@keboola/api-client 49.0.0 → 51.0.0

package/dist/sdk/configurations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["snowflakeCommon"],"sources":["../../../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../../../src/sdks/configurations/schemas/common/dbConfig.ts","../../../src/sdks/configurations/schemas/common/dbConnection.ts","../../../src/sdks/configurations/schemas/common/forbidden.ts","../../../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../../../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../../../src/sdks/configurations/schemas/common/sslSchema.ts","../../../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../../../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../../../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../../../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../../../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../../../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../../../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../../../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../../../src/sdks/configurations/schemas/googleAdsSchema.ts","../../../src/sdks/configurations/schemas/schedulerSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../../../src/sdks/configurations/createRegistry/createRegistry.ts","../../../src/sdks/configurations/registry.ts","../../../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials with an optional SSH tunnel, for the generic SSH-only drivers.\n *\n * - Keep in sync with kbc-ui's `hasSshTunnel` / `hasSsl` (`ex-db-generic/helpers.ts`).\n * - SSL-capable, tunnel-less and extra-field drivers get their own schema.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    continueOnFailure: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { createDefaultBranch } from '../../domain/defaultBranch';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  defaultBranch: ReturnType<typeof createDefaultBranch>;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are\n *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.\n * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,\n *   e.g. `storage`, is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.defaultBranch.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;AAOA,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO,EACnB,IAAI,EAAE,OAAO,EACX,aAAa,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;ACVD,MAAa,YAAkC,OAC7C,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;ACI3C,MAAa,qBAAqB,EAAE,OAAO;CACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;ACLD,MAAa,YAAY,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;ACFhD,MAAa,2BAA2B,EAAE,OAAO,EAC/C,WAAW,EAAE,OAAO;CAClB,IAAI,EAAE,OAAO;CACb,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;ACVD,MAAa,kBAAkB,EAAE,OAAO;CACtC,SAAS,EAAE,QAAQ;CACnB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAM,EACH,OAAO;EACN,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;ACZD,MAAa,YAAY,EAAE,OAAO;CAChC,SAAS,EAAE,QAAQ;CACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;ACAD,MAAM,gBAAgB,EAAE,OAAO;CAC7B,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,iBAAiB,EAAE,OAAO;CAC1B,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+B,EAAE,OAAO,EACnD,YAAY,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoB,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuB,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;ACfD,MAAM,qBAAqB,EACxB,OAAO;CACN,WAAW,EAAE,QAAQ,aAAa;CAClC,aAAa,EAAE,OAAO;CACtB,oBAAoB,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAc,EACjB,OAAO;CACN,WAAW,EAAE,QAAQ,MAAM;CAC3B,WAAW,EAAE,OAAO;CACpB,UAAU,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgB,EAC1B,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;AChCT,MAAa,oBAAoB,EAC9B,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;ACVT,MAAa,wBAAwB,EAClC,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;ACZT,MAAM,gBAAgB,EAAE,OAAO;CAC7B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,gBAAgB,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAU,EAAE,OAAO;CACnB,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAc,EACxB,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;AC/BT,MAAa,eAAe,EACzB,OAAO,EACN,YAAY,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;ACJT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;ACPA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2B,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACTA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,MAAM,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO;AAAE,CAAC,CAC5E;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAY,EAAE,OAAO;CACrB,UAAU,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;ACDA,MAAMA,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACNA,kBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5EA,kBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;ACdA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CACP,WAAW,EAAE,OAAO;CACpB,QAAQ,EAAE,OAAO;CACjB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;ACfA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,MAAM,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAU,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqB,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgB,EAAE,OAAO;CAC7B,OAAO,EAAE,OAAO;CAChB,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoB,EAAE,OAAO;CACjC,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO;CACnB,SAAS,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAM,EAAE,OAAO;EAAE,OAAO,EAAE,OAAO;EAAG,aAAa,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;ACjED,MAAa,oBAAoB,EAAE,OAAO;CACxC,eAAe;CACf,YAAY,EAAE,OAAO;EACnB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;EAC9B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,mBAAmB,EAAE,QAAQ,CAAC,CAAC,SAAS;EACxC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;ACLD,MAAa,kBAAkB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO;EACjB,SAAS,EAAE,OAAO;EAGlB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAO,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQ,EAAE,OAAO;EACf,aAAa,EAAE,OAAO;EACtB,iBAAiB,EAAE,OAAO;EAC1B,MAAM,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAY,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAW,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;ACGA,MAAM,aAAa,EAAE,OAAO;CAC1B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5B,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkB,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;ACjBA,MAAa,mBAAmB,SAC9B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;CACnB,gBAAgB,EAAE,OAAO;CACzB,uBAAuB,EAAE,OAAO;CAChC,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgB,EAAE,OAAO;CACzB,kBAAkB,EAAE,OAAO;CAC3B,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAAS,EAAE,OAAO;CAClB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CACH;;;ACNA,MAAa,kBAAkB,SAC7B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkB,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkB,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAO,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiB,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAI,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAI,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAI,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAI,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAI,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAI,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAI,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAI,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAI,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAI,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAI,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAI,YAAY,SAAS,YAAY,CAAC,CACtC,IAAI,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAI,YAAY,aAAa,WAAW,CAAC,CACzC,IAAI,YAAY,WAAW,aAAa,CAAC,CACzC,IAAI,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAI,YAAY,6BAA6B,qBAAqB;;ACrErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,cAAc,MAAM,QAAQ,EACvD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}

package/dist/sdk/developerPortal/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dedupe = require("../../dedupe-OSnnst2u.cjs");
-const require_store = require("../../store-xS-Cu_VS.cjs");
-const require_createFetchClient = require("../../createFetchClient-lZ_93Yrb.cjs");
-const require_middleware = require("../../middleware-CEP6uu_D.cjs");
-const require_developerPortalClient = require("../../developerPortalClient-DUerKw-7.cjs");
-//#region src/sdks/developerPortal/tokenExpiry.ts
+const require_createFetchClient = require("../../createFetchClient-DEkUH662.cjs");
+const require_dedupe = require("../../dedupe-Bf0gl9TJ.cjs");
+const require_store = require("../../store-2OyH1XOP.cjs");
+const require_middleware = require("../../middleware-B9RNuLfD.cjs");
+const require_developerPortalClient = require("../../developerPortalClient-BfRxYrWj.cjs");
+// src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
 * caller leaves to the 401 path). A read, not a verification.
@@ -29,8 +29,7 @@ const readTokenExpiry = (token) => {
 		return null;
 	}
 };
-//#endregion
-//#region src/sdks/developerPortal/credential.ts
+// src/sdks/developerPortal/credential.ts
 const DEFAULT_REFRESH_LEAD_TIME_MS = 3e5;
 /** Mirrors `createBearerCredential`, over the id token of the trio. */
 const createDeveloperPortalCredential = ({ refresh, getTokens, onSessionExpired, refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS }) => {
@@ -58,8 +57,7 @@ const createDeveloperPortalCredential = ({ refresh, getTokens, onSessionExpired,
 		notifyExpired: () => onSessionExpired?.()
 	};
 };
-//#endregion
-//#region src/sdks/developerPortal/middleware.ts
+// src/sdks/developerPortal/middleware.ts
 /**
 * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors
 * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.
@@ -91,8 +89,7 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 		}
 	};
 };
-//#endregion
-//#region src/sdks/developerPortal/developerPortalSdk.ts
+// src/sdks/developerPortal/developerPortalSdk.ts
 /**
 * `createDeveloperPortalClient` plus the session that keeps it authenticated.
 *
@@ -189,7 +186,6 @@ const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTok
 		}
 	};
 };
-//#endregion
 exports.createDeveloperPortalSdk = createDeveloperPortalSdk;
 
 //# sourceMappingURL=index.cjs.map

package/dist/sdk/developerPortal/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}
+{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}

package/dist/sdk/developerPortal/index.d.cts

@@ -1,8 +1,7 @@
-import { li as MiddlewareFn } from "../../index-CL4iKFic.cjs";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-BAsYMltG.cjs";
-import { t as DeveloperPortalTokens } from "../../index-DYNVbgm8.cjs";
-import { n as Listener } from "../../emitter-dLF1Fyfg.cjs";
-//#region src/sdks/developerPortal/developerPortalSdk.d.ts
+import { li as MiddlewareFn } from "../../index-D1mduJne.cjs";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-DHMxPJZq.cjs";
+import { t as DeveloperPortalTokens } from "../../index-CbSh3KFw.cjs";
+import { n as Listener } from "../../emitter-raKkIqRp.cjs";
 type DeveloperPortalSdkOptions = {
   baseUrl: string;
   /** Session to restore on construction. */
@@ -1390,6 +1389,5 @@ declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTok
 };
 type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;
 type DeveloperPortalSession = DeveloperPortalSdk['session'];
-//#endregion
 export { DeveloperPortalSdk, DeveloperPortalSdkOptions, DeveloperPortalSession, createDeveloperPortalSdk };
 //# sourceMappingURL=index.d.cts.map

package/dist/sdk/developerPortal/index.d.ts

@@ -1,8 +1,7 @@
-import { li as MiddlewareFn } from "../../index-BPMr8PQJ.js";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-0R9-osUJ.js";
-import { t as DeveloperPortalTokens } from "../../index-BiZR9BjN.js";
-import { n as Listener } from "../../emitter-dLF1Fyfg.js";
-//#region src/sdks/developerPortal/developerPortalSdk.d.ts
+import { li as MiddlewareFn } from "../../index-D1mduJne.js";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-jjOulnni.js";
+import { t as DeveloperPortalTokens } from "../../index-m9-mN8Gg.js";
+import { n as Listener } from "../../emitter-raKkIqRp.js";
 type DeveloperPortalSdkOptions = {
   baseUrl: string;
   /** Session to restore on construction. */
@@ -1390,6 +1389,5 @@ declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTok
 };
 type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;
 type DeveloperPortalSession = DeveloperPortalSdk['session'];
-//#endregion
 export { DeveloperPortalSdk, DeveloperPortalSdkOptions, DeveloperPortalSession, createDeveloperPortalSdk };
 //# sourceMappingURL=index.d.ts.map

package/dist/sdk/developerPortal/index.js

@@ -1,9 +1,9 @@
-import { t as dedupe } from "../../dedupe-Cky1gSUu.js";
-import { t as createStore } from "../../store-C9FQCHGe.js";
-import { s as HttpHeader } from "../../createFetchClient-CkHdS_IG.js";
-import { n as isUnauthorized } from "../../middleware-GOfx8Apu.js";
-import { t as createDeveloperPortalClient } from "../../developerPortalClient-Bb2suezr.js";
-//#region src/sdks/developerPortal/tokenExpiry.ts
+import { s as HttpHeader } from "../../createFetchClient-DlGCbltR.js";
+import { t as dedupe } from "../../dedupe-Bu0d2i_w.js";
+import { t as createStore } from "../../store-HP0zRcLz.js";
+import { n as isUnauthorized } from "../../middleware-8zaJWcyU.js";
+import { t as createDeveloperPortalClient } from "../../developerPortalClient-D9XOYwWF.js";
+// src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
 * caller leaves to the 401 path). A read, not a verification.
@@ -28,8 +28,7 @@ const readTokenExpiry = (token) => {
 		return null;
 	}
 };
-//#endregion
-//#region src/sdks/developerPortal/credential.ts
+// src/sdks/developerPortal/credential.ts
 const DEFAULT_REFRESH_LEAD_TIME_MS = 3e5;
 /** Mirrors `createBearerCredential`, over the id token of the trio. */
 const createDeveloperPortalCredential = ({ refresh, getTokens, onSessionExpired, refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS }) => {
@@ -57,8 +56,7 @@ const createDeveloperPortalCredential = ({ refresh, getTokens, onSessionExpired,
 		notifyExpired: () => onSessionExpired?.()
 	};
 };
-//#endregion
-//#region src/sdks/developerPortal/middleware.ts
+// src/sdks/developerPortal/middleware.ts
 /**
 * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors
 * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.
@@ -90,8 +88,7 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 		}
 	};
 };
-//#endregion
-//#region src/sdks/developerPortal/developerPortalSdk.ts
+// src/sdks/developerPortal/developerPortalSdk.ts
 /**
 * `createDeveloperPortalClient` plus the session that keeps it authenticated.
 *
@@ -188,7 +185,6 @@ const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTok
 		}
 	};
 };
-//#endregion
 export { createDeveloperPortalSdk };
 
 //# sourceMappingURL=index.js.map

package/dist/sdk/developerPortal/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAI,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgB,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAI,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQ,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgB,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAAS,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAI,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgB,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAI,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQ,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgB,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAAS,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}

package/dist/sdk/kaiMemory/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kaiMemory = require("../../kaiMemory-Qch09f-m.cjs");
+const require_kaiMemory = require("../../kaiMemory-CkLQfJXD.cjs");
 exports.KAI_MEMORY_OBJECT_TYPE = require_kaiMemory.KAI_MEMORY_OBJECT_TYPE;
 exports.KAI_MEMORY_STATUSES = require_kaiMemory.KAI_MEMORY_STATUSES;
 exports.KaiMemoryReviewConflictError = require_kaiMemory.KaiMemoryReviewConflictError;

package/dist/sdk/kaiMemory/index.d.cts

@@ -1,5 +1,4 @@
-import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-CY8X39qv.cjs";
-//#region src/sdks/kaiMemory/kaiMemorySdk.d.ts
+import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-CxEJ77m3.cjs";
 /** The metastore object type this SDK addresses — see `SEMANTIC_OBJECT_TYPE` for the convention. */
 declare const KAI_MEMORY_OBJECT_TYPE = "kai-memory";
 /**
@@ -36,6 +35,5 @@ declare const createKaiMemorySdk: ({ metastoreClient }: Options) => {
   }, meta?: CreateKaiMemoryMeta) => Promise<KaiMemoryItem>;
   updateStatus: (uuid: string, status: KaiMemoryStatus, meta?: UpdateKaiMemoryMeta) => Promise<KaiMemoryItem>;
 };
-//#endregion
 export { KAI_MEMORY_OBJECT_TYPE, KAI_MEMORY_STATUSES, KaiMemoryReviewConflictError, KaiMemoryUnreadableItemsError, createKaiMemorySdk };
 //# sourceMappingURL=index.d.cts.map

package/dist/sdk/kaiMemory/index.d.ts

@@ -1,5 +1,4 @@
-import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-BWzt1ju_.js";
-//#region src/sdks/kaiMemory/kaiMemorySdk.d.ts
+import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-xzt_2H63.js";
 /** The metastore object type this SDK addresses — see `SEMANTIC_OBJECT_TYPE` for the convention. */
 declare const KAI_MEMORY_OBJECT_TYPE = "kai-memory";
 /**
@@ -36,6 +35,5 @@ declare const createKaiMemorySdk: ({ metastoreClient }: Options) => {
   }, meta?: CreateKaiMemoryMeta) => Promise<KaiMemoryItem>;
   updateStatus: (uuid: string, status: KaiMemoryStatus, meta?: UpdateKaiMemoryMeta) => Promise<KaiMemoryItem>;
 };
-//#endregion
 export { KAI_MEMORY_OBJECT_TYPE, KAI_MEMORY_STATUSES, KaiMemoryReviewConflictError, KaiMemoryUnreadableItemsError, createKaiMemorySdk };
 //# sourceMappingURL=index.d.ts.map

package/dist/sdk/kaiMemory/index.js

@@ -1,2 +1 @@
-import { a as KAI_MEMORY_STATUSES, i as createKaiMemorySdk, n as KaiMemoryReviewConflictError, r as KaiMemoryUnreadableItemsError, t as KAI_MEMORY_OBJECT_TYPE } from "../../kaiMemory-C9di17bd.js";
-export { KAI_MEMORY_OBJECT_TYPE, KAI_MEMORY_STATUSES, KaiMemoryReviewConflictError, KaiMemoryUnreadableItemsError, createKaiMemorySdk };
+export { t as KAI_MEMORY_OBJECT_TYPE, a as KAI_MEMORY_STATUSES, n as KaiMemoryReviewConflictError, r as KaiMemoryUnreadableItemsError, i as createKaiMemorySdk } from "../../kaiMemory-oir_qCo_.js";

package/dist/sdk/kaiMemory/types.d.cts

@@ -1,2 +1,2 @@
-import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-CY8X39qv.cjs";
+import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-CxEJ77m3.cjs";
 export { CreateKaiMemoryMeta, KaiMemoryData, KaiMemoryItem, KaiMemoryMeta, KaiMemoryStatus, MetastoreClient, UpdateKaiMemoryMeta };

package/dist/sdk/kaiMemory/types.d.ts

@@ -1,2 +1,2 @@
-import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-BWzt1ju_.js";
+import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-xzt_2H63.js";
 export { CreateKaiMemoryMeta, KaiMemoryData, KaiMemoryItem, KaiMemoryMeta, KaiMemoryStatus, MetastoreClient, UpdateKaiMemoryMeta };

package/dist/sdk/queryService/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_collectByOffset = require("../../collectByOffset-DQsqtmJg.cjs");
-const require_ValidationError = require("../../ValidationError-D65QU0uq.cjs");
-//#region src/sdks/queryService/queryServiceSdk.ts
+const require_ValidationError = require("../../ValidationError-BXcFX4nD.cjs");
+const require_collectByOffset = require("../../collectByOffset-DgxJ3zT9.cjs");
+// src/sdks/queryService/queryServiceSdk.ts
 const DEFAULT_EXECUTE_QUERY_PAGE_SIZE = 5e3;
 const DEFAULT_POLL_INTERVAL = 500;
 const DEFAULT_TIMEOUT = 3e5;
@@ -66,7 +66,6 @@ const createQueryServiceSdk = ({ queryServiceClient }) => {
 	};
 	return { executeQuery };
 };
-//#endregion
 exports.createQueryServiceSdk = createQueryServiceSdk;
 
 //# sourceMappingURL=index.cjs.map

package/dist/sdk/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { b as ExecuteQueryOptions, x as createQueryServiceSdk } from "../../index-Be2dNJ_N.cjs";
+import { b as ExecuteQueryOptions, x as createQueryServiceSdk } from "../../index-qJ2IjXIM.cjs";
 export { ExecuteQueryOptions, createQueryServiceSdk };

package/dist/sdk/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { b as ExecuteQueryOptions, x as createQueryServiceSdk } from "../../index-uGRdAORl.js";
+import { b as ExecuteQueryOptions, x as createQueryServiceSdk } from "../../index-BsT_cBJd.js";
 export { ExecuteQueryOptions, createQueryServiceSdk };

package/dist/sdk/queryService/index.js

@@ -1,6 +1,6 @@
-import { t as collectByOffset } from "../../collectByOffset-2XzJqmvr.js";
-import { t as ValidationError } from "../../ValidationError-DjhtNMfZ.js";
-//#region src/sdks/queryService/queryServiceSdk.ts
+import { t as ValidationError } from "../../ValidationError-BsdFDGY2.js";
+import { t as collectByOffset } from "../../collectByOffset-i8Tdoze7.js";
+// src/sdks/queryService/queryServiceSdk.ts
 const DEFAULT_EXECUTE_QUERY_PAGE_SIZE = 5e3;
 const DEFAULT_POLL_INTERVAL = 500;
 const DEFAULT_TIMEOUT = 3e5;
@@ -65,7 +65,6 @@ const createQueryServiceSdk = ({ queryServiceClient }) => {
 	};
 	return { executeQuery };
 };
-//#endregion
 export { createQueryServiceSdk };
 
 //# sourceMappingURL=index.js.map

package/dist/sdk/semanticLayer/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_semanticLayer = require("../../semanticLayer-7BejcMj_.cjs");
+const require_semanticLayer = require("../../semanticLayer-djom-J78.cjs");
 exports.CONSTRAINT_SCOPES = require_semanticLayer.CONSTRAINT_SCOPES;
 exports.CONSTRAINT_SEVERITIES = require_semanticLayer.CONSTRAINT_SEVERITIES;
 exports.CONSTRAINT_TYPES = require_semanticLayer.CONSTRAINT_TYPES;

package/dist/sdk/semanticLayer/index.d.cts

@@ -1,6 +1,5 @@
-import { A as CONSTRAINT_TYPES, D as UpdateSemanticObjectMeta, F as SQL_DIALECTS, M as RELATIONSHIP_JOIN_TYPES, N as RULE_OPERATORS, O as CONSTRAINT_SCOPES, P as SEMANTIC_OBJECT_SCOPES, T as SemanticUnreadableObjectRef, _ as SemanticObject, a as SemanticChildObjectType, b as SemanticObjectType, g as SemanticModelData, h as SemanticModelChildRef, i as SemanticChildObjectDataMap, j as FIELD_ROLES, k as CONSTRAINT_SEVERITIES, m as SemanticMetricData, n as MetastoreClient, o as SemanticConstraintData, p as SemanticGlossaryData, t as CreateSemanticObjectMeta, u as SemanticDatasetData, x as SemanticRelationshipData } from "../../types-ptynVnkv.cjs";
+import { A as CONSTRAINT_TYPES, D as UpdateSemanticObjectMeta, F as SQL_DIALECTS, M as RELATIONSHIP_JOIN_TYPES, N as RULE_OPERATORS, O as CONSTRAINT_SCOPES, P as SEMANTIC_OBJECT_SCOPES, T as SemanticUnreadableObjectRef, _ as SemanticObject, a as SemanticChildObjectType, b as SemanticObjectType, g as SemanticModelData, h as SemanticModelChildRef, i as SemanticChildObjectDataMap, j as FIELD_ROLES, k as CONSTRAINT_SEVERITIES, m as SemanticMetricData, n as MetastoreClient, o as SemanticConstraintData, p as SemanticGlossaryData, t as CreateSemanticObjectMeta, u as SemanticDatasetData, x as SemanticRelationshipData } from "../../types-B1qe1etN.cjs";
 import { z } from "zod";
-//#region src/sdks/semanticLayer/errorMessage.d.ts
 /**
  * The message out of a metastore error body.
  *
@@ -9,8 +8,6 @@ import { z } from "zod";
  * - Only the first error: the metastore reports fields one at a time.
  */
 declare const metastoreErrorMessage: (data: unknown) => string | undefined;
-//#endregion
-//#region src/sdks/semanticLayer/schemas.d.ts
 /**
  * Write validators for untrusted input; the metastore's own validation errors are opaque.
  *
@@ -91,8 +88,6 @@ declare const SEMANTIC_CHILD_OBJECT_SCHEMAS: {
     rule: z.ZodString;
   }, z.core.$loose>;
 };
-//#endregion
-//#region src/sdks/semanticLayer/semanticLayerSdk.d.ts
 /**
  * Thrown by `listModelChildren` when some child could not be parsed; fails closed.
  *
@@ -145,6 +140,5 @@ declare const createSemanticLayerSdk: ({ metastoreClient }: Options) => {
   listPendingScopeElevationRequests: (objectType: SemanticObjectType, signal?: AbortSignal) => Promise<SemanticObject<Record<string, unknown>>[]>;
   listMyPendingScopeElevationRequests: (objectType: SemanticObjectType, signal?: AbortSignal) => Promise<SemanticObject<Record<string, unknown>>[]>;
 };
-//#endregion
 export { CONSTRAINT_SCOPES, CONSTRAINT_SEVERITIES, CONSTRAINT_TYPES, FIELD_ROLES, MODEL_CHILD_OBJECT_TYPES, RELATIONSHIP_JOIN_TYPES, RULE_OPERATORS, SEMANTIC_CHILD_OBJECT_SCHEMAS, SEMANTIC_OBJECT_SCOPES, SEMANTIC_OBJECT_TYPE, SQL_DIALECTS, SemanticLayerUnreadableChildrenError, createSemanticLayerSdk, metastoreErrorMessage, semanticConstraintSchema, semanticDatasetSchema, semanticGlossarySchema, semanticMetricSchema, semanticModelSchema, semanticRelationshipSchema };
 //# sourceMappingURL=index.d.cts.map