@keboola/api-client 47.0.0 → 49.0.0

package/dist/microsoftGraph/types.d.cts

@@ -1,4 +1,4 @@
-import { l as OpenapiReturnType } from "../index-XaPb6unB.cjs";
+import { l as OpenapiReturnType } from "../index-CL4iKFic.cjs";
 import { n as paths } from "../schema-BUyMwQnM.cjs";
 //#region src/clients/microsoftGraph/types.d.ts
 type User = OpenapiReturnType<paths['/me']['get']>;

package/dist/microsoftGraph/types.d.ts

@@ -1,4 +1,4 @@
-import { l as OpenapiReturnType } from "../index-r6YSe8B-.js";
+import { l as OpenapiReturnType } from "../index-BPMr8PQJ.js";
 import { n as paths } from "../schema-BUyMwQnM.js";
 //#region src/clients/microsoftGraph/types.d.ts
 type User = OpenapiReturnType<paths['/me']['get']>;

package/dist/{middleware-DU_5pFDW.cjs → middleware-CEP6uu_D.cjs}

@@ -8,9 +8,9 @@ const isUnauthorized = (error) => error instanceof require_createFetchClient.Api
 * - Anonymous (`null` token): passes through untouched, so `login` / `refresh` work.
 * - A `forceRefresh` answering `null` stops the replay.
 */
-const createBearerAuthMiddleware = (credential) => {
+const createBearerAuthMiddleware = (source) => {
 	return (next) => async (request) => {
-		const token = await credential.getAccessToken({ forceRefresh: false });
+		const token = await source.getAccessToken({ forceRefresh: false });
 		if (token === null) return next(request);
 		const retryRequest = request.request.clone();
 		request.request.headers.set(require_createFetchClient.HttpHeader.AUTHORIZATION, `Bearer ${token}`);
@@ -18,7 +18,7 @@ const createBearerAuthMiddleware = (credential) => {
 			return await next(request);
 		} catch (error) {
 			if (!isUnauthorized(error)) throw error;
-			const refreshed = await credential.getAccessToken({ forceRefresh: true });
+			const refreshed = await source.getAccessToken({ forceRefresh: true });
 			if (refreshed === null) throw error;
 			retryRequest.headers.set(require_createFetchClient.HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);
 			return await next({
@@ -42,4 +42,4 @@ Object.defineProperty(exports, "isUnauthorized", {
 	}
 });
 
-//# sourceMappingURL=middleware-DU_5pFDW.cjs.map
+//# sourceMappingURL=middleware-CEP6uu_D.cjs.map

package/dist/middleware-CEP6uu_D.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-CEP6uu_D.cjs","names":["ApiError","HttpStatus","HttpHeader"],"sources":["../src/keboola/bearer/credentials/middleware.ts"],"sourcesContent":["import { ApiError } from '../../../errors';\nimport { HttpHeader, type MiddlewareFn } from '../../../fetchClient';\nimport { HttpStatus } from '../../../internal';\n\nexport const isUnauthorized = (error: unknown): boolean =>\n  error instanceof ApiError && error.response.status === HttpStatus.UNAUTHORIZED;\n\n/** Where the middleware gets its token; whether the credential behind it is dead is not its call. */\nexport type AccessTokenSource = {\n  /** `null` while anonymous — nothing to stamp. */\n  getAccessToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n};\n\n/**\n * Bearer auth: stamps the access token; on a 401, force-refreshes and replays once.\n *\n * - A replay that still 401s passes on, not as expiry: an unreachable project gets the same 401.\n * - Anonymous (`null` token): passes through untouched, so `login` / `refresh` work.\n * - A `forceRefresh` answering `null` stops the replay.\n */\nexport const createBearerAuthMiddleware = (source: AccessTokenSource): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await source.getAccessToken({ forceRefresh: false });\n    if (token === null) return next(request);\n\n    // Cloned for the replay: the first attempt may consume the body.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${token}`);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await source.getAccessToken({ forceRefresh: true });\n      // Went anonymous mid-flight — surface the original 401.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);\n\n      return await next({ ...request, request: retryRequest });\n    }\n  };\n};\n"],"mappings":";;AAIA,MAAa,kBAAkB,UAC7B,iBAAiBA,0BAAAA,YAAY,MAAM,SAAS,WAAWC,0BAAAA,WAAW;;;;;;;;AAepE,MAAa,8BAA8B,WAA4C;CACrF,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,OAAO,eAAe,EAAE,cAAc,MAAM,CAAC;EACjE,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAGvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,UAAU,OAAO;EAEvE,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,OAAO,eAAe,EAAE,cAAc,KAAK,CAAC;GAEpE,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAIA,0BAAAA,WAAW,eAAe,UAAU,WAAW;GAExE,OAAO,MAAM,KAAK;IAAE,GAAG;IAAS,SAAS;GAAa,CAAC;EACzD;CACF;AACF"}

package/dist/{middleware-CWaLMlG1.js → middleware-GOfx8Apu.js}

@@ -8,9 +8,9 @@ const isUnauthorized = (error) => error instanceof ApiError && error.response.st
 * - Anonymous (`null` token): passes through untouched, so `login` / `refresh` work.
 * - A `forceRefresh` answering `null` stops the replay.
 */
-const createBearerAuthMiddleware = (credential) => {
+const createBearerAuthMiddleware = (source) => {
 	return (next) => async (request) => {
-		const token = await credential.getAccessToken({ forceRefresh: false });
+		const token = await source.getAccessToken({ forceRefresh: false });
 		if (token === null) return next(request);
 		const retryRequest = request.request.clone();
 		request.request.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${token}`);
@@ -18,7 +18,7 @@ const createBearerAuthMiddleware = (credential) => {
 			return await next(request);
 		} catch (error) {
 			if (!isUnauthorized(error)) throw error;
-			const refreshed = await credential.getAccessToken({ forceRefresh: true });
+			const refreshed = await source.getAccessToken({ forceRefresh: true });
 			if (refreshed === null) throw error;
 			retryRequest.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);
 			return await next({
@@ -31,4 +31,4 @@ const createBearerAuthMiddleware = (credential) => {
 //#endregion
 export { isUnauthorized as n, createBearerAuthMiddleware as t };
 
-//# sourceMappingURL=middleware-CWaLMlG1.js.map
+//# sourceMappingURL=middleware-GOfx8Apu.js.map

package/dist/middleware-GOfx8Apu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-GOfx8Apu.js","names":[],"sources":["../src/keboola/bearer/credentials/middleware.ts"],"sourcesContent":["import { ApiError } from '../../../errors';\nimport { HttpHeader, type MiddlewareFn } from '../../../fetchClient';\nimport { HttpStatus } from '../../../internal';\n\nexport const isUnauthorized = (error: unknown): boolean =>\n  error instanceof ApiError && error.response.status === HttpStatus.UNAUTHORIZED;\n\n/** Where the middleware gets its token; whether the credential behind it is dead is not its call. */\nexport type AccessTokenSource = {\n  /** `null` while anonymous — nothing to stamp. */\n  getAccessToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n};\n\n/**\n * Bearer auth: stamps the access token; on a 401, force-refreshes and replays once.\n *\n * - A replay that still 401s passes on, not as expiry: an unreachable project gets the same 401.\n * - Anonymous (`null` token): passes through untouched, so `login` / `refresh` work.\n * - A `forceRefresh` answering `null` stops the replay.\n */\nexport const createBearerAuthMiddleware = (source: AccessTokenSource): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await source.getAccessToken({ forceRefresh: false });\n    if (token === null) return next(request);\n\n    // Cloned for the replay: the first attempt may consume the body.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${token}`);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await source.getAccessToken({ forceRefresh: true });\n      // Went anonymous mid-flight — surface the original 401.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);\n\n      return await next({ ...request, request: retryRequest });\n    }\n  };\n};\n"],"mappings":";;AAIA,MAAa,kBAAkB,UAC7B,iBAAiB,YAAY,MAAM,SAAS,WAAW,WAAW;;;;;;;;AAepE,MAAa,8BAA8B,WAA4C;CACrF,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,OAAO,eAAe,EAAE,cAAc,MAAM,CAAC;EACjE,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAGvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,UAAU,OAAO;EAEvE,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,OAAO,eAAe,EAAE,cAAc,KAAK,CAAC;GAEpE,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,UAAU,WAAW;GAExE,OAAO,MAAM,KAAK;IAAE,GAAG;IAAS,SAAS;GAAa,CAAC;EACzD;CACF;AACF"}

package/dist/notifications/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-OkQWmonU.cjs";
-import { a as SubscriptionId, n as ListSubscriptionsQuery, s as components, t as CreateSubscriptionBody } from "../types-DBJ8c3hN.cjs";
+import { n as ClientInitOptions } from "../types-O6XM48J8.cjs";
+import { a as SubscriptionId, n as ListSubscriptionsQuery, s as components, t as CreateSubscriptionBody } from "../types-DmzSFOhK.cjs";
 //#region src/clients/notifications/notificationsClient.d.ts
 declare const createNotificationsClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/notifications/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-Cw9UISvM.js";
-import { a as SubscriptionId, n as ListSubscriptionsQuery, s as components, t as CreateSubscriptionBody } from "../types-DWJVbskE.js";
+import { n as ClientInitOptions } from "../types-CeqZuOEC.js";
+import { a as SubscriptionId, n as ListSubscriptionsQuery, s as components, t as CreateSubscriptionBody } from "../types-DlhNay1n.js";
 //#region src/clients/notifications/notificationsClient.d.ts
 declare const createNotificationsClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/notifications/types.d.cts

@@ -1,2 +1,2 @@
-import { a as SubscriptionId, i as SubscriptionFilter, n as ListSubscriptionsQuery, o as SubscriptionRecipient, r as ProjectSubscription, t as CreateSubscriptionBody } from "../types-DBJ8c3hN.cjs";
+import { a as SubscriptionId, i as SubscriptionFilter, n as ListSubscriptionsQuery, o as SubscriptionRecipient, r as ProjectSubscription, t as CreateSubscriptionBody } from "../types-DmzSFOhK.cjs";
 export { CreateSubscriptionBody, ListSubscriptionsQuery, ProjectSubscription, SubscriptionFilter, SubscriptionId, SubscriptionRecipient };

package/dist/notifications/types.d.ts

@@ -1,2 +1,2 @@
-import { a as SubscriptionId, i as SubscriptionFilter, n as ListSubscriptionsQuery, o as SubscriptionRecipient, r as ProjectSubscription, t as CreateSubscriptionBody } from "../types-DWJVbskE.js";
+import { a as SubscriptionId, i as SubscriptionFilter, n as ListSubscriptionsQuery, o as SubscriptionRecipient, r as ProjectSubscription, t as CreateSubscriptionBody } from "../types-DlhNay1n.js";
 export { CreateSubscriptionBody, ListSubscriptionsQuery, ProjectSubscription, SubscriptionFilter, SubscriptionId, SubscriptionRecipient };

package/dist/oauth/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-OkQWmonU.cjs";
-import { a as CredentialInput, c as GetCredentialsInput, r as CreateCredentialInput } from "../types-4CjbcUdD.cjs";
+import { n as ClientInitOptions } from "../types-O6XM48J8.cjs";
+import { a as CredentialInput, c as GetCredentialsInput, r as CreateCredentialInput } from "../types-CTS2NSIb.cjs";
 //#region src/clients/oauth/oauthClient.d.ts
 declare const createOauthClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/oauth/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-Cw9UISvM.js";
-import { a as CredentialInput, c as GetCredentialsInput, r as CreateCredentialInput } from "../types-B2ZLjagf.js";
+import { n as ClientInitOptions } from "../types-CeqZuOEC.js";
+import { a as CredentialInput, c as GetCredentialsInput, r as CreateCredentialInput } from "../types-BjwbzqJd.js";
 //#region src/clients/oauth/oauthClient.d.ts
 declare const createOauthClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/oauth/types.d.cts

@@ -1,2 +1,2 @@
-import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-4CjbcUdD.cjs";
+import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-CTS2NSIb.cjs";
 export { ComponentPath, CreateCredentialBody, CreateCredentialInput, Credential, CredentialInput, CredentialPath, type GetCredentialsInput, OrganizationConnection };

package/dist/oauth/types.d.ts

@@ -1,2 +1,2 @@
-import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-B2ZLjagf.js";
+import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-BjwbzqJd.js";
 export { ComponentPath, CreateCredentialBody, CreateCredentialInput, Credential, CredentialInput, CredentialPath, type GetCredentialsInput, OrganizationConnection };

package/dist/omnisearch/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-OkQWmonU.cjs";
-import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-DPDq8C4q.cjs";
+import { n as ClientInitOptions } from "../types-O6XM48J8.cjs";
+import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-vvw_H7wp.cjs";
 //#region src/clients/omnisearch/omnisearchClient.d.ts
 /**
  * Omnisearch — data lineage.

package/dist/omnisearch/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-Cw9UISvM.js";
-import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-Dg8a7m7f.js";
+import { n as ClientInitOptions } from "../types-CeqZuOEC.js";
+import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-D9ZKJYZk.js";
 //#region src/clients/omnisearch/omnisearchClient.d.ts
 /**
  * Omnisearch — data lineage.

package/dist/omnisearch/types.d.cts

@@ -1,2 +1,2 @@
-import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-DPDq8C4q.cjs";
+import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-vvw_H7wp.cjs";
 export { GetProjectsLineageQuery, GetTablesLineageQuery, LineageBucket, LineageConfiguration, LineageMetadata, LineageProject, LineageSource, LineageTable, ProjectLineageRelation, ProjectsLineage, ProjectsLineageResponse, TableLineageRelation, TablesLineage, TablesLineageResponse };

package/dist/omnisearch/types.d.ts

@@ -1,2 +1,2 @@
-import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-Dg8a7m7f.js";
+import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-D9ZKJYZk.js";
 export { GetProjectsLineageQuery, GetTablesLineageQuery, LineageBucket, LineageConfiguration, LineageMetadata, LineageProject, LineageSource, LineageTable, ProjectLineageRelation, ProjectsLineage, ProjectsLineageResponse, TableLineageRelation, TablesLineage, TablesLineageResponse };

package/dist/project-ClH22nzH.js

@@ -0,0 +1,86 @@
+import { t as AdminRole } from "./adminRoles-B40yBcmq.js";
+import { D as PermissionDeniedError, x as isAdminOrShare } from "./configurations-CL0ouUMa.js";
+//#region src/domain/permissions/organization.ts
+/**
+* Whether this token's admin is a member of the organization owning the project.
+*
+* - A limited token has no `admin` block despite the type saying required.
+* - Prefer `isOrganizationAdmin` for authorization decisions.
+*/
+const isOrganizationMember = (token) => token.isMasterToken && (token.admin?.isOrganizationMember ?? false);
+/**
+* `isOrganizationMember` AND `admin`/`share`.
+*
+* - An org member with a `readOnly` or `guest` role on this project still cannot write.
+*/
+const isOrganizationAdmin = (token) => isOrganizationMember(token) && isAdminOrShare(token);
+const assertCanAdministerOrganization = (token) => {
+	if (!isOrganizationAdmin(token)) throw new PermissionDeniedError({
+		action: "administer-organization",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings` : "a limited (non-master) token may not administer organization settings"
+	});
+};
+/**
+* Whether this token may write Kai's spend caps: project cap, default and per-user limits.
+*
+* - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.
+* - A project whose own admin could raise its cap has no cap.
+*/
+const canWriteKaiSpendCaps = (token) => isOrganizationAdmin(token);
+const assertCanWriteKaiSpendCaps = (token) => {
+	if (!canWriteKaiSpendCaps(token)) throw new PermissionDeniedError({
+		action: "write-kai-spend-caps",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps` : "a limited (non-master) token may not change Kai spend caps"
+	});
+};
+//#endregion
+//#region src/domain/permissions/storage.ts
+/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */
+const canListSharingTargets = (token) => isOrganizationMember(token) || token.isMasterToken && token.admin?.role === AdminRole.Share;
+//#endregion
+//#region src/domain/project.ts
+const hasFeature = (token, ...feature) => {
+	if (feature.length === 0) return false;
+	const projectFeatureSet = new Set(token.owner.features);
+	return feature.every((x) => projectFeatureSet.has(x));
+};
+/**
+* The admin's features as the Storage token carries them.
+*
+* - The same list `createAdminAccount` reads from the Manage token: Connection serialises both
+*   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.
+*/
+const hasAdminFeature = (token, ...feature) => {
+	if (feature.length === 0) return false;
+	const adminFeatureSet = new Set(token.admin?.features ?? []);
+	return feature.every((x) => adminFeatureSet.has(x));
+};
+const createProject = ({ sapiToken }) => {
+	const { owner, admin } = sapiToken;
+	const projectFeatureSet = new Set(owner.features);
+	const adminFeatureSet = new Set(admin?.features ?? []);
+	const hasFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => projectFeatureSet.has(x));
+	};
+	const hasAdminFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => adminFeatureSet.has(x));
+	};
+	const hasBackend = (backend) => {
+		if (backend === "bigquery") return owner.hasBigquery;
+		if (backend === "snowflake") return owner.hasSnowflake;
+		return false;
+	};
+	return {
+		hasFeature,
+		hasAdminFeature,
+		hasBackend,
+		canListSharingTargets: canListSharingTargets(sapiToken),
+		sapiToken
+	};
+};
+//#endregion
+export { assertCanAdministerOrganization as a, isOrganizationAdmin as c, canListSharingTargets as i, isOrganizationMember as l, hasAdminFeature as n, assertCanWriteKaiSpendCaps as o, hasFeature as r, canWriteKaiSpendCaps as s, createProject as t };
+
+//# sourceMappingURL=project-ClH22nzH.js.map

package/dist/project-ClH22nzH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-ClH22nzH.js","names":[],"sources":["../src/domain/permissions/organization.ts","../src/domain/permissions/storage.ts","../src/domain/project.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates, read from `admin.isOrganizationMember`, not the project role.\n * - In Keboola, org membership is org administration of every project the org owns.\n * - `isOrganizationMember` is a raw signal; nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Whether this token's admin is a member of the organization owning the project.\n *\n * - A limited token has no `admin` block despite the type saying required.\n * - Prefer `isOrganizationAdmin` for authorization decisions.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * `isOrganizationMember` AND `admin`/`share`.\n *\n * - An org member with a `readOnly` or `guest` role on this project still cannot write.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's spend caps: project cap, default and per-user limits.\n *\n * - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.\n * - A project whose own admin could raise its cap has no cap.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n","/**\n * @module domain/permissions/storage\n *\n * Storage-scope predicates.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { isOrganizationMember } from './organization';\n\n/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */\nexport const canListSharingTargets = (token: StorageToken): boolean =>\n  isOrganizationMember(token) || (token.isMasterToken && token.admin?.role === AdminRole.Share);\n","import type { Backend, StorageToken } from '../clients/storage/tokens/types';\n\nimport { canListSharingTargets } from './permissions/storage';\n\ntype Options = {\n  sapiToken: StorageToken;\n};\n\nexport const hasFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const projectFeatureSet = new Set(token.owner.features);\n  return feature.every((x) => projectFeatureSet.has(x));\n};\n\n/**\n * The admin's features as the Storage token carries them.\n *\n * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both\n *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.\n */\nexport const hasAdminFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const adminFeatureSet = new Set(token.admin?.features ?? []);\n  return feature.every((x) => adminFeatureSet.has(x));\n};\n\nexport const createProject = ({ sapiToken }: Options) => {\n  const { owner, admin } = sapiToken;\n  const projectFeatureSet = new Set(owner.features);\n  // `verify` omits `admin` for a token created via `POST /v2/storage/tokens`, even though the type\n  // declares it: an admin-less token holds no admin features, rather than failing to build at all.\n  const adminFeatureSet = new Set(admin?.features ?? []);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => projectFeatureSet.has(x));\n  };\n\n  // Same list as `createAdminAccount`'s; prefer the account where one is at hand.\n  const hasAdminFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => adminFeatureSet.has(x));\n  };\n\n  const hasBackend = (backend: Backend): boolean => {\n    if (backend === 'bigquery') return owner.hasBigquery;\n    if (backend === 'snowflake') return owner.hasSnowflake;\n    return false;\n  };\n\n  return {\n    hasFeature,\n    hasAdminFeature,\n    hasBackend,\n    canListSharingTargets: canListSharingTargets(sapiToken),\n    sapiToken,\n  };\n};\n\nexport type Project = ReturnType<typeof createProject>;\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;AAO/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAK,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;AAQA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL;;;;AC9CA,MAAa,yBAAyB,UACpC,qBAAqB,KAAK,KAAM,MAAM,iBAAiB,MAAM,OAAO,SAAS,UAAU;;;ACJzF,MAAa,cAAc,OAAqB,GAAG,YAA+B;CAChF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,oBAAoB,IAAI,IAAI,MAAM,MAAM,QAAQ;CACtD,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;AACtD;;;;;;;AAQA,MAAa,mBAAmB,OAAqB,GAAG,YAA+B;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,kBAAkB,IAAI,IAAI,MAAM,OAAO,YAAY,CAAC,CAAC;CAC3D,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;AACpD;AAEA,MAAa,iBAAiB,EAAE,gBAAyB;CACvD,MAAM,EAAE,OAAO,UAAU;CACzB,MAAM,oBAAoB,IAAI,IAAI,MAAM,QAAQ;CAGhD,MAAM,kBAAkB,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;CAErD,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;CACtD;CAGA,MAAM,mBAAmB,GAAG,YAAsB;EAChD,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;CACpD;CAEA,MAAM,cAAc,YAA8B;EAChD,IAAI,YAAY,YAAY,OAAO,MAAM;EACzC,IAAI,YAAY,aAAa,OAAO,MAAM;EAC1C,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA,uBAAuB,sBAAsB,SAAS;EACtD;CACF;AACF"}

package/dist/{project-BMmfPhXg.d.ts → project-DTfBtIJs.d.ts}

@@ -1,5 +1,5 @@
-import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-r6YSe8B-.js";
-import "./adminRoles-CvdIUkiC.js";
+import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-BPMr8PQJ.js";
+import "./adminRoles-BX1gk3At.js";
 import { t as Backend } from "./backends-DKBz5OxE.js";
 //#region src/clients/storage/tokens/types.d.ts
 type ProjectId = number;
@@ -66,9 +66,10 @@ declare const createProject: ({ sapiToken }: Options) => {
   hasFeature: (...feature: string[]) => boolean;
   hasAdminFeature: (...feature: string[]) => boolean;
   hasBackend: (backend: Backend) => boolean;
+  canListSharingTargets: boolean;
   sapiToken: StorageToken;
 };
 type Project = ReturnType<typeof createProject>;
 //#endregion
 export { UpdateTokenInput as _, CreateTokenResponse as a, GetTokenEventsPath as c, ShareTokenInput as d, ShareTokenPath as f, UpdateTokenBody as g, TokenListItem as h, CreateTokenBody as i, ProjectId as l, StorageTokenRaw as m, hasAdminFeature as n, CreateTokenSchemaBody as o, StorageToken as p, hasFeature as r, GetTokenEventsInput as s, Project as t, ShareTokenBody as u, UpdateTokenPath as v, UpdateTokenSchemaBody as y };
-//# sourceMappingURL=project-BMmfPhXg.d.ts.map
+//# sourceMappingURL=project-DTfBtIJs.d.ts.map

package/dist/project-Rh4nXiWh.cjs

@@ -0,0 +1,139 @@
+const require_adminRoles = require("./adminRoles-CO7J5qAy.cjs");
+const require_configurations = require("./configurations-D9J3jh3g.cjs");
+//#region src/domain/permissions/organization.ts
+/**
+* Whether this token's admin is a member of the organization owning the project.
+*
+* - A limited token has no `admin` block despite the type saying required.
+* - Prefer `isOrganizationAdmin` for authorization decisions.
+*/
+const isOrganizationMember = (token) => token.isMasterToken && (token.admin?.isOrganizationMember ?? false);
+/**
+* `isOrganizationMember` AND `admin`/`share`.
+*
+* - An org member with a `readOnly` or `guest` role on this project still cannot write.
+*/
+const isOrganizationAdmin = (token) => isOrganizationMember(token) && require_configurations.isAdminOrShare(token);
+const assertCanAdministerOrganization = (token) => {
+	if (!isOrganizationAdmin(token)) throw new require_configurations.PermissionDeniedError({
+		action: "administer-organization",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings` : "a limited (non-master) token may not administer organization settings"
+	});
+};
+/**
+* Whether this token may write Kai's spend caps: project cap, default and per-user limits.
+*
+* - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.
+* - A project whose own admin could raise its cap has no cap.
+*/
+const canWriteKaiSpendCaps = (token) => isOrganizationAdmin(token);
+const assertCanWriteKaiSpendCaps = (token) => {
+	if (!canWriteKaiSpendCaps(token)) throw new require_configurations.PermissionDeniedError({
+		action: "write-kai-spend-caps",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps` : "a limited (non-master) token may not change Kai spend caps"
+	});
+};
+//#endregion
+//#region src/domain/permissions/storage.ts
+/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */
+const canListSharingTargets = (token) => isOrganizationMember(token) || token.isMasterToken && token.admin?.role === require_adminRoles.AdminRole.Share;
+//#endregion
+//#region src/domain/project.ts
+const hasFeature = (token, ...feature) => {
+	if (feature.length === 0) return false;
+	const projectFeatureSet = new Set(token.owner.features);
+	return feature.every((x) => projectFeatureSet.has(x));
+};
+/**
+* The admin's features as the Storage token carries them.
+*
+* - The same list `createAdminAccount` reads from the Manage token: Connection serialises both
+*   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.
+*/
+const hasAdminFeature = (token, ...feature) => {
+	if (feature.length === 0) return false;
+	const adminFeatureSet = new Set(token.admin?.features ?? []);
+	return feature.every((x) => adminFeatureSet.has(x));
+};
+const createProject = ({ sapiToken }) => {
+	const { owner, admin } = sapiToken;
+	const projectFeatureSet = new Set(owner.features);
+	const adminFeatureSet = new Set(admin?.features ?? []);
+	const hasFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => projectFeatureSet.has(x));
+	};
+	const hasAdminFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => adminFeatureSet.has(x));
+	};
+	const hasBackend = (backend) => {
+		if (backend === "bigquery") return owner.hasBigquery;
+		if (backend === "snowflake") return owner.hasSnowflake;
+		return false;
+	};
+	return {
+		hasFeature,
+		hasAdminFeature,
+		hasBackend,
+		canListSharingTargets: canListSharingTargets(sapiToken),
+		sapiToken
+	};
+};
+//#endregion
+Object.defineProperty(exports, "assertCanAdministerOrganization", {
+	enumerable: true,
+	get: function() {
+		return assertCanAdministerOrganization;
+	}
+});
+Object.defineProperty(exports, "assertCanWriteKaiSpendCaps", {
+	enumerable: true,
+	get: function() {
+		return assertCanWriteKaiSpendCaps;
+	}
+});
+Object.defineProperty(exports, "canListSharingTargets", {
+	enumerable: true,
+	get: function() {
+		return canListSharingTargets;
+	}
+});
+Object.defineProperty(exports, "canWriteKaiSpendCaps", {
+	enumerable: true,
+	get: function() {
+		return canWriteKaiSpendCaps;
+	}
+});
+Object.defineProperty(exports, "createProject", {
+	enumerable: true,
+	get: function() {
+		return createProject;
+	}
+});
+Object.defineProperty(exports, "hasAdminFeature", {
+	enumerable: true,
+	get: function() {
+		return hasAdminFeature;
+	}
+});
+Object.defineProperty(exports, "hasFeature", {
+	enumerable: true,
+	get: function() {
+		return hasFeature;
+	}
+});
+Object.defineProperty(exports, "isOrganizationAdmin", {
+	enumerable: true,
+	get: function() {
+		return isOrganizationAdmin;
+	}
+});
+Object.defineProperty(exports, "isOrganizationMember", {
+	enumerable: true,
+	get: function() {
+		return isOrganizationMember;
+	}
+});
+
+//# sourceMappingURL=project-Rh4nXiWh.cjs.map

package/dist/project-Rh4nXiWh.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-Rh4nXiWh.cjs","names":["isAdminOrShare","PermissionDeniedError","AdminRole"],"sources":["../src/domain/permissions/organization.ts","../src/domain/permissions/storage.ts","../src/domain/project.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates, read from `admin.isOrganizationMember`, not the project role.\n * - In Keboola, org membership is org administration of every project the org owns.\n * - `isOrganizationMember` is a raw signal; nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Whether this token's admin is a member of the organization owning the project.\n *\n * - A limited token has no `admin` block despite the type saying required.\n * - Prefer `isOrganizationAdmin` for authorization decisions.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * `isOrganizationMember` AND `admin`/`share`.\n *\n * - An org member with a `readOnly` or `guest` role on this project still cannot write.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's spend caps: project cap, default and per-user limits.\n *\n * - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.\n * - A project whose own admin could raise its cap has no cap.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n","/**\n * @module domain/permissions/storage\n *\n * Storage-scope predicates.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { isOrganizationMember } from './organization';\n\n/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */\nexport const canListSharingTargets = (token: StorageToken): boolean =>\n  isOrganizationMember(token) || (token.isMasterToken && token.admin?.role === AdminRole.Share);\n","import type { Backend, StorageToken } from '../clients/storage/tokens/types';\n\nimport { canListSharingTargets } from './permissions/storage';\n\ntype Options = {\n  sapiToken: StorageToken;\n};\n\nexport const hasFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const projectFeatureSet = new Set(token.owner.features);\n  return feature.every((x) => projectFeatureSet.has(x));\n};\n\n/**\n * The admin's features as the Storage token carries them.\n *\n * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both\n *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.\n */\nexport const hasAdminFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const adminFeatureSet = new Set(token.admin?.features ?? []);\n  return feature.every((x) => adminFeatureSet.has(x));\n};\n\nexport const createProject = ({ sapiToken }: Options) => {\n  const { owner, admin } = sapiToken;\n  const projectFeatureSet = new Set(owner.features);\n  // `verify` omits `admin` for a token created via `POST /v2/storage/tokens`, even though the type\n  // declares it: an admin-less token holds no admin features, rather than failing to build at all.\n  const adminFeatureSet = new Set(admin?.features ?? []);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => projectFeatureSet.has(x));\n  };\n\n  // Same list as `createAdminAccount`'s; prefer the account where one is at hand.\n  const hasAdminFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => adminFeatureSet.has(x));\n  };\n\n  const hasBackend = (backend: Backend): boolean => {\n    if (backend === 'bigquery') return owner.hasBigquery;\n    if (backend === 'snowflake') return owner.hasSnowflake;\n    return false;\n  };\n\n  return {\n    hasFeature,\n    hasAdminFeature,\n    hasBackend,\n    canListSharingTargets: canListSharingTargets(sapiToken),\n    sapiToken,\n  };\n};\n\nexport type Project = ReturnType<typeof createProject>;\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;AAO/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAKA,uBAAAA,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAIC,uBAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;AAQA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAIA,uBAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL;;;;AC9CA,MAAa,yBAAyB,UACpC,qBAAqB,KAAK,KAAM,MAAM,iBAAiB,MAAM,OAAO,SAASC,mBAAAA,UAAU;;;ACJzF,MAAa,cAAc,OAAqB,GAAG,YAA+B;CAChF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,oBAAoB,IAAI,IAAI,MAAM,MAAM,QAAQ;CACtD,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;AACtD;;;;;;;AAQA,MAAa,mBAAmB,OAAqB,GAAG,YAA+B;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,kBAAkB,IAAI,IAAI,MAAM,OAAO,YAAY,CAAC,CAAC;CAC3D,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;AACpD;AAEA,MAAa,iBAAiB,EAAE,gBAAyB;CACvD,MAAM,EAAE,OAAO,UAAU;CACzB,MAAM,oBAAoB,IAAI,IAAI,MAAM,QAAQ;CAGhD,MAAM,kBAAkB,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;CAErD,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;CACtD;CAGA,MAAM,mBAAmB,GAAG,YAAsB;EAChD,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;CACpD;CAEA,MAAM,cAAc,YAA8B;EAChD,IAAI,YAAY,YAAY,OAAO,MAAM;EACzC,IAAI,YAAY,aAAa,OAAO,MAAM;EAC1C,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA,uBAAuB,sBAAsB,SAAS;EACtD;CACF;AACF"}

package/dist/{project-dxCJbFay.d.cts → project-vOnvjo80.d.cts}

@@ -1,5 +1,5 @@
-import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-XaPb6unB.cjs";
-import "./adminRoles-DGM8SuuF.cjs";
+import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-CL4iKFic.cjs";
+import "./adminRoles-BbxFgfX-.cjs";
 import { t as Backend } from "./backends-DKBz5OxE.cjs";
 //#region src/clients/storage/tokens/types.d.ts
 type ProjectId = number;
@@ -66,9 +66,10 @@ declare const createProject: ({ sapiToken }: Options) => {
   hasFeature: (...feature: string[]) => boolean;
   hasAdminFeature: (...feature: string[]) => boolean;
   hasBackend: (backend: Backend) => boolean;
+  canListSharingTargets: boolean;
   sapiToken: StorageToken;
 };
 type Project = ReturnType<typeof createProject>;
 //#endregion
 export { UpdateTokenInput as _, CreateTokenResponse as a, GetTokenEventsPath as c, ShareTokenInput as d, ShareTokenPath as f, UpdateTokenBody as g, TokenListItem as h, CreateTokenBody as i, ProjectId as l, StorageTokenRaw as m, hasAdminFeature as n, CreateTokenSchemaBody as o, StorageToken as p, hasFeature as r, GetTokenEventsInput as s, Project as t, ShareTokenBody as u, UpdateTokenPath as v, UpdateTokenSchemaBody as y };
-//# sourceMappingURL=project-dxCJbFay.d.cts.map
+//# sourceMappingURL=project-vOnvjo80.d.cts.map

package/dist/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { S as createQueryServiceClient } from "../index-CkwZ5x7E.cjs";
+import { S as createQueryServiceClient } from "../index-Be2dNJ_N.cjs";
 export { createQueryServiceClient };

package/dist/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { S as createQueryServiceClient } from "../index-CAWy1qjR.js";
+import { S as createQueryServiceClient } from "../index-uGRdAORl.js";
 export { createQueryServiceClient };

package/dist/queryService/types.d.cts

@@ -1,2 +1,2 @@
-import { $ as GetQueryResultsPath, J as ExportResultsResponse, Q as GetQueryJobPath, X as GetQueriesHistoryQuery, Y as GetExportResultsQuery, Z as GetQueriesPath, at as QueryJobStatus, et as GetQueryResutsQuery, it as PostQueryPath, nt as PostCancelQueryJobPath, ot as QueryResult, q as QueryJobPollOptions, rt as PostQueryBody, st as Statements, tt as JobStatusResponse } from "../index-CkwZ5x7E.cjs";
+import { $ as PostQueryBody, G as GetExportResultsQuery, J as GetQueryJobPath, K as GetQueriesHistoryQuery, Q as PostCancelQueryJobPath, U as QueryJobPollOptions, W as ExportResultsResponse, X as GetQueryResutsQuery, Y as GetQueryResultsPath, Z as JobStatusResponse, et as PostQueryPath, nt as QueryResult, q as GetQueriesPath, rt as Statements, tt as QueryJobStatus } from "../index-Be2dNJ_N.cjs";
 export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, type QueryJobPollOptions, QueryJobStatus, QueryResult, Statements };

package/dist/queryService/types.d.ts

@@ -1,2 +1,2 @@
-import { $ as GetQueryResultsPath, J as ExportResultsResponse, Q as GetQueryJobPath, X as GetQueriesHistoryQuery, Y as GetExportResultsQuery, Z as GetQueriesPath, at as QueryJobStatus, et as GetQueryResutsQuery, it as PostQueryPath, nt as PostCancelQueryJobPath, ot as QueryResult, q as QueryJobPollOptions, rt as PostQueryBody, st as Statements, tt as JobStatusResponse } from "../index-CAWy1qjR.js";
+import { $ as PostQueryBody, G as GetExportResultsQuery, J as GetQueryJobPath, K as GetQueriesHistoryQuery, Q as PostCancelQueryJobPath, U as QueryJobPollOptions, W as ExportResultsResponse, X as GetQueryResutsQuery, Y as GetQueryResultsPath, Z as JobStatusResponse, et as PostQueryPath, nt as QueryResult, q as GetQueriesPath, rt as Statements, tt as QueryJobStatus } from "../index-uGRdAORl.js";
 export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, type QueryJobPollOptions, QueryJobStatus, QueryResult, Statements };

package/dist/queue/index.d.cts

@@ -1,6 +1,6 @@
-import { Br as CreateJobBody, Hr as KillJobPath, Jr as SearchGroupedJobsQuery, Qr as components, Vr as GetQueueJobPath, Wr as OrchestrationRerunPlanPath, Xr as SearchJobsQuery, qr as SearchAllJobsQuery } from "../index-XaPb6unB.cjs";
-import { Kt as Poller } from "../index-CkwZ5x7E.cjs";
-import { n as ClientInitOptions } from "../types-OkQWmonU.cjs";
+import { Br as CreateJobBody, Hr as KillJobPath, Jr as SearchGroupedJobsQuery, Qr as components, Vr as GetQueueJobPath, Wr as OrchestrationRerunPlanPath, Xr as SearchJobsQuery, qr as SearchAllJobsQuery } from "../index-CL4iKFic.cjs";
+import { Xt as Poller } from "../index-Be2dNJ_N.cjs";
+import { n as ClientInitOptions } from "../types-O6XM48J8.cjs";
 //#region src/clients/queue/queueClient.d.ts
 declare const createQueueClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/queue/index.d.ts

@@ -1,6 +1,6 @@
-import { Br as CreateJobBody, Hr as KillJobPath, Jr as SearchGroupedJobsQuery, Qr as components, Vr as GetQueueJobPath, Wr as OrchestrationRerunPlanPath, Xr as SearchJobsQuery, qr as SearchAllJobsQuery } from "../index-r6YSe8B-.js";
-import { Kt as Poller } from "../index-CAWy1qjR.js";
-import { n as ClientInitOptions } from "../types-Cw9UISvM.js";
+import { Br as CreateJobBody, Hr as KillJobPath, Jr as SearchGroupedJobsQuery, Qr as components, Vr as GetQueueJobPath, Wr as OrchestrationRerunPlanPath, Xr as SearchJobsQuery, qr as SearchAllJobsQuery } from "../index-BPMr8PQJ.js";
+import { Xt as Poller } from "../index-uGRdAORl.js";
+import { n as ClientInitOptions } from "../types-CeqZuOEC.js";
 //#region src/clients/queue/queueClient.d.ts
 declare const createQueueClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/queue/types.d.cts

@@ -1,2 +1,2 @@
-import { Br as CreateJobBody, Gr as QueueJob, Hr as KillJobPath, Jr as SearchGroupedJobsQuery, Kr as QueueJobStatus, Ur as OrchestrationRerunPlan, Vr as GetQueueJobPath, Wr as OrchestrationRerunPlanPath, Xr as SearchJobsQuery, Yr as SearchGroupedJobsResponse, Zr as SearchJobsResponse, qr as SearchAllJobsQuery } from "../index-XaPb6unB.cjs";
+import { Br as CreateJobBody, Gr as QueueJob, Hr as KillJobPath, Jr as SearchGroupedJobsQuery, Kr as QueueJobStatus, Ur as OrchestrationRerunPlan, Vr as GetQueueJobPath, Wr as OrchestrationRerunPlanPath, Xr as SearchJobsQuery, Yr as SearchGroupedJobsResponse, Zr as SearchJobsResponse, qr as SearchAllJobsQuery } from "../index-CL4iKFic.cjs";
 export { CreateJobBody, GetQueueJobPath, KillJobPath, OrchestrationRerunPlan, OrchestrationRerunPlanPath, QueueJob, QueueJobStatus, SearchAllJobsQuery, SearchGroupedJobsQuery, SearchGroupedJobsResponse, SearchJobsQuery, SearchJobsResponse };

package/dist/queue/types.d.ts

@@ -1,2 +1,2 @@
-import { Br as CreateJobBody, Gr as QueueJob, Hr as KillJobPath, Jr as SearchGroupedJobsQuery, Kr as QueueJobStatus, Ur as OrchestrationRerunPlan, Vr as GetQueueJobPath, Wr as OrchestrationRerunPlanPath, Xr as SearchJobsQuery, Yr as SearchGroupedJobsResponse, Zr as SearchJobsResponse, qr as SearchAllJobsQuery } from "../index-r6YSe8B-.js";
+import { Br as CreateJobBody, Gr as QueueJob, Hr as KillJobPath, Jr as SearchGroupedJobsQuery, Kr as QueueJobStatus, Ur as OrchestrationRerunPlan, Vr as GetQueueJobPath, Wr as OrchestrationRerunPlanPath, Xr as SearchJobsQuery, Yr as SearchGroupedJobsResponse, Zr as SearchJobsResponse, qr as SearchAllJobsQuery } from "../index-BPMr8PQJ.js";
 export { CreateJobBody, GetQueueJobPath, KillJobPath, OrchestrationRerunPlan, OrchestrationRerunPlanPath, QueueJob, QueueJobStatus, SearchAllJobsQuery, SearchGroupedJobsQuery, SearchGroupedJobsResponse, SearchJobsQuery, SearchJobsResponse };

package/dist/scheduler/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-OkQWmonU.cjs";
-import { a as SchedulePath, n as ConfigurationPath, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-BG0oWq8u.cjs";
+import { n as ClientInitOptions } from "../types-O6XM48J8.cjs";
+import { a as SchedulePath, n as ConfigurationPath, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-C614wC5h.cjs";
 //#region src/clients/scheduler/schedulerClient.d.ts
 declare const createSchedulerClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/scheduler/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-Cw9UISvM.js";
-import { a as SchedulePath, n as ConfigurationPath, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-4HmtNuJf.js";
+import { n as ClientInitOptions } from "../types-CeqZuOEC.js";
+import { a as SchedulePath, n as ConfigurationPath, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-45O2dU2w.js";
 //#region src/clients/scheduler/schedulerClient.d.ts
 declare const createSchedulerClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/scheduler/types.d.cts

@@ -1,2 +1,2 @@
-import { a as SchedulePath, i as Schedule, n as ConfigurationPath, o as Schedules, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-BG0oWq8u.cjs";
+import { a as SchedulePath, i as Schedule, n as ConfigurationPath, o as Schedules, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-C614wC5h.cjs";
 export { ActivateScheduleBody, ConfigurationPath, GetSchedulesQuery, Schedule, SchedulePath, Schedules };

package/dist/scheduler/types.d.ts

@@ -1,2 +1,2 @@
-import { a as SchedulePath, i as Schedule, n as ConfigurationPath, o as Schedules, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-4HmtNuJf.js";
+import { a as SchedulePath, i as Schedule, n as ConfigurationPath, o as Schedules, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-45O2dU2w.js";
 export { ActivateScheduleBody, ConfigurationPath, GetSchedulesQuery, Schedule, SchedulePath, Schedules };

package/dist/sdk/configurations/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_configurations = require("../../configurations-D_Rbs0Wl.cjs");
+const require_configurations = require("../../configurations-Dkxsa3Uf.cjs");
 exports.createConfigurationSdk = require_configurations.createConfigurationSdk;

package/dist/sdk/configurations/index.d.cts

@@ -1,5 +1,5 @@
-import { Eo as BaseComponentConfig, Fo as ConfigurationPath, Lo as CreateConfigurationInput, Nt as createDefaultBranch, gt as registry, ht as RegisteredComponentId, ss as UpdateConfigurationInput, t as createEncryptionClient, y as createStorageClient } from "../../index-CkwZ5x7E.cjs";
-import { t as Project } from "../../project-dxCJbFay.cjs";
+import { It as createDefaultBranch, Mo as BaseComponentConfig, Uo as CreateConfigurationInput, Vo as ConfigurationPath, dt as RegisteredComponentId, ft as registry, ps as UpdateConfigurationInput, t as createEncryptionClient, y as createStorageClient } from "../../index-Be2dNJ_N.cjs";
+import { t as Project } from "../../project-vOnvjo80.cjs";
 import { z } from "zod";
 //#region src/sdks/configurations/configurationsSdk.d.ts
 type ConfigurationSdkContext = {

package/dist/sdk/configurations/index.d.ts

@@ -1,5 +1,5 @@
-import { Eo as BaseComponentConfig, Fo as ConfigurationPath, Lo as CreateConfigurationInput, Nt as createDefaultBranch, gt as registry, ht as RegisteredComponentId, ss as UpdateConfigurationInput, t as createEncryptionClient, y as createStorageClient } from "../../index-CAWy1qjR.js";
-import { t as Project } from "../../project-BMmfPhXg.js";
+import { It as createDefaultBranch, Mo as BaseComponentConfig, Uo as CreateConfigurationInput, Vo as ConfigurationPath, dt as RegisteredComponentId, ft as registry, ps as UpdateConfigurationInput, t as createEncryptionClient, y as createStorageClient } from "../../index-uGRdAORl.js";
+import { t as Project } from "../../project-DTfBtIJs.js";
 import { z } from "zod";
 //#region src/sdks/configurations/configurationsSdk.d.ts
 type ConfigurationSdkContext = {

package/dist/sdk/configurations/index.js

@@ -1,2 +1,2 @@
-import { t as createConfigurationSdk } from "../../configurations-DcpUlC8I.js";
+import { t as createConfigurationSdk } from "../../configurations-B44z6BSO.js";
 export { createConfigurationSdk };