@keboola/api-client 47.0.0 → 48.0.0

package/dist/{types-C2JMisvL.d.ts → types-Dn1G-qv4.d.cts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType, s as OpenapiPathType } from "./index-r6YSe8B-.js";
+import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType, s as OpenapiPathType } from "./index-ChDl6ig5.cjs";
 //#region src/clients/management/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -1488,6 +1488,26 @@ type paths = {
     patch: operations['patch_/manage/organizations/{id}/force-mfa::OrganizationSetMfaRequiredAction'];
     trace?: never;
   };
+  '/manage/programmatic-projects/claim': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Read the parked agent-project claim
+     * @description Reports whether the browser carries a claim cookie, with the claim's id and the name of the project it hands over. Never returns the claim secret. Answers `present: true` only to a same-origin request that carries the cookie: `SameSite=Lax` keeps it off cross-site fetches and the wildcard CORS rule allows no credentials.
+     */
+    get: operations['get_/manage/programmatic-projects/claim::ProgrammaticProjectClaimDetailAction'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/manage/programmatic-projects/confirm': {
     parameters: {
       query?: never;
@@ -2444,7 +2464,7 @@ type paths = {
      *
      *     A backend uses one taxonomy. Pass the existing one as the single item of `resourceScopes`, or `createTaxonomy=true` for a new one in `roleProject`; a second taxonomy is refused. The taxonomy must be in the backend region, and in `roleProject`: the custom roles are project-level and can be granted only on resources of their own project.
      *
-     *     Available to a super admin and, for a BYODB backend, to a direct member of a maintainer that has this backend as its default BigQuery backend.
+     *     Available to a super admin only, the same as creating a BigQuery backend.
      */
     get: operations['get_/manage/storage-backend/{id}/policy-tags/enablement-guide::StorageBackendPolicyTagEnablementGuideAction'];
     put?: never;
@@ -5718,6 +5738,20 @@ type components = {
       };
     };
     OrganizationsListResponse: components['schemas']['OrganizationListResponse'][];
+    ProgrammaticProjectClaimDetailResponse: {
+      /** @description Whether the browser carries a parked claim. */
+      present: boolean;
+      /**
+       * @description The claim's safe-to-log id, never its secret. `null` when the cookie does not parse.
+       * @example 01a00eb0-2b6c-7496-9520-d6f4cae52015
+       */
+      claimId?: string | null;
+      /**
+       * @description The project the claim hands over. `null` when it cannot be resolved.
+       * @example Agent project
+       */
+      projectName?: string | null;
+    };
     ConfirmProgrammaticProjectRequest2: {
       /**
        * Null when the body carried no token. The caller resolves the effective claim - see
@@ -6252,7 +6286,7 @@ type components = {
       /** @description Backend region. */
       region: string;
       /** @description Associated legal owner (mostly: keboola, client-<name>). */
-      owner: string;
+      owner: string | null;
       /** @description Associated technical owner (who technically manages the account). One of: keboola, internal, kbdb, byodb. */
       technicalOwner: string;
       /** @description Username used for the connection. */
@@ -6323,6 +6357,8 @@ type components = {
        * @example something@else.iam.gserviceaccount.com
        */
       serviceAccountEmail?: string | null;
+      /** @description Detail endpoint only (absent on the list endpoint). Whether the BigQuery policy-tag capability is enabled on the backend. BigQuery backends only; absent otherwise. */
+      policyTagsEnabled?: boolean;
     };
     StorageBackendListResponse: components['schemas']['StorageBackendDetailResponse'][];
     StorageBackendMaintainerListResponse: {
@@ -6346,6 +6382,26 @@ type components = {
       /** @description The guide: a Markdown document, or a Terraform module. */
       content: string;
     };
+    PolicyTagEnablementGuideErrorResponse: {
+      /** @description Human-readable reason, safe to show to the user. */
+      error: string;
+      /**
+       * @description Machine-readable error code.
+       * @example manage.storageBackend.invalidPolicyTagEnablementGuideRequest
+       */
+      code?: string;
+      /** @description Identifier of the error occurrence, for support. */
+      exceptionId?: string;
+      /** @description Per-parameter validation errors, present when a query parameter fails its format check. */
+      errors?: {
+        /**
+         * @description The query parameter.
+         * @example roleProject
+         */
+        key: string;
+        message: string;
+      }[];
+    };
     StorageBackendProjectListResponse: {
       /**
        * @description Project identifier.
@@ -12322,6 +12378,26 @@ interface operations {
       };
     };
   };
+  'get_/manage/programmatic-projects/claim::ProgrammaticProjectClaimDetailAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description The parked claim, or `present: false` when the browser carries none. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ProgrammaticProjectClaimDetailResponse'];
+        };
+      };
+    };
+  };
   'post_/manage/programmatic-projects/confirm::ProgrammaticProjectConfirmAction': {
     parameters: {
       query?: never;
@@ -12571,7 +12647,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the feature is already assigned or request is invalid. */
+      /** @description Returned when the feature is already assigned, the request is invalid, or the feature is `bigquery-policy-tags`, which is assigned per project only. */
       422: {
         headers: {
           [name: string]: unknown;
@@ -12971,7 +13047,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the feature is already assigned or cannot be managed via API. */
+      /** @description Returned when the feature is already assigned, cannot be managed via API, or is `bigquery-policy-tags` on a project whose BigQuery backend lacks the policy-tag capability. */
       422: {
         headers: {
           [name: string]: unknown;
@@ -14578,7 +14654,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the current admin is not a super admin. */
+      /** @description Returned when the current admin is neither a super admin nor holds the can-reactivate-workspaces feature. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -15252,7 +15328,7 @@ interface operations {
           'application/json': components['schemas']['StorageBackendResponse'];
         };
       };
-      /** @description Returned when the backend cannot be activated or validation fails (connection test, missing certificate, already-enabled certificate, unsupported backend). */
+      /** @description Returned when the backend cannot be activated or validation fails (connection test, missing certificate, already-enabled certificate, unsupported backend, or a dynamic backend whose Snowflake account lacks the bare warehouse or a small, medium or large sized warehouse). */
       400: {
         headers: {
           [name: string]: unknown;
@@ -15764,7 +15840,9 @@ interface operations {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          'application/json': components['schemas']['PolicyTagEnablementGuideErrorResponse'];
+        };
       };
       /** @description Returned when the Manage token is missing or invalid. */
       401: {
@@ -15773,7 +15851,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the current admin is neither a super admin nor, for a BYODB backend, a member of a maintainer with this default BigQuery backend. */
+      /** @description Returned when the current admin is not a super admin. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -15792,7 +15870,9 @@ interface operations {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          'application/json': components['schemas']['PolicyTagEnablementGuideErrorResponse'];
+        };
       };
     };
   };
@@ -17145,7 +17225,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the current admin is not a super admin. */
+      /** @description Returned when the current admin is neither a super admin nor holds the can-reactivate-workspaces feature. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -17994,6 +18074,7 @@ type ConfirmProgrammaticProjectResult = {
   };
   confirmedByAdminId: number;
 };
+type ProgrammaticProjectClaim = OpenapiReturnType<paths['/manage/programmatic-projects/claim']['get']>;
 //#endregion
 //#region src/clients/management/users/types.d.ts
 type AddUserFeaturePath = {
@@ -18340,5 +18421,5 @@ type ProjectRetentionWorkspace = {
 //#region src/clients/management/tokenTypes.d.ts
 type ManagementToken = components['schemas']['ManageTokenVerifyResponse'];
 //#endregion
-export { MoveProjectInput as $, CreateFileStorageAbsBody as $n, UpdateStripeCustomerBody as $t, UpdateStorageBackendInput as A, UpdateSamlConfigInput as An, ProjectInvitation as Ar, DeleteUserMetadataPath as At, CreateProjectInvitationBody as B, OrganizationInvitationDetail as Bn, UserMaintainerMembership as Bt, StorageBackendBigquery as C, SamlConfigPath as Cn, DeletedProjectsListFilter as Cr, SetProjectMetadataPath as Ct, UpdateBigqueryStorageBackendBody as D, UpdateMaintainerBody as Dn, DeletedProjectsStatus as Dr, UpdateProjectInput as Dt, StorageBackendProject as E, SetMaintainerMetadataInput as En, DeletedProjectsStats as Er, UpdateProjectBody as Et, ChangeProjectUserRoleBody as F, CreateOrganizationInvitationInput as Fn, CreatedApplicationToken as Fr, UpdateUserBody as Ft, GetProjectPath as G, OrganizationPath as Gn, ConfirmProgrammaticProjectResult as Gt, DeleteProjectInvitationPath as H, OrganizationListItem as Hn, UserPath as Ht, ChangeProjectUserRoleInput as I, CreateOrganizationProjectBody as In, components as Ir, UpdateUserInput as It, JoinProjectInput as J, SetOrganizationMetadataBody as Jn, CreditPurchase as Jt, GetProjectReviewersPath as K, OrganizationProject as Kn, CreatePaymentRequestBody as Kt, ChangeProjectUserRolePath as L, CreateOrganizationProjectInput as Ln, paths as Lr, User as Lt, AddProjectUserPath as M, AddOrganizationUserInput as Mn, ApplicationToken as Mr, RemoveUserFeaturePath as Mt, AssignFeatureBody as N, AdminUser as Nn, ApplicationTokenScope as Nr, SetUserMetadataBody as Nt, UpdateBigqueryStorageBackendInput as O, UpdateMaintainerInput as On, MaintainerInvitation as Or, AddUserFeatureBody as Ot, AssignProjectTemplateFeatureInput as P, CreateOrganizationInvitationBody as Pn, CreateApplicationTokenBody as Pr, SetUserMetadataInput as Pt, MoveProjectBody as Q, SetUpBigQueryBody as Qn, TopUpSetting as Qt, CreateProjectFeatureBody as R, Organization as Rn, UserDetail as Rt, StorageBackend as S, SamlConfigDetail as Sn, DeletedProjectPurgeResult as Sr, SetProjectMetadataBody as St, StorageBackendPath as T, SetMaintainerMetadataBody as Tn, DeletedProjectsPage as Tr, SetProjectReviewersPath as Tt, DeleteProjectMetadataPath as U, OrganizationMaintainer as Un, UserProjectMembership as Ut, CreateProjectInvitationPath as V, OrganizationInvitationPath as Vn, UserOrganizationMembership as Vt, GetProjectMetadataPath as W, OrganizationMetadataItemPath as Wn, ConfirmProgrammaticProjectPayload as Wt, ListProjectJoinRequestsPath as X, UpdateOrganizationBody as Xn, StripeCustomer as Xt, ListProjectInvitationsPath as Y, SetOrganizationMetadataInput as Yn, PayAsYouGoBillingConfiguration as Yt, ListProjectUsersPath as Z, UpdateOrganizationInput as Zn, StripeCustomerCard as Zt, PolicyTagEnablementGuide as _, MaintainerMetadataItemPath as _n, FeatureAdmin as _r, Reviewer as _t, GetUiAppsQuery as a, CreateMaintainerBody as an, FileStorageS3 as ar, ProjectJoinRequestPath as at, PolicyTagEnablementGuideQuery as b, MaintainerUserPath as bn, GetAllFeaturesQuery as br, SetProjectLimitsBody as bt, UiApp as c, CreateMaintainerOrganizationBody as cn, RotateFileStorageAbsPath as cr, ProjectPath as ct, UiAppVersion as d, CreateSamlConfigInput as dn, RotateFileStorageGcsPath as dr, RemoveProjectFeaturePath as dt, UpdateTopUpSettingBody as en, CreateFileStorageGcsBody as er, Project as et, CreateBigqueryServerSideStorageBackendBody as f, CreateSamlConfigPath as fn, RotateFileStorageS3Body as fr, RemoveProjectLimitPath as ft, GetStorageBackendProjectsQuery as g, MaintainerInvitationPath as gn, Feature as gr, RequestProjectAccessInput as gt, CreateSnowflakeStorageBackendResponse as h, MaintainerInvitationDetail as hn, UpdateFileStorageBody as hr, RequestProjectAccessBody as ht, ReactivateWorkspaceResult as i, CompleteSamlSetupInput as in, FileStorageGcs as ir, ProjectJoinRequestDetail as it, AddProjectUserBody as j, AddOrganizationUserBody as jn, ProjectJoinRequest as jr, GetUsersQuery as jt, UpdateStorageBackendBody as k, UpdateSamlConfigBody as kn, OrganizationInvitation as kr, AddUserFeaturePath as kt, UiAppDetail as l, CreateMaintainerOrganizationInput as ln, RotateFileStorageGcsBody as lr, ProjectTemplate as lt, CreateSnowflakeStorageBackendBody as m, MaintainerDetail as mn, RotateFileStorageS3Path as mr, RemoveProjectUserPath as mt, ProjectRetentionWorkspace as n, AddMaintainerUserInput as nn, FileStorage as nr, ProjectInvitableRole as nt, RegisterUiAppBody as o, CreateMaintainerInvitationBody as on, RotateFileStorageAbsBody as or, ProjectMetadataInput as ot, CreateBigqueryStorageBackendBody as p, Maintainer as pn, RotateFileStorageS3Input as pr, RemoveProjectTemplateFeaturePath as pt, JoinProjectBody as q, OrganizationUserPath as qn, CreditPaymentRequest as qt, ProjectRetentionWorkspaceState as r, CompleteSamlSetupBody as rn, FileStorageAbs as rr, ProjectInvitationDetail as rt, RenameUiAppBody as s, CreateMaintainerInvitationInput as sn, RotateFileStorageAbsInput as sr, ProjectMetadataItem as st, ManagementToken as t, AddMaintainerUserBody as tn, CreateFileStorageS3Body as tr, ProjectBase as tt, UiAppRegistrationResult as u, CreateSamlConfigBody as un, RotateFileStorageGcsInput as ur, ProjectTemplatePath as ut, PolicyTagEnablementGuideInput as v, MaintainerPath as vn, FeatureProject as vr, SetProjectDisabledBody as vt, StorageBackendMaintainer as w, SamlConfigSummary as wn, DeletedProjectsListQuery as wr, SetProjectReviewersBody as wt, PolicyTagEnablementGuideSchemaQuery as x, MetadataItem as xn, DeletedProject as xr, SetProjectLimitsInput as xt, PolicyTagEnablementGuidePath as y, MaintainerUser as yn, FeatureType as yr, SetProjectDisabledInput as yt, CreateProjectFeaturePath as z, OrganizationDetail as zn, UserListItem as zt };
-//# sourceMappingURL=types-C2JMisvL.d.ts.map
+export { MoveProjectInput as $, SetUpBigQueryBody as $n, TopUpSetting as $t, UpdateStorageBackendInput as A, UpdateSamlConfigBody as An, OrganizationInvitation as Ar, DeleteUserMetadataPath as At, CreateProjectInvitationBody as B, OrganizationDetail as Bn, UserMaintainerMembership as Bt, StorageBackendBigquery as C, SamlConfigDetail as Cn, DeletedProjectPurgeResult as Cr, SetProjectMetadataPath as Ct, UpdateBigqueryStorageBackendBody as D, SetMaintainerMetadataInput as Dn, DeletedProjectsStats as Dr, UpdateProjectInput as Dt, StorageBackendProject as E, SetMaintainerMetadataBody as En, DeletedProjectsPage as Er, UpdateProjectBody as Et, ChangeProjectUserRoleBody as F, CreateOrganizationInvitationBody as Fn, CreateApplicationTokenBody as Fr, UpdateUserBody as Ft, GetProjectPath as G, OrganizationMetadataItemPath as Gn, ConfirmProgrammaticProjectResult as Gt, DeleteProjectInvitationPath as H, OrganizationInvitationPath as Hn, UserPath as Ht, ChangeProjectUserRoleInput as I, CreateOrganizationInvitationInput as In, CreatedApplicationToken as Ir, UpdateUserInput as It, JoinProjectInput as J, OrganizationUserPath as Jn, CreditPaymentRequest as Jt, GetProjectReviewersPath as K, OrganizationPath as Kn, ProgrammaticProjectClaim as Kt, ChangeProjectUserRolePath as L, CreateOrganizationProjectBody as Ln, components as Lr, User as Lt, AddProjectUserPath as M, AddOrganizationUserBody as Mn, ProjectJoinRequest as Mr, RemoveUserFeaturePath as Mt, AssignFeatureBody as N, AddOrganizationUserInput as Nn, ApplicationToken as Nr, SetUserMetadataBody as Nt, UpdateBigqueryStorageBackendInput as O, UpdateMaintainerBody as On, DeletedProjectsStatus as Or, AddUserFeatureBody as Ot, AssignProjectTemplateFeatureInput as P, AdminUser as Pn, ApplicationTokenScope as Pr, SetUserMetadataInput as Pt, MoveProjectBody as Q, UpdateOrganizationInput as Qn, StripeCustomerCard as Qt, CreateProjectFeatureBody as R, CreateOrganizationProjectInput as Rn, paths as Rr, UserDetail as Rt, StorageBackend as S, MetadataItem as Sn, DeletedProject as Sr, SetProjectMetadataBody as St, StorageBackendPath as T, SamlConfigSummary as Tn, DeletedProjectsListQuery as Tr, SetProjectReviewersPath as Tt, DeleteProjectMetadataPath as U, OrganizationListItem as Un, UserProjectMembership as Ut, CreateProjectInvitationPath as V, OrganizationInvitationDetail as Vn, UserOrganizationMembership as Vt, GetProjectMetadataPath as W, OrganizationMaintainer as Wn, ConfirmProgrammaticProjectPayload as Wt, ListProjectJoinRequestsPath as X, SetOrganizationMetadataInput as Xn, PayAsYouGoBillingConfiguration as Xt, ListProjectInvitationsPath as Y, SetOrganizationMetadataBody as Yn, CreditPurchase as Yt, ListProjectUsersPath as Z, UpdateOrganizationBody as Zn, StripeCustomer as Zt, PolicyTagEnablementGuide as _, MaintainerInvitationPath as _n, Feature as _r, Reviewer as _t, GetUiAppsQuery as a, CompleteSamlSetupInput as an, FileStorageGcs as ar, ProjectJoinRequestPath as at, PolicyTagEnablementGuideQuery as b, MaintainerUser as bn, FeatureType as br, SetProjectLimitsBody as bt, UiApp as c, CreateMaintainerInvitationInput as cn, RotateFileStorageAbsInput as cr, ProjectPath as ct, UiAppVersion as d, CreateSamlConfigBody as dn, RotateFileStorageGcsInput as dr, RemoveProjectFeaturePath as dt, UpdateStripeCustomerBody as en, CreateFileStorageAbsBody as er, Project as et, CreateBigqueryServerSideStorageBackendBody as f, CreateSamlConfigInput as fn, RotateFileStorageGcsPath as fr, RemoveProjectLimitPath as ft, GetStorageBackendProjectsQuery as g, MaintainerInvitationDetail as gn, UpdateFileStorageBody as gr, RequestProjectAccessInput as gt, CreateSnowflakeStorageBackendResponse as h, MaintainerDetail as hn, RotateFileStorageS3Path as hr, RequestProjectAccessBody as ht, ReactivateWorkspaceResult as i, CompleteSamlSetupBody as in, FileStorageAbs as ir, ProjectJoinRequestDetail as it, AddProjectUserBody as j, UpdateSamlConfigInput as jn, ProjectInvitation as jr, GetUsersQuery as jt, UpdateStorageBackendBody as k, UpdateMaintainerInput as kn, MaintainerInvitation as kr, AddUserFeaturePath as kt, UiAppDetail as l, CreateMaintainerOrganizationBody as ln, RotateFileStorageAbsPath as lr, ProjectTemplate as lt, CreateSnowflakeStorageBackendBody as m, Maintainer as mn, RotateFileStorageS3Input as mr, RemoveProjectUserPath as mt, ProjectRetentionWorkspace as n, AddMaintainerUserBody as nn, CreateFileStorageS3Body as nr, ProjectInvitableRole as nt, RegisterUiAppBody as o, CreateMaintainerBody as on, FileStorageS3 as or, ProjectMetadataInput as ot, CreateBigqueryStorageBackendBody as p, CreateSamlConfigPath as pn, RotateFileStorageS3Body as pr, RemoveProjectTemplateFeaturePath as pt, JoinProjectBody as q, OrganizationProject as qn, CreatePaymentRequestBody as qt, ProjectRetentionWorkspaceState as r, AddMaintainerUserInput as rn, FileStorage as rr, ProjectInvitationDetail as rt, RenameUiAppBody as s, CreateMaintainerInvitationBody as sn, RotateFileStorageAbsBody as sr, ProjectMetadataItem as st, ManagementToken as t, UpdateTopUpSettingBody as tn, CreateFileStorageGcsBody as tr, ProjectBase as tt, UiAppRegistrationResult as u, CreateMaintainerOrganizationInput as un, RotateFileStorageGcsBody as ur, ProjectTemplatePath as ut, PolicyTagEnablementGuideInput as v, MaintainerMetadataItemPath as vn, FeatureAdmin as vr, SetProjectDisabledBody as vt, StorageBackendMaintainer as w, SamlConfigPath as wn, DeletedProjectsListFilter as wr, SetProjectReviewersBody as wt, PolicyTagEnablementGuideSchemaQuery as x, MaintainerUserPath as xn, GetAllFeaturesQuery as xr, SetProjectLimitsInput as xt, PolicyTagEnablementGuidePath as y, MaintainerPath as yn, FeatureProject as yr, SetProjectDisabledInput as yt, CreateProjectFeaturePath as z, Organization as zn, UserListItem as zt };
+//# sourceMappingURL=types-Dn1G-qv4.d.cts.map

package/dist/{types-B6ozaDkl.d.cts → types-EkyQ0_10.d.cts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-XaPb6unB.cjs";
+import { c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-ChDl6ig5.cjs";
 //#region src/clients/auth/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -3880,4 +3880,4 @@ type RemoveWebauthnQuery = NonNullable<OpenapiQueryType<paths['/v1/auth/webauthn
 type RemoveWebauthnInput = RemoveWebauthnPath & RemoveWebauthnQuery;
 //#endregion
 export { CreateDeviceAuthorizationBody as $, PatScopeInput as A, GetMeMaintainersResult as B, GetPkceTokenResult as C, ExchangePatBodyRaw as D, CreatePatResult as E, TotpVerifyResult as F, MeMaintainer as G, GetMeOrganizationsResult as H, VerifyMfaBody as I, MeResult as J, MeOrganization as K, VerifyMfaResult as L, DisableTotpPath as M, RegenerateRecoveryCodesResult as N, ExchangePatInput as O, TotpSetupResult as P, ApproveDeviceAuthorizationResult as Q, VerifyMfaType as R, GetPkceTokenBody as S, CreatePatInput as T, GetMeProjectsQuery as U, GetMeOrganizationsQuery as V, GetMeProjectsResult as W, LoginBody as X, MeUser as Y, ApproveDeviceAuthorizationBody as Z, RevokeSessionPath as _, RemoveWebauthnInput as a, InitiateSamlBody as b, IntrospectTokenResult as c, RefreshTokenResult as d, CreateDeviceAuthorizationResult as et, RevokeTokenBody as f, SudoResult as g, SudoChallengeResult as h, RegisterWebauthnResult as i, paths as it, RevokePatPath as j, ListPatsResult as k, RefreshTokenBody as l, SudoBodyRaw as m, RegisterWebauthnInput as n, GetDeviceAuthorizationTokenResult as nt, RemoveWebauthnPath as o, SudoBody as p, MeProject as q, RegisterWebauthnOptionsResult as r, components as rt, RemoveWebauthnQuery as s, ListWebauthnCredentialsResult as t, GetDeviceAuthorizationTokenBody as tt, RefreshTokenPartialBody as u, AssertSamlBody as v, CreatePatBodyRaw as w, InitiateSamlResult as x, AssertSamlResult as y, GetMeMaintainersQuery as z };
-//# sourceMappingURL=types-B6ozaDkl.d.cts.map
+//# sourceMappingURL=types-EkyQ0_10.d.cts.map

package/dist/{types-B_1plf0y.d.cts → types-EmIcG-8K.d.cts}

@@ -1,4 +1,4 @@
-import { l as OpenapiReturnType, r as OpenapiBodyType } from "./index-XaPb6unB.cjs";
+import { l as OpenapiReturnType, r as OpenapiBodyType } from "./index-ChDl6ig5.cjs";
 //#region src/clients/telemetry/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -286,4 +286,4 @@ type GetProvisioningTokenBody = NonNullable<OpenapiBodyType<paths['/token']['pos
 type ProvisioningToken = OpenapiReturnType<paths['/token']['post']>;
 //#endregion
 export { ProvisioningToken as n, GetProvisioningTokenBody as t };
-//# sourceMappingURL=types-B_1plf0y.d.cts.map
+//# sourceMappingURL=types-EmIcG-8K.d.cts.map

package/dist/{types-D8w9lyb8.d.cts → types-NSxpnYW5.d.cts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-XaPb6unB.cjs";
+import { c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-ChDl6ig5.cjs";
 //#region src/clients/kaiAgent/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -325,6 +325,10 @@ type paths = {
             supportsApprovalRequestedEvent?: boolean;
             /** @enum {string} */
             client?: 'kbc-ui' | 'business-chat';
+            gitCredential?: {
+              repository: string;
+              token: string;
+            };
           };
         };
       };
@@ -1049,7 +1053,7 @@ type paths = {
                   errorText?: string;
                   approval?: {
                     id: string;
-                    approved: boolean;
+                    approved?: boolean;
                     reason?: string;
                   };
                 })[];
@@ -4332,4 +4336,4 @@ type ArtifactResponse = OpenapiReturnType<paths['/api/artifacts/{id}']['get']>;
 type ArtifactListResponse = OpenapiReturnType<paths['/api/artifacts']['get']>;
 //#endregion
 export { ChatWithMessages as a, GetChatPath as c, PrepareChatRequest as d, UsageResponse as f, ChatRequest as i, GetHistoryQuery as l, ArtifactListResponse as n, GetArtifactPath as o, VoteRequest as p, ArtifactResponse as r, GetArtifactsQuery as s, ApprovalBody as t, GetVotesQuery as u };
-//# sourceMappingURL=types-D8w9lyb8.d.cts.map
+//# sourceMappingURL=types-NSxpnYW5.d.cts.map

package/dist/{types-CEw2IzWk.d.ts → types-QPW-7dPm.d.ts}

@@ -1,4 +1,4 @@
-import { l as OpenapiReturnType, r as OpenapiBodyType } from "./index-r6YSe8B-.js";
+import { l as OpenapiReturnType, r as OpenapiBodyType } from "./index-sDHBkJhU.js";
 //#region src/clients/telemetry/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -286,4 +286,4 @@ type GetProvisioningTokenBody = NonNullable<OpenapiBodyType<paths['/token']['pos
 type ProvisioningToken = OpenapiReturnType<paths['/token']['post']>;
 //#endregion
 export { ProvisioningToken as n, GetProvisioningTokenBody as t };
-//# sourceMappingURL=types-CEw2IzWk.d.ts.map
+//# sourceMappingURL=types-QPW-7dPm.d.ts.map

package/dist/{types-BcQ3j8xK.d.ts → types-UySfduQo.d.ts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType, s as OpenapiPathType } from "./index-r6YSe8B-.js";
+import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType, s as OpenapiPathType } from "./index-sDHBkJhU.js";
 //#region src/clients/vault/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -392,4 +392,4 @@ type VariableWithHash = Omit<VariableWithHashRaw, 'hash'> & {
 type AnyVariable = VariableWithHash | CreateVariableBody;
 //#endregion
 export { GetVariablesQuery as a, GetVariablesByBranchId as i, CreateVariableBody as n, VariableWithHash as o, DeleteVariablePath as r, AnyVariable as t };
-//# sourceMappingURL=types-BcQ3j8xK.d.ts.map
+//# sourceMappingURL=types-UySfduQo.d.ts.map

package/dist/{types-7DBpH7Rf.d.ts → types-VehpPOQX.d.ts}

@@ -1,4 +1,4 @@
-import { r as OpenapiBodyType } from "./index-r6YSe8B-.js";
+import { r as OpenapiBodyType } from "./index-sDHBkJhU.js";
 import * as z$1 from "zod";
 //#region src/clients/syncActions/schemas.d.ts
 /** The Keboola-side context every sync action carries; namespaces extend it with their own fields. */
@@ -1310,4 +1310,4 @@ declare const buildOauthAuthorization: (credentials: OauthCredentials) => {
 type PostActionsBodyRaw = OpenapiBodyType<paths['/actions']['post']>;
 //#endregion
 export { GitBranch as $, ConfigurationMigrationStatus as $t, GoogleSheetsTable as A, flowMigrationPreviewResultSchema as At, GoogleAnalyticsGetProfilesPropertiesInput as B, FacebookComponentId as Bt, oneDriveSearchFilesResultSchema as C, genericExtractorPerformFunctionResultSchema as Ct, testLookerCredentialsInputSchema as D, FlowMigrationPreviewResult as Dt, lookerCredentialsResultSchema as E, FlowMigrationInput as Et, GoogleDriveCreateFileInput as F, FacebookGetAccountsInput as Ft, GoogleAnalyticsProperty as G, DbtActionInput as Gt, GoogleAnalyticsGetPropertiesMetadataInput as H, GetEmailAttachmentsEmailInput as Ht, GoogleDriveFile as I, facebookAccountsSchema as It, googleAnalyticsGetPropertiesMetadataInputSchema as J, dbtActionInputSchema as Jt, googleAnalyticsGetProfilesPropertiesInputSchema as K, DbtCompiled as Kt, GoogleDriveTable as L, facebookGetAccountsInputSchema as Lt, googleSheetsAddSheetResultSchema as M, flowMigrationValidationResultSchema as Mt, googleSheetsCreateSpreadsheetResultSchema as N, flowMigrationValidationResultsSchema as Nt, GoogleSheetsSheet as O, FlowMigrationValidationResult as Ot, googleSheetsTableActionInputSchema as P, FacebookAccount as Pt, GitAuth as Q, dbtRunResultsSchema as Qt, googleDriveCreateFileInputSchema as R, FACEBOOK_ACCOUNTS_ACTION as Rt, oneDriveSearchFilesInputSchema as S, syncActionContextSchema as Sn, genericExtractorPerformFunctionInputSchema as St, TestLookerCredentialsInput as T, genericExtractorTestRequestResultSchema as Tt, GoogleAnalyticsGetPropertiesMetadataResult as U, emailAttachmentsEmailSchema as Ut, GoogleAnalyticsGetProfilesPropertiesResult as V, isFacebookComponentId as Vt, GoogleAnalyticsProfile as W, getEmailAttachmentsEmailInputSchema as Wt, GetBranchesInput as X, dbtDocsSchema as Xt, googleAnalyticsGetPropertiesMetadataResultSchema as Y, dbtCompiledSchema as Yt, GetEntrypointsInput as Z, dbtModelTimingSchema as Zt, oneDriveCreateWorkbookResultSchema as _, apifyObjectsSchema as _n, GenericExtractorTestRequestResult as _t, SshKeyPair as a, PreparedRow as an, gitEntrypointsSchema as at, oneDriveGetWorksheetsInputSchema as b, SyncActionContext as bn, genericExtractorLoadFromCurlInputSchema as bt, snowflakeDwhManagerUserActionInputSchema as c, preparedRowsSchema as cn, GIT_FAMILY as ct, OneDriveCreateWorksheetInput as d, CodePatternGenerateResult as dn, GenericExtractorInferMappingInput as dt, GetConfigurationMigrationStatusInput as en, GitEntrypoints as et, OneDriveFile as f, codePatternGenerateInputSchema as fn, GenericExtractorJob as ft, oneDriveCreateWorkbookInputSchema as g, apifyObjectsInputSchema as gn, GenericExtractorTestRequestInput as gt, OneDriveWorksheet as h, ApifyObjectsInput as hn, GenericExtractorPerformFunctionInput as ht, oauthCredentialsSchema as i, CommonActionInput as in, gitBranchesSchema as it, GoogleSheetsTableActionInput as j, flowMigrationPreviewResultsSchema as jt, GoogleSheetsSpreadsheet as k, flowMigrationInputSchema as kt, snowflakeDwhManagerUserActionResultSchema as l, testConnectionResultSchema as ln, GitComponentId as lt, OneDriveSearchFilesInput as m, ApifyObject as mn, GenericExtractorMapping as mt, OauthCredentials as n, getConfigurationMigrationStatusInputSchema as nn, getEntrypointsInputSchema as nt, sshKeyPairSchema as o, TestConnectionResult as on, DATA_APP_FAMILY as ot, OneDriveGetWorksheetsInput as p, codePatternGenerateResultSchema as pn, GenericExtractorLoadFromCurlInput as pt, googleAnalyticsGetProfilesPropertiesResultSchema as q, DbtModelTiming as qt, buildOauthAuthorization as r, getConfigurationMigrationStatusResultSchema as rn, gitAuthSchema as rt, SnowflakeDwhManagerUserActionInput as s, commonActionInputSchema as sn, DataAppComponentId as st, PostActionsBodyRaw as t, configurationMigrationStatusSchema as tn, getBranchesInputSchema as tt, OneDriveCreateWorkbookInput as u, CodePatternGenerateInput as un, isDataAppFamily as ut, oneDriveCreateWorksheetInputSchema as v, paths as vn, genericExtractorInferMappingInputSchema as vt, LookerCredentialsResult as w, genericExtractorTestRequestInputSchema as wt, oneDriveGetWorksheetsResultSchema as x, syncActionBodySchema as xn, genericExtractorMappingSchema as xt, oneDriveCreateWorksheetResultSchema as y, SyncActionBody as yn, genericExtractorJobSchema as yt, googleDriveCreateFileResultSchema as z, FACEBOOK_FAMILY as zt };
-//# sourceMappingURL=types-7DBpH7Rf.d.ts.map
+//# sourceMappingURL=types-VehpPOQX.d.ts.map

package/dist/{types-BiBBKcin.d.ts → types-Vu09EUZs.d.ts}

@@ -1,5 +1,5 @@
-import { i as CreateMetaObjectInput } from "./types-ij6BpTzR.js";
-import { n as createMetastoreClient } from "./index-Dp-a2DdI.js";
+import { i as CreateMetaObjectInput } from "./types-C9VaQSqV.js";
+import { n as createMetastoreClient } from "./index-CIqWOEWD.js";
 //#region src/sdks/semanticLayer/vocabulary.d.ts
 /**
  * The closed value sets the metastore accepts on a semantic object.
@@ -199,4 +199,4 @@ type SemanticUnreadableObjectRef = {
 };
 //#endregion
 export { CONSTRAINT_TYPES as A, SemanticRuleExpression as C, UpdateSemanticObjectMeta as D, SemanticValidationQuery as E, SQL_DIALECTS as F, RELATIONSHIP_JOIN_TYPES as M, RULE_OPERATORS as N, CONSTRAINT_SCOPES as O, SEMANTIC_OBJECT_SCOPES as P, SemanticRelationshipJoinType as S, SemanticUnreadableObjectRef as T, SemanticObject as _, SemanticChildObjectType as a, SemanticObjectType as b, SemanticConstraintSeverity as c, SemanticFieldData as d, SemanticFieldRole as f, SemanticModelData as g, SemanticModelChildRef as h, SemanticChildObjectDataMap as i, FIELD_ROLES as j, CONSTRAINT_SEVERITIES as k, SemanticConstraintType as l, SemanticMetricData as m, MetastoreClient as n, SemanticConstraintData as o, SemanticGlossaryData as p, SemanticAiMetadata as r, SemanticConstraintScope as s, CreateSemanticObjectMeta as t, SemanticDatasetData as u, SemanticObjectMeta as v, SemanticRuleOperator as w, SemanticRelationshipData as x, SemanticObjectScope as y };
-//# sourceMappingURL=types-BiBBKcin.d.ts.map
+//# sourceMappingURL=types-Vu09EUZs.d.ts.map

package/dist/{types-DgIzXY-Y.d.ts → types-c4h2YDMC.d.ts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType } from "./index-r6YSe8B-.js";
+import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType } from "./index-sDHBkJhU.js";
 //#region src/clients/stream/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -7521,4 +7521,4 @@ type SinkStatisticsFilesQuery = OpenapiQueryType<paths['/v1/branches/{branchId}/
 type TestSourceQuery = OpenapiQueryType<paths['/v1/branches/{branchId}/sources/{sourceId}/test']['post']>;
 //#endregion
 export { UpdateSinkSettingsRequestBody as C, components as E, UpdateSinkRequestBody as S, UpdateSourceSettingsRequestBody as T, TableColumn as _, OTLPSource as a, TestResult as b, SettingsResult as c, SinkStatisticsFilesQuery as d, SinkStatisticsFilesResult as f, SourcesList as g, Source as h, OTLPSignal as i, Sink as l, SinksList as m, CreateSourceRequestBody as n, PaginationQuery as o, SinkStatisticsTotalResult as p, DeleteSourceQuery as r, SettingResult as s, CreateSinkRequestBody as t, SinkFile as u, TableSinkCreate as v, UpdateSourceRequestBody as w, TestSourceQuery as x, Task as y };
-//# sourceMappingURL=types-DgIzXY-Y.d.ts.map
+//# sourceMappingURL=types-c4h2YDMC.d.ts.map

package/dist/{types-OkQWmonU.d.cts → types-sOM2_KPc.d.cts}

@@ -1,4 +1,4 @@
-import { ii as BaseUrl, oi as MiddlewareFn } from "./index-XaPb6unB.cjs";
+import { ii as BaseUrl, oi as MiddlewareFn } from "./index-ChDl6ig5.cjs";
 //#region src/clients/auth.d.ts
 type AuthStrategy = {
   type: 'sapi-token';
@@ -20,4 +20,4 @@ type ClientInitOptions = {
 };
 //#endregion
 export { ClientInitOptions as n, AuthStrategy as r, BaseClientOptions as t };
-//# sourceMappingURL=types-OkQWmonU.d.cts.map
+//# sourceMappingURL=types-sOM2_KPc.d.cts.map

package/dist/{types-BBbzWczQ.d.cts → types-wNuJUhco.d.cts}

@@ -1,4 +1,4 @@
-import { l as OpenapiReturnType, r as OpenapiBodyType } from "./index-XaPb6unB.cjs";
+import { l as OpenapiReturnType, r as OpenapiBodyType } from "./index-ChDl6ig5.cjs";
 //#region src/clients/ai/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -852,7 +852,6 @@ interface operations {
 //#region src/clients/ai/types.d.ts
 type DescribeConfigurationVersionBody = OpenapiBodyType<paths['/describe/configuration-version']['post']>;
 type DescribeConfigurationMergeBody = OpenapiBodyType<paths['/describe/configuration-merge']['post']>;
-type FeedbackBody = OpenapiBodyType<paths['/feedback']['post']>;
 type ExplainErrorBody = OpenapiBodyType<paths['/explain']['post']>;
 type ErrorExplanation = OpenapiReturnType<paths['/explain']['post']>;
 type SuggestComponentBody = OpenapiBodyType<paths['/suggest/component']['post']>;
@@ -863,5 +862,5 @@ type DocsQuestionBody = OpenapiBodyType<paths['/docs/question']['post']>;
 type DocsAnswer = OpenapiReturnType<paths['/docs/question']['post']>;
 type ComponentDocsDetail = OpenapiReturnType<paths['/docs/components/{componentId}']['get']>;
 //#endregion
-export { DescribeConfigurationVersionBody as a, ErrorExplanation as c, ObjectDescription as d, SuggestComponentBody as f, DescribeConfigurationMergeBody as i, ExplainErrorBody as l, ComponentSuggestion as n, DocsAnswer as o, components as p, DescribeConfigurationBody as r, DocsQuestionBody as s, ComponentDocsDetail as t, FeedbackBody as u };
-//# sourceMappingURL=types-BBbzWczQ.d.cts.map
+export { DescribeConfigurationVersionBody as a, ErrorExplanation as c, SuggestComponentBody as d, components as f, DescribeConfigurationMergeBody as i, ExplainErrorBody as l, ComponentSuggestion as n, DocsAnswer as o, DescribeConfigurationBody as r, DocsQuestionBody as s, ComponentDocsDetail as t, ObjectDescription as u };
+//# sourceMappingURL=types-wNuJUhco.d.cts.map

package/dist/vault/index.d.cts

@@ -1,2 +1,2 @@
-import { t as createVaultClient } from "../index-Ds0tViQS.cjs";
+import { t as createVaultClient } from "../index-BCjU-g9t.cjs";
 export { createVaultClient };

package/dist/vault/index.d.ts

@@ -1,2 +1,2 @@
-import { t as createVaultClient } from "../index-DloFSSj3.js";
+import { t as createVaultClient } from "../index-BTrxCk90.js";
 export { createVaultClient };

package/dist/vault/types.d.cts

@@ -1,2 +1,2 @@
-import { a as GetVariablesQuery, i as GetVariablesByBranchId, n as CreateVariableBody, o as VariableWithHash, r as DeleteVariablePath, t as AnyVariable } from "../types-D51g4h9w.cjs";
+import { a as GetVariablesQuery, i as GetVariablesByBranchId, n as CreateVariableBody, o as VariableWithHash, r as DeleteVariablePath, t as AnyVariable } from "../types-D8d5tyGi.cjs";
 export { AnyVariable, CreateVariableBody, DeleteVariablePath, GetVariablesByBranchId, GetVariablesQuery, VariableWithHash };

package/dist/vault/types.d.ts

@@ -1,2 +1,2 @@
-import { a as GetVariablesQuery, i as GetVariablesByBranchId, n as CreateVariableBody, o as VariableWithHash, r as DeleteVariablePath, t as AnyVariable } from "../types-BcQ3j8xK.js";
+import { a as GetVariablesQuery, i as GetVariablesByBranchId, n as CreateVariableBody, o as VariableWithHash, r as DeleteVariablePath, t as AnyVariable } from "../types-UySfduQo.js";
 export { AnyVariable, CreateVariableBody, DeleteVariablePath, GetVariablesByBranchId, GetVariablesQuery, VariableWithHash };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keboola/api-client",
-  "version": "47.0.0",
+  "version": "48.0.0",
   "description": "TypeScript SDK for Keboola APIs",
   "license": "MIT",
   "type": "module",

package/surface/ai.md

@@ -9,7 +9,6 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.ai.describeConfigurationVersion(body: { branchId: string; componentId: string; configId: string; currentVersionId: string; previousVersionId?: string | undefined; rowId?: string | undefined; }): Promise<{ description: string; correlationId: string; }>`
 - `api.ai.docsQuestion(body: { query: string; }): Promise<{ response: string; metadata: { sources: string[]; }; }>`
 - `api.ai.explainError(body: { error?: string | undefined; jobId: string; }): Promise<{ answer: string; correlationId: string; }>`
-- `api.ai.feedback(body: { value: "good" | "bad" | "cancel"; correlationId?: string | undefined; comment?: string | undefined; subject?: { type: "failed-job"; jobId: string; } | { type: "configuration"; branchId: string; componentId: string; configId: string; rowId?: string | undefined; } | { type: "component-suggestions"; searchTerm: string; } | undefined; }): Promise<never>`
 - `api.ai.getComponentDetail(componentId: string): Promise<{ componentId: string; componentType: string; componentName: string; componentCategories: string[]; description: string; longDescription: string; documentationUrl: string | null; documentation: string | null; configurationSchema: Record<string, never> | null; configurationRowSchema: Record<string, never> | null; configurationDescription: string | null; rootConfigurationExamples: Record<string, never>[] | null; rowConfigurationExamples: Record<string, never>[] | null; componentFlags: string[] | null; synchronousActions?: string[] | null | undefined; }>`
 - `api.ai.healthCheck(signal?: AbortSignal | undefined): Promise<{ status: "ok"; }>`
 - `api.ai.suggestComponent(body: { prompt: string; }): Promise<{ components: { componentId: string; score: number; }[]; correlationId: string; }>`

package/surface/kaiAgent.md

@@ -5,14 +5,14 @@
 Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 
 - `api.kaiAgent.approveToolCall(chatId: string, body: { toolUseId: string; approved: boolean; reason?: string | undefined; dismissed?: boolean | undefined; updatedInput?: { [key: string]: unknown; } | undefined; answers?: { [key: string]: string; } | undefined; }): Promise<void>`
-- `api.kaiAgent.createChat(request: { id: string; message: { id: string; role: "user" | "assistant"; parts: { [key: string]: unknown; }[]; metadata?: { hidden?: boolean | undefined; autoForwarded?: boolean | undefined; requestContext?: { path?: string | undefined; sqlEditorActive?: boolean | undefined; } | undefined; deployPreapproval?: { configurationId: string; } | undefined; tableContext?: { tableName: string; tableId: string; bucketId: string; fileName: string; }[] | undefined; previewSelections?: { source: string | null; sourceTrail: string[]; selector: string; tag: string; text: string; html: string; rect: { x: number; y: number; width: number; height: number; }; page: string; viewport: { width: number; height: number; }; area?: { inside: { source: string | null; tag: string; text: string; }[]; within: { source: string | null; tag: string; text: string; } | null; above: { source: string | null; tag: string; text: string; } | null; below: { source: string | null; tag: string; text: string; } | null; } | undefined; }[] | undefined; previewIntent?: "data-source" | undefined; } | undefined; }; selectedChatModel?: string | undefined; selectedVisibilityType?: "public" | "private" | undefined; branchId?: number | undefined; model?: string | undefined; toolRestrictions?: { allowedTools?: string[] | undefined; disallowedTools?: string[] | undefined; readOnlyMode?: boolean | undefined; } | undefined; telemetryMetadata?: { [key: string]: string | number | boolean; } | undefined; supportsApprovalRequestedEvent?: boolean | undefined; client?: "kbc-ui" | "business-chat" | undefined; }): Promise<Response>`
+- `api.kaiAgent.createChat(request: { id: string; message: { id: string; role: "user" | "assistant"; parts: { [key: string]: unknown; }[]; metadata?: { hidden?: boolean | undefined; autoForwarded?: boolean | undefined; requestContext?: { path?: string | undefined; sqlEditorActive?: boolean | undefined; } | undefined; deployPreapproval?: { configurationId: string; } | undefined; tableContext?: { tableName: string; tableId: string; bucketId: string; fileName: string; }[] | undefined; previewSelections?: { source: string | null; sourceTrail: string[]; selector: string; tag: string; text: string; html: string; rect: { x: number; y: number; width: number; height: number; }; page: string; viewport: { width: number; height: number; }; area?: { inside: { source: string | null; tag: string; text: string; }[]; within: { source: string | null; tag: string; text: string; } | null; above: { source: string | null; tag: string; text: string; } | null; below: { source: string | null; tag: string; text: string; } | null; } | undefined; }[] | undefined; previewIntent?: "data-source" | undefined; } | undefined; }; selectedChatModel?: string | undefined; selectedVisibilityType?: "public" | "private" | undefined; branchId?: number | undefined; model?: string | undefined; toolRestrictions?: { allowedTools?: string[] | undefined; disallowedTools?: string[] | undefined; readOnlyMode?: boolean | undefined; } | undefined; telemetryMetadata?: { [key: string]: string | number | boolean; } | undefined; supportsApprovalRequestedEvent?: boolean | undefined; client?: "kbc-ui" | "business-chat" | undefined; gitCredential?: { repository: string; token: string; } | undefined; }): Promise<Response>`
 - `api.kaiAgent.deleteChat(chatId: string): Promise<{ id?: string | undefined; title?: string | undefined; userId?: string | undefined; createdAt?: string | undefined; visibility?: "public" | "private" | undefined; branchId?: number | null | undefined; }>`
 - `api.kaiAgent.deleteUserMemory(memoryId: string, signal?: AbortSignal | undefined): Promise<void>`
 - `api.kaiAgent.downloadSandboxFile(chatId: string, path: string, signal?: AbortSignal | undefined): Promise<Blob>`
 - `api.kaiAgent.getAgentSettings(signal?: AbortSignal | undefined): Promise<{ projectId: string; customInstructions: string | null; createdAt: string; updatedAt: string; toolPermissions?: Record<string, ProjectToolPolicyValue> | null | undefined; canWriteToolPolicy?: boolean | undefined; }>`
 - `api.kaiAgent.getArtifact(artifactId: string, signal?: AbortSignal | undefined): Promise<{ id: string; chatId: string; messageId: string; kind: "table" | "chart" | "document"; title: string; summary: string | null; spec: { [key: string]: unknown; }; recipe: { [key: string]: unknown; }; createdAt: string; }>`
 - `api.kaiAgent.getArtifacts(chatId: string, signal?: AbortSignal | undefined): Promise<{ id: string; chatId: string; messageId: string; kind: "table" | "chart" | "document"; title: string; summary: string | null; spec: { [key: string]: unknown; }; recipe: { [key: string]: unknown; }; createdAt: string; }[]>`
-- `api.kaiAgent.getChat(chatId: string, signal?: AbortSignal | undefined): Promise<{ id: string; title: string; userId: string; createdAt: string; lastMessageAt: string; visibility: "public" | "private"; branchId?: number | null | undefined; contextWindow?: { usedTokens: number; maxTokens: number; percentage: number; } | null | undefined; ppuUsed: number | null; ppuPercentage: number | null; model: string | null; effort: "medium" | "low" | "high" | "xhigh" | "max" | null; effectiveModel: string | null; messages: { id: string; role: "user" | "assistant"; parts: ({ type: "text"; text: string; state?: "done" | undefined; } | { type: "tool-result"; toolCallId: string; toolName: string; result: string; } | { type: "step-start"; } | { type: "data-compact-boundary"; data: { trigger: "manual" | "auto"; preTokens: number; preservedSegment?: { headUuid: string; anchorUuid: string; tailUuid: string; } | undefined; summary: string; sdkSessionId: string; }; } | { type: string; toolCallId: string; state: "output-available" | "output-error" | "output-denied" | "input-available" | "input-streaming" | "approval-requested" | "approval-responded"; input?: { [key: string]: unknown; } | undefined; output?: unknown; errorText?: string | undefined; approval?: { id: string; approved: boolean; reason?: string | undefined; } | undefined; })[]; metadata?: { createdAt?: string | undefined; hidden?: boolean | undefined; autoForwarded?: boolean | undefined; pausedReason?: "turn-budget" | undefined; requestContext?: { path?: string | undefined; sqlEditorActive?: boolean | undefined; } | undefined; } | undefined; status?: "pending" | "failed" | "completed" | "interrupted" | undefined; }[]; }>`
+- `api.kaiAgent.getChat(chatId: string, signal?: AbortSignal | undefined): Promise<{ id: string; title: string; userId: string; createdAt: string; lastMessageAt: string; visibility: "public" | "private"; branchId?: number | null | undefined; contextWindow?: { usedTokens: number; maxTokens: number; percentage: number; } | null | undefined; ppuUsed: number | null; ppuPercentage: number | null; model: string | null; effort: "medium" | "low" | "high" | "xhigh" | "max" | null; effectiveModel: string | null; messages: { id: string; role: "user" | "assistant"; parts: ({ type: "text"; text: string; state?: "done" | undefined; } | { type: "tool-result"; toolCallId: string; toolName: string; result: string; } | { type: "step-start"; } | { type: "data-compact-boundary"; data: { trigger: "auto" | "manual"; preTokens: number; preservedSegment?: { headUuid: string; anchorUuid: string; tailUuid: string; } | undefined; summary: string; sdkSessionId: string; }; } | { type: string; toolCallId: string; state: "output-available" | "output-error" | "output-denied" | "input-available" | "input-streaming" | "approval-requested" | "approval-responded"; input?: { [key: string]: unknown; } | undefined; output?: unknown; errorText?: string | undefined; approval?: { id: string; approved?: boolean | undefined; reason?: string | undefined; } | undefined; })[]; metadata?: { createdAt?: string | undefined; hidden?: boolean | undefined; autoForwarded?: boolean | undefined; pausedReason?: "turn-budget" | undefined; requestContext?: { path?: string | undefined; sqlEditorActive?: boolean | undefined; } | undefined; } | undefined; status?: "pending" | "failed" | "completed" | "interrupted" | undefined; }[]; }>`
 - `api.kaiAgent.getHistory(params?: { limit?: number | undefined; starting_after?: string | undefined; ending_before?: string | undefined; client?: "kbc-ui" | "business-chat" | undefined; } | undefined, signal?: AbortSignal | undefined): Promise<{ chats: { id?: string | undefined; title?: string | undefined; userId?: string | undefined; createdAt?: string | undefined; lastMessageAt?: string | undefined; visibility?: "public" | "private" | undefined; branchId?: number | null | undefined; client?: "kbc-ui" | "business-chat" | null | undefined; }[]; hasMore: boolean; }>`
 - `api.kaiAgent.getSandboxGitBranch(chatId: string, signal?: AbortSignal | undefined): Promise<{ branch: string | null; }>`
 - `api.kaiAgent.getSkillsList(signal?: AbortSignal | undefined): Promise<{ skills: { name: string; description: string | null; source: "first-party" | "vendored" | "project"; }[]; commands: { name: string; description: string; }[]; }>`
@@ -20,7 +20,7 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.kaiAgent.getSuggestions(request: { context: "dashboard"; data: { recentFailedJobs: { id: string; status: "error" | "warning"; component: string; configId: string; createdTime: string; configName?: string | undefined; durationSeconds?: number | undefined; errorMessage?: string | undefined; }[]; deprecatedComponents: { id: string; name: string; type: string; expiredOn: string; configCount: number; }[]; userRecentEdits: { component: string; configId: string; configName: string; lastEdited: string; }[]; currentUserEmail: string; }; } | { context: "job-detail"; data: { job: { id: string; status: "error" | "success" | "warning" | "created" | "waiting" | "processing" | "terminating" | "terminated" | "cancelled"; component: string; createdTime: string; configId?: string | undefined; configName?: string | undefined; startTime?: string | undefined; endTime?: string | undefined; durationSeconds?: number | undefined; errorMessage?: string | undefined; errorType?: "user" | "application" | undefined; backendSize?: string | undefined; }; currentUserEmail: string; component?: { id: string; name: string; type: string; } | undefined; runtimeHistory?: { recentJobsCount: number; averageDurationSeconds?: number | undefined; minDurationSeconds?: number | undefined; maxDurationSeconds?: number | undefined; isSlowerThanAverage?: boolean | undefined; isFasterThanAverage?: boolean | undefined; percentageDifference?: number | undefined; } | undefined; }; } | { context: "configuration-detail"; data: { configuration: { id: string; name: string; component: string; hasRows: boolean; description?: string | undefined; rowCount?: number | undefined; lastChangeDescription?: string | undefined; }; currentUserEmail: string; component?: { id: string; name: string; type: string; } | undefined; latestJobs?: { id: string; status: "error" | "success" | "warning" | "created" | "waiting" | "processing" | "terminating" | "terminated" | "cancelled"; createdTime: string; durationSeconds?: number | undefined; errorMessage?: string | undefined; }[] | undefined; }; }, signal?: AbortSignal | undefined): Promise<{ suggestions: { label: string; prompt: string; priority: number; category: "error" | "maintenance" | "documentation"; reasoning: string; id: string; }[]; suggestionSessionId: string; }>`
 - `api.kaiAgent.getToolsList(signal?: AbortSignal | undefined): Promise<{ tools: { name: string; description: string; readOnly: boolean; }[]; }>`
 - `api.kaiAgent.getUsage(signal?: AbortSignal | undefined): Promise<UsageResponse>`
-- `api.kaiAgent.getUserAgentSettings(signal?: AbortSignal | undefined): Promise<{ projectId: string; userId: string; customInstructions: string | null; toolPermissions: Record<string, "blocked" | "always_ask" | "always_allow"> | null; createdAt: string; updatedAt: string; projectToolPermissions?: Record<string, ProjectToolPolicyValue> | null | undefined; }>`
+- `api.kaiAgent.getUserAgentSettings(signal?: AbortSignal | undefined): Promise<{ projectId: string; userId: string; customInstructions: string | null; toolPermissions: Record<string, "blocked" | "always_ask" | "always_allow"> | null; createdAt: string; updatedAt: string; projectToolPermissions?: Record<string, ProjectToolPolicyValue> | null | undefined; memorySaveMode?: "auto" | "ask" | undefined; }>`
 - `api.kaiAgent.getUserMemories(signal?: AbortSignal | undefined): Promise<{ id: string; content: string; createdAt: string; }[]>`
 - `api.kaiAgent.getVotes(chatId: string): Promise<{ chatId: string; messageId: string; isUpvoted: boolean; }[]>`
 - `api.kaiAgent.healthCheck(signal?: AbortSignal | undefined): Promise<unknown>`
@@ -34,4 +34,5 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.kaiAgent.updateAgentSettings(request: UpdateAgentSettingsRequest, signal?: AbortSignal | undefined): Promise<{ projectId: string; customInstructions: string | null; createdAt: string; updatedAt: string; toolPermissions?: Record<string, ProjectToolPolicyValue> | null | undefined; canWriteToolPolicy?: boolean | undefined; }>`
 - `api.kaiAgent.updateProjectToolPolicy(toolPermissions: ProjectToolPolicy, signal?: AbortSignal | undefined): Promise<{ projectId: string; customInstructions: string | null; createdAt: string; updatedAt: string; toolPermissions?: Record<string, ProjectToolPolicyValue> | null | undefined; canWriteToolPolicy?: boolean | undefined; }>`
 - `api.kaiAgent.updateSpendCaps(request: UpdateSpendCapsRequest, signal?: AbortSignal | undefined): Promise<SpendCapsView>`
-- `api.kaiAgent.updateUserAgentSettings(request: UpdateUserAgentSettingsRequest, signal?: AbortSignal | undefined): Promise<{ projectId: string; userId: string; customInstructions: string | null; toolPermissions: Record<string, "blocked" | "always_ask" | "always_allow"> | null; createdAt: string; updatedAt: string; projectToolPermissions?: Record<string, ProjectToolPolicyValue> | null | undefined; }>`
+- `api.kaiAgent.updateUserAgentSettings(request: UpdateUserAgentSettingsRequest, signal?: AbortSignal | undefined): Promise<{ projectId: string; userId: string; customInstructions: string | null; toolPermissions: Record<string, "blocked" | "always_ask" | "always_allow"> | null; createdAt: string; updatedAt: string; projectToolPermissions?: Record<string, ProjectToolPolicyValue> | null | undefined; memorySaveMode?: "auto" | "ask" | undefined; }>`
+- `api.kaiAgent.updateUserMemory(memoryId: string, content: string, signal?: AbortSignal | undefined): Promise<{ id: string; content: string; createdAt: string; }>`

package/surface/management.md

@@ -130,6 +130,7 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 ### `api.management.programmaticProjects`
 
 - `api.management.programmaticProjects.confirm(payload: ConfirmProgrammaticProjectPayload, signal?: AbortSignal | undefined): Promise<ConfirmProgrammaticProjectResult>`
+- `api.management.programmaticProjects.getClaim(signal?: AbortSignal | undefined): Promise<{ present: boolean; claimId?: string | null | undefined; projectName?: string | null | undefined; }>`
 
 ### `api.management.projects`
 

package/surface/storage.md

@@ -57,6 +57,7 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.storage.bucketSharing.shareBucketToUsersAsync({ branchId, bucketId, ...body }: ShareBucketToUsersInput, signal?: AbortSignal | undefined): Promise<ShareBucketToAdminsJob>`
 - `api.storage.bucketSharing.shareBucketToUsersPoller(input: ShareBucketToUsersInput, options?: StorageJobPollOptions | undefined): Poller<ShareBucketToAdminsJob, JobBase<"bucketShareToAdmins", Record<string, unknown>> & { status: "success"; results: null; }>`
 - `api.storage.bucketSharing.sharedBuckets<const I extends readonly SharedBucketInclude[] = []>(query?: SharedBucketsQuery<I> | undefined, signal?: AbortSignal | undefined): Promise<SharedBucketWith<I>[]>`
+- `api.storage.bucketSharing.sharingTargets(signal?: AbortSignal | undefined): Promise<{ projects: { id: number; name: string; }[]; users: { id: number; name: string; email: string; }[]; }>`
 - `api.storage.bucketSharing.unshareBucketAsync({ branchId, bucketId }: { bucketId: string; branchId: string; }, signal?: AbortSignal | undefined): Promise<RemoveBucketShareJob>`
 - `api.storage.bucketSharing.unshareBucketPoller(input: { bucketId: string; branchId: string; }, options?: StorageJobPollOptions | undefined): Poller<RemoveBucketShareJob, JobBase<"bucketRemoveShare", Record<string, unknown>> & { status: "success"; results: null; }>`
 
@@ -124,7 +125,7 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.storage.configurationWorkspaces.createConfigurationWorkspace({ componentId, branchId, configurationId, ...body }: CreateConfigurationWorkspaceInput): Promise<CreatedWorkspace>`
 - `api.storage.configurationWorkspaces.createConfigurationWorkspaceAsync({ componentId, branchId, configurationId, ...body }: CreateConfigurationWorkspaceInput, signal?: AbortSignal | undefined): Promise<CreateWorkspaceJob>`
 - `api.storage.configurationWorkspaces.createConfigurationWorkspacePoller(input: CreateConfigurationWorkspaceInput, options?: StorageJobPollOptions | undefined): Poller<CreateWorkspaceJob, JobBase<"workspaceCreate", { backend: string; backendConfiguration: []; backendSize: null; branchId: number; componentId: string; configurationId: string; loginType: number; networkPolicy: string; publicKey: string; readOnlyStorageAccess: boolean; useCase: ConfigurationUseCaseType; }> & { status: "success"; results: Workspace; }>`
-- `api.storage.configurationWorkspaces.getConfigurationWorkspaces({ componentId, branchId, configurationId, }: { componentId: string; configurationId: string; branchId: string; }): Promise<{ id: number; type: "file" | "table"; name: string | null; component: string | null; configurationId: string | null; configurationVersion: number | null; created: string; connection: { backend: "snowflake" | "bigquery" | "synapse" | "exasol" | "teradata" | "postgres" | "ducklake"; region: string; host: string; database: string | null; schema: string | null; warehouse: string | null; user: string; loginType: "default" | "snowflake-person-sso" | "snowflake-legacy-service" | "snowflake-person-keypair" | "snowflake-service-keypair" | "none"; ssoLoginAvailable: boolean; account?: string | undefined; role?: string | null | undefined; } | { backend: string; container: string | null; region: string; }; backendSize: string | null; statementTimeoutSeconds: number; creatorToken: { id: number; description: string | null; }; readOnlyStorageAccess: boolean; platformUsageType: "user" | "service" | "reader" | null; state: "active" | "deactivated"; deactivateAt: string | null; }[]>`
+- `api.storage.configurationWorkspaces.getConfigurationWorkspaces({ componentId, branchId, configurationId, }: { componentId: string; configurationId: string; branchId: string; }): Promise<{ id: number; type: "file" | "table"; name: string | null; component: string | null; configurationId: string | null; configurationVersion: number | null; created: string; connection: { backend: "snowflake" | "bigquery" | "synapse" | "exasol" | "teradata" | "postgres" | "ducklake"; region: string; host: string; database: string | null; schema: string | null; warehouse: string | null; user: string; loginType: "default" | "snowflake-person-sso" | "snowflake-legacy-service" | "snowflake-person-keypair" | "snowflake-service-keypair" | "none" | "governed"; ssoLoginAvailable: boolean; account?: string | undefined; role?: string | null | undefined; } | { backend: string; container: string | null; region: string; }; backendSize: string | null; statementTimeoutSeconds: number; creatorToken: { id: number; description: string | null; }; readOnlyStorageAccess: boolean; platformUsageType: "user" | "service" | "reader" | null; state: "active" | "deactivated"; lastActivityAt: string | null; warnAt: string | null; deactivateAt: string | null; deleteAt: string | null; }[]>`
 
 ### `api.storage.configurations`
 
@@ -261,5 +262,5 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.storage.workspaces.getWorkspaces(path: { branchId: string; }, signal?: AbortSignal | undefined): Promise<Workspace[]>`
 - `api.storage.workspaces.inputMappingLoadPreview({ branchId, body, ...query }: WorkspaceInputMappingLoadPreviewInput, signal?: AbortSignal | undefined): Promise<{ input: { source: string; destination: string; loadType: "VIEW" | "COPY" | "CLONE"; possibleLoadTypes: ("VIEW" | "COPY" | "CLONE")[]; }[]; }>`
 - `api.storage.workspaces.resetWorkspacePassword({ branchId, workspaceId }: { workspaceId: number; branchId: string; }): Promise<{ password?: string | undefined; connectionString?: string | undefined; credentials?: { type?: string | undefined; project_id?: string | undefined; private_key_id?: string | undefined; private_key?: string | undefined; client_email?: string | undefined; client_id?: string | undefined; auth_uri?: string | undefined; token_uri?: string | undefined; auth_provider_x509_cert_url?: string | undefined; client_x509_cert_url?: string | undefined; } | undefined; }>`
-- `api.storage.workspaces.setWorkspacePublicKey({ branchId, workspaceId, ...body }: SetWorkspacePublicInput): Promise<{ id: number; type: "file" | "table"; name: string | null; component: string | null; configurationId: string | null; configurationVersion: number | null; created: string; connection: { backend: "snowflake" | "bigquery" | "synapse" | "exasol" | "teradata" | "postgres" | "ducklake"; region: string; host: string; database: string | null; schema: string | null; warehouse: string | null; user: string; loginType: "default" | "snowflake-person-sso" | "snowflake-legacy-service" | "snowflake-person-keypair" | "snowflake-service-keypair" | "none"; ssoLoginAvailable: boolean; account?: string | undefined; role?: string | null | undefined; } | { backend: string; container: string | null; region: string; }; backendSize: string | null; statementTimeoutSeconds: number; creatorToken: { id: number; description: string | null; }; readOnlyStorageAccess: boolean; platformUsageType: "user" | "service" | "reader" | null; state: "active" | "deactivated"; deactivateAt: string | null; }>`
+- `api.storage.workspaces.setWorkspacePublicKey({ branchId, workspaceId, ...body }: SetWorkspacePublicInput): Promise<{ id: number; type: "file" | "table"; name: string | null; component: string | null; configurationId: string | null; configurationVersion: number | null; created: string; connection: { backend: "snowflake" | "bigquery" | "synapse" | "exasol" | "teradata" | "postgres" | "ducklake"; region: string; host: string; database: string | null; schema: string | null; warehouse: string | null; user: string; loginType: "default" | "snowflake-person-sso" | "snowflake-legacy-service" | "snowflake-person-keypair" | "snowflake-service-keypair" | "none" | "governed"; ssoLoginAvailable: boolean; account?: string | undefined; role?: string | null | undefined; } | { backend: string; container: string | null; region: string; }; backendSize: string | null; statementTimeoutSeconds: number; creatorToken: { id: number; description: string | null; }; readOnlyStorageAccess: boolean; platformUsageType: "user" | "service" | "reader" | null; state: "active" | "deactivated"; lastActivityAt: string | null; warnAt: string | null; deactivateAt: string | null; deleteAt: string | null; }>`
 - `api.storage.workspaces.unloadWorkspace({ branchId, workspaceId, ...query }: UnloadWorkspaceInput): Promise<Record<string, never>[]>`

package/dist/configurations-BTRHVSRq.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"configurations-BTRHVSRq.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts","../src/domain/permissions/configurations.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): AdminRole | null => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin` or `productionManager` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin || token.admin?.role === AdminRole.ProductionManager;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * - Dev branch → developer or reviewer; production → production manager.\n * - Purge is admin-only in any branch mode; its `ctx` is ignored.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` on any branch other than the default (`isDefault`) one.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanUpdateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canUpdateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'update-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;;ACRA,MAAM,QAAQ,UAA0C,MAAM,MAAM;AAEpE,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAASA,mBAAAA,UAAU,SAAS,MAAM,OAAO,SAASA,mBAAAA,UAAU;AAE3E,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;;;AC/FA,MAAM,iBAAiB,OAAqB,QAC1C,IAAI,kBAAkB,sBAAsB,KAAK,IAAI,oBAAoB,KAAK;AAEhF,MAAM,oBAAoB,QACxB,IAAI,kBACA,mDACA;AAEN,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,wBAAwB,OAAqB,QACxD,cAAc,OAAO,GAAG;AAE1B,MAAa,0BAA0B,OAAqB,QAC1D,cAAc,OAAO,GAAG;AAE1B,MAAa,yBACX,UACG,QAAQ,KAAK;AAElB,MAAa,mBAAmB,OAAqB,QACnD,cAAc,OAAO,GAAG;AAE1B,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,8BAA8B,OAAqB,QAAgC;CAC9F,IAAI,CAAC,qBAAqB,OAAO,GAAG,GAClC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,gCAAgC,OAAqB,QAAgC;CAChG,IAAI,CAAC,uBAAuB,OAAO,GAAG,GACpC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL;AAEA,MAAa,+BAA+B,OAAqB,QAAgC;CAC/F,IAAI,CAAC,sBAAsB,OAAO,GAAG,GACnC,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ;CACV,CAAC;AAEL;AAEA,MAAa,yBAAyB,OAAqB,QAAgC;CACzF,IAAI,CAAC,gBAAgB,OAAO,GAAG,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,iBAAiB,GAAG;CAC9B,CAAC;AAEL"}