAA,EAAE,OAAO,EAAE,YAAYA,IAAAA,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;;ACI3C,MAAa,qBAAqBC,IAAAA,EAAE,OAAO;CACzC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;;ACLD,MAAa,YAAYC,IAAAA,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;;ACFhD,MAAa,2BAA2BC,IAAAA,EAAE,OAAO,EAC/C,WAAWA,IAAAA,EAAE,OAAO;CAClB,IAAIA,IAAAA,EAAE,OAAO;CACb,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;;ACVD,MAAa,kBAAkBC,IAAAA,EAAE,OAAO;CACtC,SAASA,IAAAA,EAAE,QAAQ;CACnB,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAMA,IAAAA,EACH,OAAO;EACN,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;ACZD,MAAa,YAAYC,IAAAA,EAAE,OAAO;CAChC,SAASA,IAAAA,EAAE,QAAQ;CACnB,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;;ACAD,MAAM,gBAAgBC,IAAAA,EAAE,OAAO;CAC7B,aAAaA,IAAAA,EAAE,OAAO;CACtB,aAAaA,IAAAA,EAAE,OAAO;CACtB,iBAAiBA,IAAAA,EAAE,OAAO;CAC1B,WAAWA,IAAAA,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+BA,IAAAA,EAAE,OAAO,EACnD,YAAYA,IAAAA,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoBA,IAAAA,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuBA,IAAAA,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;;ACfD,MAAM,qBAAqBC,IAAAA,EACxB,OAAO;CACN,WAAWA,IAAAA,EAAE,QAAQ,aAAa;CAClC,aAAaA,IAAAA,EAAE,OAAO;CACtB,oBAAoBA,IAAAA,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAcA,IAAAA,EACjB,OAAO;CACN,WAAWA,IAAAA,EAAE,QAAQ,MAAM;CAC3B,WAAWA,IAAAA,EAAE,OAAO;CACpB,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgBA,IAAAA,EAC1B,OAAO,EACN,YAAYA,IAAAA,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;;AChCT,MAAa,oBAAoBC,IAAAA,EAC9B,OAAO,EACN,YAAYA,IAAAA,EACT,OAAO;CACN,cAAcA,IAAAA,EAAE,OAAO;CACvB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,gBAAgBA,IAAAA,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;;ACVT,MAAa,wBAAwBC,IAAAA,EAClC,OAAO,EACN,YAAYA,IAAAA,EACT,OAAO;CACN,cAAcA,IAAAA,EAAE,OAAO;CACvB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;ACZT,MAAM,gBAAgBC,IAAAA,EAAE,OAAO;CAC7B,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,gBAAgBA,IAAAA,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAUA,IAAAA,EAAE,OAAO;CACnB,sBAAsBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAcA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAeA,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAcA,IAAAA,EACxB,OAAO,EACN,YAAYA,IAAAA,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;;AC/BT,MAAa,eAAeC,IAAAA,EACzB,OAAO,EACN,YAAYA,IAAAA,EAAE,OAAO;CAAE,SAASA,IAAAA,EAAE,OAAO;CAAG,cAAcA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;;ACJT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;;ACPA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2BA,IAAAA,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAMC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAMC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACTA,MAAa,qBAAqB,SAChCC,IAAAA,EAAE,OAAO;CAAE,QAAQA,IAAAA,EAAE,OAAO;CAAG,MAAMA,IAAAA,EAAE,OAAO;CAAG,aAAaA,IAAAA,EAAE,OAAO;AAAE,CAAC,CAC5E;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAYC,IAAAA,EAAE,OAAO;CACrB,UAAUA,IAAAA,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;;ACDA,MAAMC,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,MAAM,CACND,kBAAgB,OAAO;CAAE,aAAaC,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5ED,kBAAgB,OAAO;CAAE,eAAeC,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;ACdA,MAAa,qBAAqB,SAChCC,IAAAA,EAAE,OAAO;CACP,WAAWA,IAAAA,EAAE,OAAO;CACpB,QAAQA,IAAAA,EAAE,OAAO;CACjB,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,oBAAoBA,IAAAA,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAYA,IAAAA,EAAE,OAAO;CACrB,SAASA,IAAAA,EAAE,OAAO;CAClB,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;;ACfA,MAAM,iBAAiBC,IAAAA,EAAE,OAAO;CAC9B,MAAMA,IAAAA,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAUA,IAAAA,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAcA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAWA,IAAAA,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAeA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgBA,IAAAA,EAAE,OAAO;CAC7B,OAAOA,IAAAA,EAAE,OAAO;CAChB,UAAUA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAASA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoBA,IAAAA,EAAE,OAAO;CACjC,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAaA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuBA,IAAAA,EAAE,OAAO,EAC3C,YAAYA,IAAAA,EAAE,OAAO;CACnB,SAASA,IAAAA,EAAE,OAAO;EAAE,KAAKA,IAAAA,EAAE,OAAO;EAAG,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAMA,IAAAA,EAAE,OAAO;EAAE,OAAOA,IAAAA,EAAE,OAAO;EAAG,aAAaA,IAAAA,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAUA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAWA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAYA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;;ACjED,MAAa,oBAAoBC,IAAAA,EAAE,OAAO;CACxC,eAAe;CACf,YAAYA,IAAAA,EAAE,OAAO;EACnB,YAAYA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC;EAC9B,sBAAsBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,mBAAmBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;EACxC,oBAAoBA,IAAAA,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;;ACLD,MAAa,kBAAkBC,IAAAA,EAAE,OAAO;CACtC,UAAUA,IAAAA,EAAE,OAAO;EACjB,SAASA,IAAAA,EAAE,OAAO;EAGlB,UAAUA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAOA,IAAAA,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQA,IAAAA,EAAE,OAAO;EACf,aAAaA,IAAAA,EAAE,OAAO;EACtB,iBAAiBA,IAAAA,EAAE,OAAO;EAC1B,MAAMA,IAAAA,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAUC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAYA,IAAAA,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAWC,IAAAA,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;;ACGA,MAAM,aAAaC,IAAAA,EAAE,OAAO;CAC1B,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,QAAQA,IAAAA,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5BA,IAAAA,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,kBAAkBA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkBA,IAAAA,EAAE,OAAO;CAAG,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;;ACjBA,MAAa,mBAAmB,SAC9BC,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,aAAaA,IAAAA,EAAE,OAAO;CACtB,UAAUA,IAAAA,EAAE,OAAO;CACnB,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,uBAAuBA,IAAAA,EAAE,OAAO;CAChC,gBAAgBA,IAAAA,EAAE,OAAO;CACzB,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgBC,IAAAA,EAAE,OAAO;CACzB,kBAAkBA,IAAAA,EAAE,OAAO;CAC3B,QAAQA,IAAAA,EAAE,OAAO;CACjB,WAAWA,IAAAA,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQC,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAASA,IAAAA,EAAE,OAAO;CAClB,gBAAgBA,IAAAA,EAAE,OAAO;AAC3B,CAAC,CACH;;;;ACNA,MAAa,kBAAkB,SAC7BC,IAAAA,EAAE,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO;CACf,MAAMA,IAAAA,EAAE,OAAO;CACf,UAAUA,IAAAA,EAAE,OAAO;CACnB,aAAaA,IAAAA,EAAE,OAAO;CACtB,UAAUA,IAAAA,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQC,IAAAA,EAAE,OAAO;CAAG,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjCA,IAAAA,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAaA,IAAAA,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAeA,IAAAA,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkBC,IAAAA,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkBA,IAAAA,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAOA,IAAAA,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiBA,IAAAA,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAUA,IAAAA,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAIC,oBAAAA,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAIA,oBAAAA,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAIA,oBAAAA,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAIA,oBAAAA,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAIA,oBAAAA,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAIA,oBAAAA,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAIA,oBAAAA,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAIA,oBAAAA,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAIA,oBAAAA,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAIA,oBAAAA,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAIA,oBAAAA,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAIA,oBAAAA,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAIA,oBAAAA,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAIA,oBAAAA,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAIA,oBAAAA,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAIA,oBAAAA,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAIA,oBAAAA,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAIA,oBAAAA,YAAY,SAAS,YAAY,CAAC,CACtC,IAAIA,oBAAAA,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAIA,oBAAAA,YAAY,aAAa,WAAW,CAAC,CACzC,IAAIA,oBAAAA,YAAY,WAAW,aAAa,CAAC,CACzC,IAAIA,oBAAAA,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAIA,oBAAAA,YAAY,6BAA6B,qBAAqB;;;ACrErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,uBAAA,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,uBAAA,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}

package/dist/{configurations-Chg_JwJ1.js → configurations-CL0ouUMa.js}

@@ -63,11 +63,11 @@ const assertCanWriteKaiSettings = (token) => {
 * Whether this token may write the project's semantic layer in the metastore.
 *
 * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):
-*   only a master token with the `admin` or `productionManager` role gets `project-admin`.
+*   only a master token with the `admin`, `productionManager` or `share` role gets `project-admin`.
 * - Every other role, and a limited token (no `admin` block), gets a 403.
 * - Organization-scope promotion is left to the metastore's 403.
 */
-const canWriteSemanticLayer = (token) => token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;
+const canWriteSemanticLayer = (token) => token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager || token.admin?.role === AdminRole.Share;
 const assertCanAdmin = (token) => {
 	if (!isAdmin(token)) throw new PermissionDeniedError({
 		action: "admin",
@@ -141,4 +141,4 @@ const assertCanAssignFolder = (token, ctx) => {
 //#endregion
 export { isKaiSettingsWriterRole as C, PermissionDeniedError as D, isReadOnlyRole as E, isDeveloperOrReviewer as S, isProductionManager as T, assertCanWriteKaiSettings as _, assertCanPurgeConfiguration as a, isAdmin as b, canCopyConfiguration as c, canPurgeConfiguration as d, canUpdateConfiguration as f, assertCanProductionManage as g, assertCanDevelopOrReview as h, assertCanMigrateFromTemplate as i, canCreateConfiguration as l, assertCanAdminOrShare as m, assertCanCopyConfiguration as n, assertCanUpdateConfiguration as o, assertCanAdmin as p, assertCanCreateConfiguration as r, canAssignFolder as s, assertCanAssignFolder as t, canMigrateFromTemplate as u, canWriteKaiSettings as v, isKnownAdminRole as w, isAdminOrShare as x, canWriteSemanticLayer as y };
 
-//# sourceMappingURL=configurations-Chg_JwJ1.js.map
+//# sourceMappingURL=configurations-CL0ouUMa.js.map

package/dist/configurations-CL0ouUMa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configurations-CL0ouUMa.js","names":[],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): AdminRole | null => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin`, `productionManager` or `share` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin ||\n  token.admin?.role === AdminRole.ProductionManager ||\n  token.admin?.role === AdminRole.Share;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * - Dev branch → developer or reviewer; production → production manager.\n * - Purge is admin-only in any branch mode; its `ctx` is ignored.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` on any branch other than the default (`isDefault`) one.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACRA,MAAM,QAAQ,UAA0C,MAAM,MAAM;AAEpE,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAM,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,MAAM,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAM,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK,MAAM,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAM,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAO,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAK,UAAU;EACf,KAAK,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAAS,UAAU,SAChC,MAAM,OAAO,SAAS,UAAU,qBAChC,MAAM,OAAO,SAAS,UAAU;AAElC,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;ACjGA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}

package/dist/{configurations-BTRHVSRq.cjs → configurations-D9J3jh3g.cjs}

@@ -63,11 +63,11 @@ const assertCanWriteKaiSettings = (token) => {
 * Whether this token may write the project's semantic layer in the metastore.
 *
 * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):
-*   only a master token with the `admin` or `productionManager` role gets `project-admin`.
+*   only a master token with the `admin`, `productionManager` or `share` role gets `project-admin`.
 * - Every other role, and a limited token (no `admin` block), gets a 403.
 * - Organization-scope promotion is left to the metastore's 403.
 */
-const canWriteSemanticLayer = (token) => token.admin?.role === require_adminRoles.AdminRole.Admin || token.admin?.role === require_adminRoles.AdminRole.ProductionManager;
+const canWriteSemanticLayer = (token) => token.admin?.role === require_adminRoles.AdminRole.Admin || token.admin?.role === require_adminRoles.AdminRole.ProductionManager || token.admin?.role === require_adminRoles.AdminRole.Share;
 const assertCanAdmin = (token) => {
 	if (!isAdmin(token)) throw new PermissionDeniedError({
 		action: "admin",
@@ -302,4 +302,4 @@ Object.defineProperty(exports, "isReadOnlyRole", {
 	}
 });
 
-//# sourceMappingURL=configurations-BTRHVSRq.cjs.map
+//# sourceMappingURL=configurations-D9J3jh3g.cjs.map