@keboola/api-client 48.0.0 → 50.0.0

package/dist/oauth/types.d.cts

@@ -1,2 +1,2 @@
-import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-Cfc-fYbq.cjs";
+import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-YpOm4yXE.cjs";
 export { ComponentPath, CreateCredentialBody, CreateCredentialInput, Credential, CredentialInput, CredentialPath, type GetCredentialsInput, OrganizationConnection };

package/dist/oauth/types.d.ts

@@ -1,2 +1,2 @@
-import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-BYFU_6Iz.js";
+import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-D6lre27s.js";
 export { ComponentPath, CreateCredentialBody, CreateCredentialInput, Credential, CredentialInput, CredentialPath, type GetCredentialsInput, OrganizationConnection };

package/dist/{oauth-DKZPuUlt.cjs → oauth-B5Biqz21.cjs}

@@ -1,8 +1,8 @@
-const require_createFetchClient = require("./createFetchClient-lZ_93Yrb.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-MOx97wi-.cjs");
-const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-DHYo_k3t.cjs");
-const require_auth = require("./auth-C8Pjl0Mu.cjs");
-//#region src/clients/oauth/utils.ts
+const require_createFetchClient = require("./createFetchClient-DEkUH662.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-2oU-PXVo.cjs");
+const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-DL9w7vU-.cjs");
+const require_auth = require("./auth-CvB4MukT.cjs");
+// src/clients/oauth/utils.ts
 /**
 * The credentials payload rides one of two fields, and only one of them is in the current spec:
 *
@@ -18,8 +18,7 @@ const getScopedBranchId = (scope) => {
 		case "branched": return scope.branchId;
 	}
 };
-//#endregion
-//#region src/clients/oauth/oauthClient.ts
+// src/clients/oauth/oauthClient.ts
 const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({
 		baseUrl,
@@ -88,7 +87,6 @@ const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 		getOrganizationConnections
 	};
 };
-//#endregion
 Object.defineProperty(exports, "createOauthClient", {
 	enumerable: true,
 	get: function() {
@@ -96,4 +94,4 @@ Object.defineProperty(exports, "createOauthClient", {
 	}
 });
 
-//# sourceMappingURL=oauth-DKZPuUlt.cjs.map
+//# sourceMappingURL=oauth-B5Biqz21.cjs.map

package/dist/{oauth-DKZPuUlt.cjs.map → oauth-B5Biqz21.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"oauth-DKZPuUlt.cjs","names":["createOpenapiFetchClient","createAuthHeaders","createGenericFetchClient","isApiError","HttpStatus"],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  /**\n   * The GitHub connections of the project's organization; any project member's token may read them.\n   *\n   * - Empty when the organization has none.\n   * - A listed connection does not guarantee a repository: the App installation must cover it.\n   */\n  const getOrganizationConnections = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/organization-credentials/connections', {}, { signal });\n    return data.connections;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n    getOrganizationConnections,\n  };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAASA,iCAAAA,yBAAgC;EAC7C;EACA;EACA,SAASC,aAAAA,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAIC,0BAAAA,WAAW,KAAK,KAAK,MAAM,SAAS,WAAWC,0BAAAA,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;;;;;;;CAQA,MAAM,6BAA6B,OAAO,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,yCAAyC,CAAC,GAAG,EAAE,OAAO,CAAC;EACzF,OAAO,KAAK;CACd;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"oauth-B5Biqz21.cjs","names":["createOpenapiFetchClient","createAuthHeaders","createGenericFetchClient","isApiError","HttpStatus"],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  /**\n   * The GitHub connections of the project's organization; any project member's token may read them.\n   *\n   * - Empty when the organization has none.\n   * - A listed connection does not guarantee a repository: the App installation must cover it.\n   */\n  const getOrganizationConnections = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/organization-credentials/connections', {}, { signal });\n    return data.connections;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n    getOrganizationConnections,\n  };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAASA,iCAAAA,yBAAgC;EAC7C;EACA;EACA,SAASC,aAAAA,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAIC,0BAAAA,WAAW,KAAK,KAAK,MAAM,SAAS,WAAWC,0BAAAA,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;;;;;;;CAQA,MAAM,6BAA6B,OAAO,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,yCAAyC,CAAC,GAAG,EAAE,OAAO,CAAC;EACzF,OAAO,KAAK;CACd;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/{oauth-GXmZ9agP.js → oauth-ByCdISsV.js}

@@ -1,8 +1,8 @@
-import { g as HttpStatus, r as isApiError } from "./createFetchClient-CkHdS_IG.js";
-import { t as createGenericFetchClient } from "./createGenericFetchClient-CQdNcPC3.js";
-import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-DXiMv9WL.js";
-import { t as createAuthHeaders } from "./auth-4coY1uwo.js";
-//#region src/clients/oauth/utils.ts
+import { g as HttpStatus, r as isApiError } from "./createFetchClient-DlGCbltR.js";
+import { t as createGenericFetchClient } from "./createGenericFetchClient-wGxemBwR.js";
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-Bhz62MUE.js";
+import { t as createAuthHeaders } from "./auth-DYfQMQCs.js";
+// src/clients/oauth/utils.ts
 /**
 * The credentials payload rides one of two fields, and only one of them is in the current spec:
 *
@@ -18,8 +18,7 @@ const getScopedBranchId = (scope) => {
 		case "branched": return scope.branchId;
 	}
 };
-//#endregion
-//#region src/clients/oauth/oauthClient.ts
+// src/clients/oauth/oauthClient.ts
 const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 	const client = createOpenapiFetchClient({
 		baseUrl,
@@ -88,7 +87,6 @@ const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 		getOrganizationConnections
 	};
 };
-//#endregion
 export { createOauthClient as t };
 
-//# sourceMappingURL=oauth-GXmZ9agP.js.map
+//# sourceMappingURL=oauth-ByCdISsV.js.map

package/dist/{oauth-GXmZ9agP.js.map → oauth-ByCdISsV.js.map}

@@ -1 +1 @@
-{"version":3,"file":"oauth-GXmZ9agP.js","names":[],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  /**\n   * The GitHub connections of the project's organization; any project member's token may read them.\n   *\n   * - Empty when the organization has none.\n   * - A listed connection does not guarantee a repository: the App installation must cover it.\n   */\n  const getOrganizationConnections = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/organization-credentials/connections', {}, { signal });\n    return data.connections;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n    getOrganizationConnections,\n  };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,KAAK,MAAM,SAAS,WAAW,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;;;;;;;CAQA,MAAM,6BAA6B,OAAO,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,yCAAyC,CAAC,GAAG,EAAE,OAAO,CAAC;EACzF,OAAO,KAAK;CACd;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"oauth-ByCdISsV.js","names":[],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  /**\n   * The GitHub connections of the project's organization; any project member's token may read them.\n   *\n   * - Empty when the organization has none.\n   * - A listed connection does not guarantee a repository: the App installation must cover it.\n   */\n  const getOrganizationConnections = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/organization-credentials/connections', {}, { signal });\n    return data.connections;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n    getOrganizationConnections,\n  };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,KAAK,MAAM,SAAS,WAAW,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;;;;;;;CAQA,MAAM,6BAA6B,OAAO,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,yCAAyC,CAAC,GAAG,EAAE,OAAO,CAAC;EACzF,OAAO,KAAK;CACd;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/omnisearch/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-DHYo_k3t.cjs");
-const require_auth = require("../auth-C8Pjl0Mu.cjs");
-//#region src/clients/omnisearch/omnisearchClient.ts
+const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-DL9w7vU-.cjs");
+const require_auth = require("../auth-CvB4MukT.cjs");
+// src/clients/omnisearch/omnisearchClient.ts
 /**
 * Omnisearch — data lineage.
 *
@@ -35,7 +35,6 @@ const createOmnisearchClient = ({ baseUrl, middlewares, auth }) => {
 		getTablesLineage
 	};
 };
-//#endregion
 exports.createOmnisearchClient = createOmnisearchClient;
 
 //# sourceMappingURL=index.cjs.map

package/dist/omnisearch/index.d.cts

@@ -1,6 +1,5 @@
-import { n as ClientInitOptions } from "../types-sOM2_KPc.cjs";
-import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-DSBrhK_K.cjs";
-//#region src/clients/omnisearch/omnisearchClient.d.ts
+import { n as ClientInitOptions } from "../types-Dryq2GGE.cjs";
+import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-CcGp6O3B.cjs";
 /**
  * Omnisearch — data lineage.
  *
@@ -17,6 +16,5 @@ declare const createOmnisearchClient: ({ baseUrl, middlewares, auth }: ClientIni
   }>;
   getTablesLineage: (query: GetTablesLineageQuery, signal?: AbortSignal) => Promise<TablesLineageResponse>;
 };
-//#endregion
 export { createOmnisearchClient };
 //# sourceMappingURL=index.d.cts.map

package/dist/omnisearch/index.d.ts

@@ -1,6 +1,5 @@
-import { n as ClientInitOptions } from "../types-D3H3EAre.js";
-import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-Bt8CEZ6K.js";
-//#region src/clients/omnisearch/omnisearchClient.d.ts
+import { n as ClientInitOptions } from "../types-DUpVIuk7.js";
+import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-wYrC2boT.js";
 /**
  * Omnisearch — data lineage.
  *
@@ -17,6 +16,5 @@ declare const createOmnisearchClient: ({ baseUrl, middlewares, auth }: ClientIni
   }>;
   getTablesLineage: (query: GetTablesLineageQuery, signal?: AbortSignal) => Promise<TablesLineageResponse>;
 };
-//#endregion
 export { createOmnisearchClient };
 //# sourceMappingURL=index.d.ts.map

package/dist/omnisearch/index.js

@@ -1,6 +1,6 @@
-import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-DXiMv9WL.js";
-import { t as createAuthHeaders } from "../auth-4coY1uwo.js";
-//#region src/clients/omnisearch/omnisearchClient.ts
+import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-Bhz62MUE.js";
+import { t as createAuthHeaders } from "../auth-DYfQMQCs.js";
+// src/clients/omnisearch/omnisearchClient.ts
 /**
 * Omnisearch — data lineage.
 *
@@ -34,7 +34,6 @@ const createOmnisearchClient = ({ baseUrl, middlewares, auth }) => {
 		getTablesLineage
 	};
 };
-//#endregion
 export { createOmnisearchClient };
 
 //# sourceMappingURL=index.js.map

package/dist/omnisearch/types.d.cts

@@ -1,2 +1,2 @@
-import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-DSBrhK_K.cjs";
+import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-CcGp6O3B.cjs";
 export { GetProjectsLineageQuery, GetTablesLineageQuery, LineageBucket, LineageConfiguration, LineageMetadata, LineageProject, LineageSource, LineageTable, ProjectLineageRelation, ProjectsLineage, ProjectsLineageResponse, TableLineageRelation, TablesLineage, TablesLineageResponse };

package/dist/omnisearch/types.d.ts

@@ -1,2 +1,2 @@
-import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-Bt8CEZ6K.js";
+import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-wYrC2boT.js";
 export { GetProjectsLineageQuery, GetTablesLineageQuery, LineageBucket, LineageConfiguration, LineageMetadata, LineageProject, LineageSource, LineageTable, ProjectLineageRelation, ProjectsLineage, ProjectsLineageResponse, TableLineageRelation, TablesLineage, TablesLineageResponse };

package/dist/project-DmuC0bMK.js

@@ -0,0 +1,83 @@
+import { t as AdminRole } from "./adminRoles-asa-MhDD.js";
+import { h as PermissionDeniedError, l as isAdminOrShare } from "./admin-CbMOsfgs.js";
+// src/domain/permissions/organization.ts
+/**
+* Whether this token's admin is a member of the organization owning the project.
+*
+* - A limited token has no `admin` block despite the type saying required.
+* - Prefer `isOrganizationAdmin` for authorization decisions.
+*/
+const isOrganizationMember = (token) => token.isMasterToken && (token.admin?.isOrganizationMember ?? false);
+/**
+* `isOrganizationMember` AND `admin`/`share`.
+*
+* - An org member with a `readOnly` or `guest` role on this project still cannot write.
+*/
+const isOrganizationAdmin = (token) => isOrganizationMember(token) && isAdminOrShare(token);
+const assertCanAdministerOrganization = (token) => {
+	if (!isOrganizationAdmin(token)) throw new PermissionDeniedError({
+		action: "administer-organization",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings` : "a limited (non-master) token may not administer organization settings"
+	});
+};
+/**
+* Whether this token may write Kai's spend caps: project cap, default and per-user limits.
+*
+* - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.
+* - A project whose own admin could raise its cap has no cap.
+*/
+const canWriteKaiSpendCaps = (token) => isOrganizationAdmin(token);
+const assertCanWriteKaiSpendCaps = (token) => {
+	if (!canWriteKaiSpendCaps(token)) throw new PermissionDeniedError({
+		action: "write-kai-spend-caps",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps` : "a limited (non-master) token may not change Kai spend caps"
+	});
+};
+// src/domain/permissions/storage.ts
+/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */
+const canListSharingTargets = (token) => isOrganizationMember(token) || token.isMasterToken && token.admin?.role === AdminRole.Share;
+// src/domain/project.ts
+const hasFeature = (token, ...feature) => {
+	if (feature.length === 0) return false;
+	const projectFeatureSet = new Set(token.owner.features);
+	return feature.every((x) => projectFeatureSet.has(x));
+};
+/**
+* The admin's features as the Storage token carries them.
+*
+* - The same list `createAdminAccount` reads from the Manage token: Connection serialises both
+*   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.
+*/
+const hasAdminFeature = (token, ...feature) => {
+	if (feature.length === 0) return false;
+	const adminFeatureSet = new Set(token.admin?.features ?? []);
+	return feature.every((x) => adminFeatureSet.has(x));
+};
+const createProject = ({ sapiToken }) => {
+	const { owner, admin } = sapiToken;
+	const projectFeatureSet = new Set(owner.features);
+	const adminFeatureSet = new Set(admin?.features ?? []);
+	const hasFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => projectFeatureSet.has(x));
+	};
+	const hasAdminFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => adminFeatureSet.has(x));
+	};
+	const hasBackend = (backend) => {
+		if (backend === "bigquery") return owner.hasBigquery;
+		if (backend === "snowflake") return owner.hasSnowflake;
+		return false;
+	};
+	return {
+		hasFeature,
+		hasAdminFeature,
+		hasBackend,
+		canListSharingTargets: canListSharingTargets(sapiToken),
+		sapiToken
+	};
+};
+export { assertCanAdministerOrganization as a, isOrganizationAdmin as c, canListSharingTargets as i, isOrganizationMember as l, hasAdminFeature as n, assertCanWriteKaiSpendCaps as o, hasFeature as r, canWriteKaiSpendCaps as s, createProject as t };
+
+//# sourceMappingURL=project-DmuC0bMK.js.map

package/dist/project-DmuC0bMK.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-DmuC0bMK.js","names":[],"sources":["../src/domain/permissions/organization.ts","../src/domain/permissions/storage.ts","../src/domain/project.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates, read from `admin.isOrganizationMember`, not the project role.\n * - In Keboola, org membership is org administration of every project the org owns.\n * - `isOrganizationMember` is a raw signal; nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Whether this token's admin is a member of the organization owning the project.\n *\n * - A limited token has no `admin` block despite the type saying required.\n * - Prefer `isOrganizationAdmin` for authorization decisions.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * `isOrganizationMember` AND `admin`/`share`.\n *\n * - An org member with a `readOnly` or `guest` role on this project still cannot write.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's spend caps: project cap, default and per-user limits.\n *\n * - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.\n * - A project whose own admin could raise its cap has no cap.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n","/**\n * @module domain/permissions/storage\n *\n * Storage-scope predicates.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { isOrganizationMember } from './organization';\n\n/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */\nexport const canListSharingTargets = (token: StorageToken): boolean =>\n  isOrganizationMember(token) || (token.isMasterToken && token.admin?.role === AdminRole.Share);\n","import type { Backend, StorageToken } from '../clients/storage/tokens/types';\n\nimport { canListSharingTargets } from './permissions/storage';\n\ntype Options = {\n  sapiToken: StorageToken;\n};\n\nexport const hasFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const projectFeatureSet = new Set(token.owner.features);\n  return feature.every((x) => projectFeatureSet.has(x));\n};\n\n/**\n * The admin's features as the Storage token carries them.\n *\n * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both\n *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.\n */\nexport const hasAdminFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const adminFeatureSet = new Set(token.admin?.features ?? []);\n  return feature.every((x) => adminFeatureSet.has(x));\n};\n\nexport const createProject = ({ sapiToken }: Options) => {\n  const { owner, admin } = sapiToken;\n  const projectFeatureSet = new Set(owner.features);\n  // `verify` omits `admin` for a token created via `POST /v2/storage/tokens`, even though the type\n  // declares it: an admin-less token holds no admin features, rather than failing to build at all.\n  const adminFeatureSet = new Set(admin?.features ?? []);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => projectFeatureSet.has(x));\n  };\n\n  // Same list as `createAdminAccount`'s; prefer the account where one is at hand.\n  const hasAdminFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => adminFeatureSet.has(x));\n  };\n\n  const hasBackend = (backend: Backend): boolean => {\n    if (backend === 'bigquery') return owner.hasBigquery;\n    if (backend === 'snowflake') return owner.hasSnowflake;\n    return false;\n  };\n\n  return {\n    hasFeature,\n    hasAdminFeature,\n    hasBackend,\n    canListSharingTargets: canListSharingTargets(sapiToken),\n    sapiToken,\n  };\n};\n\nexport type Project = ReturnType<typeof createProject>;\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;AAO/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAK,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;AAQA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL;;;AC9CA,MAAa,yBAAyB,UACpC,qBAAqB,KAAK,KAAM,MAAM,iBAAiB,MAAM,OAAO,SAAS,UAAU;;ACJzF,MAAa,cAAc,OAAqB,GAAG,YAA+B;CAChF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,oBAAoB,IAAI,IAAI,MAAM,MAAM,QAAQ;CACtD,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;AACtD;;;;;;;AAQA,MAAa,mBAAmB,OAAqB,GAAG,YAA+B;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,kBAAkB,IAAI,IAAI,MAAM,OAAO,YAAY,CAAC,CAAC;CAC3D,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;AACpD;AAEA,MAAa,iBAAiB,EAAE,gBAAyB;CACvD,MAAM,EAAE,OAAO,UAAU;CACzB,MAAM,oBAAoB,IAAI,IAAI,MAAM,QAAQ;CAGhD,MAAM,kBAAkB,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;CAErD,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;CACtD;CAGA,MAAM,mBAAmB,GAAG,YAAsB;EAChD,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;CACpD;CAEA,MAAM,cAAc,YAA8B;EAChD,IAAI,YAAY,YAAY,OAAO,MAAM;EACzC,IAAI,YAAY,aAAa,OAAO,MAAM;EAC1C,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA,uBAAuB,sBAAsB,SAAS;EACtD;CACF;AACF"}

package/dist/project-Onf-IcPW.cjs

@@ -0,0 +1,136 @@
+const require_adminRoles = require("./adminRoles-DnFpO_2W.cjs");
+const require_admin = require("./admin-Di-MmGFP.cjs");
+// src/domain/permissions/organization.ts
+/**
+* Whether this token's admin is a member of the organization owning the project.
+*
+* - A limited token has no `admin` block despite the type saying required.
+* - Prefer `isOrganizationAdmin` for authorization decisions.
+*/
+const isOrganizationMember = (token) => token.isMasterToken && (token.admin?.isOrganizationMember ?? false);
+/**
+* `isOrganizationMember` AND `admin`/`share`.
+*
+* - An org member with a `readOnly` or `guest` role on this project still cannot write.
+*/
+const isOrganizationAdmin = (token) => isOrganizationMember(token) && require_admin.isAdminOrShare(token);
+const assertCanAdministerOrganization = (token) => {
+	if (!isOrganizationAdmin(token)) throw new require_admin.PermissionDeniedError({
+		action: "administer-organization",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings` : "a limited (non-master) token may not administer organization settings"
+	});
+};
+/**
+* Whether this token may write Kai's spend caps: project cap, default and per-user limits.
+*
+* - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.
+* - A project whose own admin could raise its cap has no cap.
+*/
+const canWriteKaiSpendCaps = (token) => isOrganizationAdmin(token);
+const assertCanWriteKaiSpendCaps = (token) => {
+	if (!canWriteKaiSpendCaps(token)) throw new require_admin.PermissionDeniedError({
+		action: "write-kai-spend-caps",
+		reason: token.isMasterToken ? `role '${token.admin?.role ?? "none"}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps` : "a limited (non-master) token may not change Kai spend caps"
+	});
+};
+// src/domain/permissions/storage.ts
+/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */
+const canListSharingTargets = (token) => isOrganizationMember(token) || token.isMasterToken && token.admin?.role === require_adminRoles.AdminRole.Share;
+// src/domain/project.ts
+const hasFeature = (token, ...feature) => {
+	if (feature.length === 0) return false;
+	const projectFeatureSet = new Set(token.owner.features);
+	return feature.every((x) => projectFeatureSet.has(x));
+};
+/**
+* The admin's features as the Storage token carries them.
+*
+* - The same list `createAdminAccount` reads from the Manage token: Connection serialises both
+*   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.
+*/
+const hasAdminFeature = (token, ...feature) => {
+	if (feature.length === 0) return false;
+	const adminFeatureSet = new Set(token.admin?.features ?? []);
+	return feature.every((x) => adminFeatureSet.has(x));
+};
+const createProject = ({ sapiToken }) => {
+	const { owner, admin } = sapiToken;
+	const projectFeatureSet = new Set(owner.features);
+	const adminFeatureSet = new Set(admin?.features ?? []);
+	const hasFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => projectFeatureSet.has(x));
+	};
+	const hasAdminFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => adminFeatureSet.has(x));
+	};
+	const hasBackend = (backend) => {
+		if (backend === "bigquery") return owner.hasBigquery;
+		if (backend === "snowflake") return owner.hasSnowflake;
+		return false;
+	};
+	return {
+		hasFeature,
+		hasAdminFeature,
+		hasBackend,
+		canListSharingTargets: canListSharingTargets(sapiToken),
+		sapiToken
+	};
+};
+Object.defineProperty(exports, "assertCanAdministerOrganization", {
+	enumerable: true,
+	get: function() {
+		return assertCanAdministerOrganization;
+	}
+});
+Object.defineProperty(exports, "assertCanWriteKaiSpendCaps", {
+	enumerable: true,
+	get: function() {
+		return assertCanWriteKaiSpendCaps;
+	}
+});
+Object.defineProperty(exports, "canListSharingTargets", {
+	enumerable: true,
+	get: function() {
+		return canListSharingTargets;
+	}
+});
+Object.defineProperty(exports, "canWriteKaiSpendCaps", {
+	enumerable: true,
+	get: function() {
+		return canWriteKaiSpendCaps;
+	}
+});
+Object.defineProperty(exports, "createProject", {
+	enumerable: true,
+	get: function() {
+		return createProject;
+	}
+});
+Object.defineProperty(exports, "hasAdminFeature", {
+	enumerable: true,
+	get: function() {
+		return hasAdminFeature;
+	}
+});
+Object.defineProperty(exports, "hasFeature", {
+	enumerable: true,
+	get: function() {
+		return hasFeature;
+	}
+});
+Object.defineProperty(exports, "isOrganizationAdmin", {
+	enumerable: true,
+	get: function() {
+		return isOrganizationAdmin;
+	}
+});
+Object.defineProperty(exports, "isOrganizationMember", {
+	enumerable: true,
+	get: function() {
+		return isOrganizationMember;
+	}
+});
+
+//# sourceMappingURL=project-Onf-IcPW.cjs.map

package/dist/project-Onf-IcPW.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-Onf-IcPW.cjs","names":["isAdminOrShare","PermissionDeniedError","AdminRole"],"sources":["../src/domain/permissions/organization.ts","../src/domain/permissions/storage.ts","../src/domain/project.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates, read from `admin.isOrganizationMember`, not the project role.\n * - In Keboola, org membership is org administration of every project the org owns.\n * - `isOrganizationMember` is a raw signal; nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Whether this token's admin is a member of the organization owning the project.\n *\n * - A limited token has no `admin` block despite the type saying required.\n * - Prefer `isOrganizationAdmin` for authorization decisions.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * `isOrganizationMember` AND `admin`/`share`.\n *\n * - An org member with a `readOnly` or `guest` role on this project still cannot write.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's spend caps: project cap, default and per-user limits.\n *\n * - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.\n * - A project whose own admin could raise its cap has no cap.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n","/**\n * @module domain/permissions/storage\n *\n * Storage-scope predicates.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { isOrganizationMember } from './organization';\n\n/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */\nexport const canListSharingTargets = (token: StorageToken): boolean =>\n  isOrganizationMember(token) || (token.isMasterToken && token.admin?.role === AdminRole.Share);\n","import type { Backend, StorageToken } from '../clients/storage/tokens/types';\n\nimport { canListSharingTargets } from './permissions/storage';\n\ntype Options = {\n  sapiToken: StorageToken;\n};\n\nexport const hasFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const projectFeatureSet = new Set(token.owner.features);\n  return feature.every((x) => projectFeatureSet.has(x));\n};\n\n/**\n * The admin's features as the Storage token carries them.\n *\n * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both\n *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.\n */\nexport const hasAdminFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const adminFeatureSet = new Set(token.admin?.features ?? []);\n  return feature.every((x) => adminFeatureSet.has(x));\n};\n\nexport const createProject = ({ sapiToken }: Options) => {\n  const { owner, admin } = sapiToken;\n  const projectFeatureSet = new Set(owner.features);\n  // `verify` omits `admin` for a token created via `POST /v2/storage/tokens`, even though the type\n  // declares it: an admin-less token holds no admin features, rather than failing to build at all.\n  const adminFeatureSet = new Set(admin?.features ?? []);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => projectFeatureSet.has(x));\n  };\n\n  // Same list as `createAdminAccount`'s; prefer the account where one is at hand.\n  const hasAdminFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => adminFeatureSet.has(x));\n  };\n\n  const hasBackend = (backend: Backend): boolean => {\n    if (backend === 'bigquery') return owner.hasBigquery;\n    if (backend === 'snowflake') return owner.hasSnowflake;\n    return false;\n  };\n\n  return {\n    hasFeature,\n    hasAdminFeature,\n    hasBackend,\n    canListSharingTargets: canListSharingTargets(sapiToken),\n    sapiToken,\n  };\n};\n\nexport type Project = ReturnType<typeof createProject>;\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;AAO/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAKA,cAAAA,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAIC,cAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;AAQA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAIA,cAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL;;;AC9CA,MAAa,yBAAyB,UACpC,qBAAqB,KAAK,KAAM,MAAM,iBAAiB,MAAM,OAAO,SAASC,mBAAAA,UAAU;;ACJzF,MAAa,cAAc,OAAqB,GAAG,YAA+B;CAChF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,oBAAoB,IAAI,IAAI,MAAM,MAAM,QAAQ;CACtD,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;AACtD;;;;;;;AAQA,MAAa,mBAAmB,OAAqB,GAAG,YAA+B;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,kBAAkB,IAAI,IAAI,MAAM,OAAO,YAAY,CAAC,CAAC;CAC3D,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;AACpD;AAEA,MAAa,iBAAiB,EAAE,gBAAyB;CACvD,MAAM,EAAE,OAAO,UAAU;CACzB,MAAM,oBAAoB,IAAI,IAAI,MAAM,QAAQ;CAGhD,MAAM,kBAAkB,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;CAErD,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;CACtD;CAGA,MAAM,mBAAmB,GAAG,YAAsB;EAChD,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;CACpD;CAEA,MAAM,cAAc,YAA8B;EAChD,IAAI,YAAY,YAAY,OAAO,MAAM;EACzC,IAAI,YAAY,aAAa,OAAO,MAAM;EAC1C,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA,uBAAuB,sBAAsB,SAAS;EACtD;CACF;AACF"}

package/dist/{project-nbv9yjpl.d.ts → project-UHZGFmmG.d.cts}

@@ -1,7 +1,6 @@
-import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-sDHBkJhU.js";
-import "./adminRoles-DsoGQipO.js";
-import { t as Backend } from "./backends-DKBz5OxE.js";
-//#region src/clients/storage/tokens/types.d.ts
+import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-D1mduJne.cjs";
+import "./adminRoles-FFyl7Dyx.cjs";
+import { t as Backend } from "./backends-BHotIdL0.cjs";
 type ProjectId = number;
 type CreateTokenSchemaBody = OpenapiBodyType<paths['/v2/storage/tokens']['post']>;
 type UpdateTokenSchemaBody = OpenapiBodyType<paths['/v2/storage/tokens/{id}']['put']>;
@@ -49,8 +48,6 @@ type UpdateTokenInput = UpdateTokenPath & UpdateTokenBody;
 type ShareTokenBody = OpenapiBodyType<paths['/v2/storage/tokens/{id}/share']['post']>;
 type ShareTokenPath = OpenapiPathType<paths['/v2/storage/tokens/{id}/share']['post']>;
 type ShareTokenInput = ShareTokenPath & ShareTokenBody;
-//#endregion
-//#region src/domain/project.d.ts
 type Options = {
   sapiToken: StorageToken;
 };
@@ -66,9 +63,9 @@ declare const createProject: ({ sapiToken }: Options) => {
   hasFeature: (...feature: string[]) => boolean;
   hasAdminFeature: (...feature: string[]) => boolean;
   hasBackend: (backend: Backend) => boolean;
+  canListSharingTargets: boolean;
   sapiToken: StorageToken;
 };
 type Project = ReturnType<typeof createProject>;
-//#endregion
-export { UpdateTokenInput as _, CreateTokenResponse as a, GetTokenEventsPath as c, ShareTokenInput as d, ShareTokenPath as f, UpdateTokenBody as g, TokenListItem as h, CreateTokenBody as i, ProjectId as l, StorageTokenRaw as m, hasAdminFeature as n, CreateTokenSchemaBody as o, StorageToken as p, hasFeature as r, GetTokenEventsInput as s, Project as t, ShareTokenBody as u, UpdateTokenPath as v, UpdateTokenSchemaBody as y };
-//# sourceMappingURL=project-nbv9yjpl.d.ts.map
+export { UpdateTokenBody as _, CreateTokenBody as a, UpdateTokenSchemaBody as b, GetTokenEventsInput as c, ShareTokenBody as d, ShareTokenInput as f, TokenListItem as g, StorageTokenRaw as h, hasFeature as i, GetTokenEventsPath as l, StorageToken as m, createProject as n, CreateTokenResponse as o, ShareTokenPath as p, hasAdminFeature as r, CreateTokenSchemaBody as s, Project as t, ProjectId as u, UpdateTokenInput as v, UpdateTokenPath as y };
+//# sourceMappingURL=project-UHZGFmmG.d.cts.map

package/dist/{project-Dzu85cqr.d.cts → project-iBm4cIIR.d.ts}

@@ -1,7 +1,6 @@
-import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-ChDl6ig5.cjs";
-import "./adminRoles-BgpaBE7h.cjs";
-import { t as Backend } from "./backends-DKBz5OxE.cjs";
-//#region src/clients/storage/tokens/types.d.ts
+import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-D1mduJne.js";
+import "./adminRoles-DAwl657q.js";
+import { t as Backend } from "./backends-BHotIdL0.js";
 type ProjectId = number;
 type CreateTokenSchemaBody = OpenapiBodyType<paths['/v2/storage/tokens']['post']>;
 type UpdateTokenSchemaBody = OpenapiBodyType<paths['/v2/storage/tokens/{id}']['put']>;
@@ -49,8 +48,6 @@ type UpdateTokenInput = UpdateTokenPath & UpdateTokenBody;
 type ShareTokenBody = OpenapiBodyType<paths['/v2/storage/tokens/{id}/share']['post']>;
 type ShareTokenPath = OpenapiPathType<paths['/v2/storage/tokens/{id}/share']['post']>;
 type ShareTokenInput = ShareTokenPath & ShareTokenBody;
-//#endregion
-//#region src/domain/project.d.ts
 type Options = {
   sapiToken: StorageToken;
 };
@@ -66,9 +63,9 @@ declare const createProject: ({ sapiToken }: Options) => {
   hasFeature: (...feature: string[]) => boolean;
   hasAdminFeature: (...feature: string[]) => boolean;
   hasBackend: (backend: Backend) => boolean;
+  canListSharingTargets: boolean;
   sapiToken: StorageToken;
 };
 type Project = ReturnType<typeof createProject>;
-//#endregion
-export { UpdateTokenInput as _, CreateTokenResponse as a, GetTokenEventsPath as c, ShareTokenInput as d, ShareTokenPath as f, UpdateTokenBody as g, TokenListItem as h, CreateTokenBody as i, ProjectId as l, StorageTokenRaw as m, hasAdminFeature as n, CreateTokenSchemaBody as o, StorageToken as p, hasFeature as r, GetTokenEventsInput as s, Project as t, ShareTokenBody as u, UpdateTokenPath as v, UpdateTokenSchemaBody as y };
-//# sourceMappingURL=project-Dzu85cqr.d.cts.map
+export { UpdateTokenBody as _, CreateTokenBody as a, UpdateTokenSchemaBody as b, GetTokenEventsInput as c, ShareTokenBody as d, ShareTokenInput as f, TokenListItem as g, StorageTokenRaw as h, hasFeature as i, GetTokenEventsPath as l, StorageToken as m, createProject as n, CreateTokenResponse as o, ShareTokenPath as p, hasAdminFeature as r, CreateTokenSchemaBody as s, Project as t, ProjectId as u, UpdateTokenInput as v, UpdateTokenPath as y };
+//# sourceMappingURL=project-iBm4cIIR.d.ts.map

package/dist/queryService/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_queryService = require("../queryService-CzK53q94.cjs");
+const require_queryService = require("../queryService-Cg-eMysa.cjs");
 exports.createQueryServiceClient = require_queryService.createQueryServiceClient;

package/dist/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { S as createQueryServiceClient } from "../index-C40Fbj-6.cjs";
+import { S as createQueryServiceClient } from "../index-CTMnmISl.cjs";
 export { createQueryServiceClient };

package/dist/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { S as createQueryServiceClient } from "../index-B3QTeqfL.js";
+import { S as createQueryServiceClient } from "../index-C9iNazAc.js";
 export { createQueryServiceClient };

package/dist/queryService/index.js

@@ -1,2 +1 @@
-import { t as createQueryServiceClient } from "../queryService-C-pZha5p.js";
-export { createQueryServiceClient };
+export { t as createQueryServiceClient } from "../queryService-x8kq8Z2-.js";

package/dist/queryService/types.d.cts

@@ -1,2 +1,2 @@
-import { $ as PostQueryBody, G as GetExportResultsQuery, J as GetQueryJobPath, K as GetQueriesHistoryQuery, Q as PostCancelQueryJobPath, U as QueryJobPollOptions, W as ExportResultsResponse, X as GetQueryResutsQuery, Y as GetQueryResultsPath, Z as JobStatusResponse, et as PostQueryPath, nt as QueryResult, q as GetQueriesPath, rt as Statements, tt as QueryJobStatus } from "../index-C40Fbj-6.cjs";
+import { $ as GetQueryResutsQuery, J as GetExportResultsQuery, K as QueryJobPollOptions, Q as GetQueryResultsPath, X as GetQueriesPath, Y as GetQueriesHistoryQuery, Z as GetQueryJobPath, at as QueryResult, et as JobStatusResponse, it as QueryJobStatus, nt as PostQueryBody, ot as Statements, q as ExportResultsResponse, rt as PostQueryPath, tt as PostCancelQueryJobPath } from "../index-CTMnmISl.cjs";
 export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, type QueryJobPollOptions, QueryJobStatus, QueryResult, Statements };

package/dist/queryService/types.d.ts

@@ -1,2 +1,2 @@
-import { $ as PostQueryBody, G as GetExportResultsQuery, J as GetQueryJobPath, K as GetQueriesHistoryQuery, Q as PostCancelQueryJobPath, U as QueryJobPollOptions, W as ExportResultsResponse, X as GetQueryResutsQuery, Y as GetQueryResultsPath, Z as JobStatusResponse, et as PostQueryPath, nt as QueryResult, q as GetQueriesPath, rt as Statements, tt as QueryJobStatus } from "../index-B3QTeqfL.js";
+import { $ as GetQueryResutsQuery, J as GetExportResultsQuery, K as QueryJobPollOptions, Q as GetQueryResultsPath, X as GetQueriesPath, Y as GetQueriesHistoryQuery, Z as GetQueryJobPath, at as QueryResult, et as JobStatusResponse, it as QueryJobStatus, nt as PostQueryBody, ot as Statements, q as ExportResultsResponse, rt as PostQueryPath, tt as PostCancelQueryJobPath } from "../index-C9iNazAc.js";
 export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, type QueryJobPollOptions, QueryJobStatus, QueryResult, Statements };