@keboola/api-client 53.0.0 → 55.0.0

package/dist/constants-V9hAyPTo.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants-V9hAyPTo.cjs","names":[],"sources":["../src/constants/manageErrorCodes.ts","../src/constants/projectFeatures.ts","../src/constants/projectMetrics.ts","../src/constants/stackFeatures.ts","../src/constants/adminFeatures.ts","../src/constants/backends.ts","../src/constants/stacks.ts","../src/constants/index.ts"],"sourcesContent":["export const ManageErrorCode = {\n  ProgrammaticProjectInvalidClaim: 'manage.programmaticProjects.invalidClaim',\n  ProgrammaticProjectRateLimited: 'manage.programmaticProjects.rateLimited',\n  ProgrammaticProjectProvisioningFailed: 'manage.programmaticProjects.provisioningFailed',\n} as const;\n\nexport type ManageErrorCode = (typeof ManageErrorCode)[keyof typeof ManageErrorCode];\n","export const ProjectFeature = {\n  SandboxesPythonSpark: 'sandboxes-python-spark',\n  GcpMarketplaceByodb: 'gcp-marketplace-byodb',\n  GcpMarketplaceByodbEmpty: 'gcp-marketplace-byodb-empty',\n  FrontendLogin: 'frontend-login',\n  ComponentsMcp: 'ai-components-mcp',\n  PayAsYouGo: 'pay-as-you-go',\n  ShowVault: 'show-vault',\n  DeprecatedGoogleDriveTranspose: 'deprecated-google-drive-transpose',\n  SandboxesPersistentVolume: 'sandboxes-persistent-volume',\n  WorkspaceSnowflakeDynamicBackendSize: 'workspace-snowflake-dynamic-backend-size',\n  DynamicBackendJobs: 'dynamic-backend-jobs',\n  HasSimplifiedComponents: 'has-simplified-components',\n  FlowMigration: 'flow-migration',\n  FlowMigrationBatch1: 'flow-migration-batch1',\n  FlowMigrationBatch2: 'flow-migration-batch2',\n  FlowMigrationBatch3: 'flow-migration-batch3',\n  OracleTransformations: 'oracle-transformations',\n  ExternalBuckets: 'external-buckets',\n  InputMappingReadOnlyStorage: 'input-mapping-read-only-storage',\n  Artifacts: 'artifacts',\n  SnowflakePartnerConnect: 'snowflake-partner-connect',\n  SnowflakePartnerConnectLimited: 'snowflake-partner-connect-limited',\n  NewNativeTypes: 'new-native-types',\n  DisableLegacyBucketPrefix: 'disable-legacy-bucket-prefix',\n  SoxProtectedDefaultBranch: 'protected-default-branch',\n  StorageBranches: 'storage-branches',\n  DataStreams: 'data-streams',\n  AiLineage: 'ai-lineage',\n  AiComponentSuggestion: 'ai-component-suggestion',\n  AgentChat: 'agent-chat',\n  AgentChatUseKaiAgentUrl: 'agent-chat-use-kai-agent-url',\n  AgentChatModelTiers: 'agent-chat-model-tiers',\n  BucketExposure: 'bucket-exposure',\n  WebMcp: 'webmcp',\n  SnowflakeRegisterExternalSecureDataShare: 'snowflake-register-external-secure-data-share',\n  DirectGrantOutputMapping: 'direct-grant-output-mapping',\n  EditorWithoutReadOnlyStorage: 'editor-without-read-only-storage',\n  BranchesMergeRequests: 'branches-merge-requests',\n  DenyExternalDatasetInputMapping: 'deny-external-dataset-input-mapping',\n  AllowSharedSnowflakeAccess: 'allow-shared-snowflake-access',\n  BigqueryDefaultImView: 'bigquery-default-im-view',\n  BigqueryPolicyTags: 'bigquery-policy-tags',\n  DataAppsDisabled: 'data-apps-disabled',\n  RowLevelSecurity: 'row-level-security',\n} as const;\n\nexport type ProjectFeature = (typeof ProjectFeature)[keyof typeof ProjectFeature];\n","/** The metrics Connection snapshots for every project; the keys of a project's `metrics`. */\nexport const ProjectMetric = {\n  AdminsCount: 'kbc.adminsCount',\n  DataSizeBytes: 'storage.dataSizeBytes',\n  RowsCount: 'storage.rowsCount',\n} as const;\n\nexport type ProjectMetric = (typeof ProjectMetric)[keyof typeof ProjectMetric];\n","export const StackFeature = {\n  SingleTenant: 'single-tenant',\n  CanaryStack: 'canary-stack',\n  DisableJuliaAndR: 'disable-julia-and-r',\n  SamlRoles: 'saml-roles',\n  NewOauthService: 'new-oauth-service-enabled',\n  DataAppsEnforceAuth: 'data-apps-enforce-auth',\n  AllowAi: 'allow-ai',\n  UserWorkspaceDynamicBackendEnabled: 'user-workspace-dynamic-backend-enabled',\n  McpEnabled: 'mcp-enabled',\n  KaiEnabled: 'kai-enabled',\n  AgentProvisioning: 'agent-provisioning',\n  SandboxesPythonSpark: 'sandboxes-python-spark',\n} as const;\n\nexport type StackFeature = (typeof StackFeature)[keyof typeof StackFeature];\n","export const AdminFeature = {\n  DisableAutosavingInFlows: 'disable-autosaving-in-flows',\n  CanUpdateProjectSettings: 'can-update-project-settings',\n  CanManageFeatures: 'can-manage-features',\n  CanManageUsers: 'can-manage-users',\n  CanManageDeletedProjects: 'can-manage-deleted-projects',\n  CanManageProjectLimits: 'can-manage-project-limits',\n  CanManageMaintainers: 'can-manage-maintainers',\n  CanDisableProjects: 'can-disable-projects',\n  CanReactivateWorkspaces: 'can-reactivate-workspaces',\n  PowerUser: 'power-user',\n  MuteSoundNotifications: 'mute-sound-notifications',\n} as const;\n\nexport type AdminFeature = (typeof AdminFeature)[keyof typeof AdminFeature];\n","export const Backend = {\n  Snowflake: 'snowflake',\n  Bigquery: 'bigquery',\n} as const;\n\nexport type Backend = (typeof Backend)[keyof typeof Backend];\n","export const Provider = {\n  Aws: 'aws',\n  Azure: 'azure',\n  Gcp: 'gcp',\n} as const;\n\nexport type Provider = (typeof Provider)[keyof typeof Provider];\n\nexport const Continent = {\n  Us: 'us',\n  Europe: 'europe',\n} as const;\n\nexport type Continent = (typeof Continent)[keyof typeof Continent];\n\nexport type KeboolaStack = {\n  id: string;\n  host: string;\n  isSingleTenant?: boolean;\n  isTesting?: boolean;\n  isPayg?: boolean;\n  provider?: Provider;\n  continent?: Continent;\n  region?: string;\n  isCanary?: boolean;\n};\n\nconst stacks = {\n  NORTH_EUROPE_AZURE: {\n    id: 'com-keboola-azure-north-europe',\n    region: 'north-europe',\n    host: 'connection.north-europe.azure.keboola.com',\n    provider: 'azure',\n    continent: 'europe',\n    isPayg: true,\n  },\n  EU_CENTRAL_1_AWS: {\n    id: 'kbc-eu-central-1',\n    region: 'eu-central-1',\n    host: 'connection.eu-central-1.keboola.com',\n    provider: 'aws',\n    continent: 'europe',\n  },\n  US_EAST_1_AWS: {\n    id: 'kbc-us-east-1',\n    region: 'us-east-1',\n    host: 'connection.keboola.com',\n    provider: 'aws',\n    continent: 'us',\n  },\n  EUROPE_WEST3_GCP: {\n    id: 'com-keboola-gcp-europe-west3',\n    region: 'europe-west3',\n    host: 'connection.europe-west3.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'europe',\n  },\n  US_EAST_4_GCP: {\n    id: 'com-keboola-gcp-us-east4',\n    region: 'us-east4',\n    host: 'connection.us-east4.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'us',\n    isPayg: true,\n  },\n\n  /* PRIVATE SINGLE TENANT STACKS\n     ---------------------------- */\n  HCI: {\n    id: 'cloud-keboola-hci',\n    host: 'connection.hci.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_PROD: {\n    id: 'cloud-keboola-cs',\n    host: 'connection.cs.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_TEST: {\n    id: 'cloud-keboola-cs-test',\n    host: 'connection.cs-test.keboola.cloud',\n    isSingleTenant: true,\n  },\n  INNOGY: {\n    id: 'cloud-keboola-innogy-hub',\n    host: 'connection.innogy-hub.keboola.cloud',\n    isSingleTenant: true,\n  },\n  GROUPON: {\n    id: 'cloud-keboola-groupon',\n    host: 'connection.groupon.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CREDIT_INFO: {\n    id: 'cloud-keboola-creditinfo',\n    host: 'connection.creditinfo.keboola.cloud',\n    isSingleTenant: true,\n  },\n  COATES: {\n    id: 'cloud-keboola-coates',\n    host: 'connection.coates.keboola.cloud',\n    isSingleTenant: true,\n  },\n  SLSP: {\n    id: 'cloud-keboola-slsp',\n    host: 'connection.slsp.keboola.cloud',\n    isSingleTenant: true,\n  },\n  HCKZ: {\n    id: 'cloud-keboola-hckz',\n    host: 'connection.hckz.keboola.cloud',\n    isSingleTenant: true,\n  },\n  PASHA: {\n    id: 'cloud-keboola-pasha',\n    host: 'connection.pasha.keboola.cloud',\n    isSingleTenant: true,\n  },\n  RBI: {\n    id: 'cloud-keboola-rbi',\n    host: 'connection.rbi.keboola.cloud',\n    isSingleTenant: true,\n  },\n  NAH: {\n    id: 'cloud-keboola-nah',\n    host: 'connection.nah.keboola.cloud',\n    isSingleTenant: true,\n    provider: 'azure',\n    continent: 'us',\n  },\n\n  /* DEV STACKS\n     ---------------------------- */\n  DEV_US_CENTRAL_1_GCP: {\n    id: 'dev-keboola-gcp-us-central1',\n    region: 'us-central1',\n    host: 'connection.us-central1.gcp.keboola.dev',\n    provider: 'gcp',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_EU_WEST_1_AWS: {\n    id: 'dev-keboola-aws-eu-west-1',\n    region: 'eu-west-1',\n    host: 'connection.eu-west-1.aws.keboola.dev',\n    provider: 'aws',\n    continent: 'europe',\n    isTesting: true,\n  },\n  DEV_US_EAST_1_AWS_E2E: {\n    id: 'dev-keboola-aws-us-east-1-e2e',\n    region: 'us-east-1',\n    host: 'connection.e2e.us-east-1.aws.keboola.dev',\n    provider: 'aws',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_US_EAST_2_AZURE: {\n    id: 'kbc-testing-azure-east-us-2',\n    region: 'east-us-2',\n    host: 'connection.east-us-2.azure.keboola-testing.com',\n    provider: 'azure',\n    continent: 'us',\n    isTesting: true,\n  },\n  DEV_KEBOOLA_CANARY_ORION: {\n    id: 'dev-keboola-canary-orion',\n    region: 'europe-west3',\n    host: 'connection.canary-orion.keboola.dev',\n    provider: 'gcp',\n    continent: 'europe',\n    isCanary: true,\n  },\n} satisfies Record<string, Readonly<KeboolaStack>>;\n\n/**\n * Every stack the platform knows, keyed by name.\n *\n * - The key set is literal, so a name that is not in the object is a compile error at the call site\n *   rather than an `undefined` to fall back from.\n * - The value type stays the uniform `KeboolaStack`, so `stack.isCanary` reads on any entry, not\n *   only on the ones that carry the flag.\n */\nexport const STACKS: Record<keyof typeof stacks, Readonly<KeboolaStack>> = stacks;\n","export { ComponentId } from './componentId';\nexport { ManageErrorCode } from './manageErrorCodes';\nexport { ProjectFeature } from './projectFeatures';\nexport { ProjectMetric } from './projectMetrics';\nexport { StackFeature } from './stackFeatures';\nexport { AdminFeature } from './adminFeatures';\nexport { Backend } from './backends';\nexport { AdminRole } from './adminRoles';\nexport { ServiceId } from './serviceIds';\nexport { Continent, Provider, STACKS } from './stacks';\nexport type { KeboolaStack } from './stacks';\n\nexport const URLS = {\n  USER_DOCUMENTATION: 'https://help.keboola.com',\n  COMPONENTS: 'https://components.keboola.com',\n  DEVELOPERS_DOCUMENTATION: 'https://developers.keboola.com',\n  ACADEMY: 'https://academy.keboola.com',\n  SALES_CONTACT_FORM: 'https://keboola.com/contact',\n  SNOWFLAKE: 'https://www.snowflake.com',\n  SNOWFLAKE_DOCS: 'https://docs.snowflake.com',\n  MCP: 'https://www.keboola.com/mcp',\n  CLI: 'https://www.keboola.com/cli',\n  NODE_JS: 'https://nodejs.org/en',\n  CLAUDE_CONNECTORS: 'https://claude.ai/customize/connectors',\n  // Vendor \"how do I get this client\" pages linked from the connect surfaces.\n  CLIENT_CLAUDE_CODE_QUICKSTART: 'https://code.claude.com/docs/en/quickstart',\n  CLIENT_CLAUDE_AI: 'https://claude.ai',\n  CLIENT_CLAUDE_DESKTOP_DOWNLOAD: 'https://claude.com/download',\n  CLIENT_CURSOR_QUICKSTART: 'https://cursor.com/docs/get-started/quickstart',\n  CLIENT_VS_CODE_SETUP: 'https://code.visualstudio.com/docs/setup/setup-overview',\n  CLIENT_CODEX_QUICKSTART: 'https://developers.openai.com/codex/cli',\n  CLIENT_CHATGPT_DOWNLOAD: 'https://chatgpt.com/download',\n  CLIENT_MAKE_GET_STARTED: 'https://help.make.com/get-started',\n  CLIENT_DEVIN_DESKTOP: 'https://docs.devin.ai/desktop/getting-started',\n} as const;\n"],"mappings":";AAAA,MAAa,kBAAkB;CAC7B,iCAAiC;CACjC,gCAAgC;CAChC,uCAAuC;AACzC;;ACJA,MAAa,iBAAiB;CAC5B,sBAAsB;CACtB,qBAAqB;CACrB,0BAA0B;CAC1B,eAAe;CACf,eAAe;CACf,YAAY;CACZ,WAAW;CACX,gCAAgC;CAChC,2BAA2B;CAC3B,sCAAsC;CACtC,oBAAoB;CACpB,yBAAyB;CACzB,eAAe;CACf,qBAAqB;CACrB,qBAAqB;CACrB,qBAAqB;CACrB,uBAAuB;CACvB,iBAAiB;CACjB,6BAA6B;CAC7B,WAAW;CACX,yBAAyB;CACzB,gCAAgC;CAChC,gBAAgB;CAChB,2BAA2B;CAC3B,2BAA2B;CAC3B,iBAAiB;CACjB,aAAa;CACb,WAAW;CACX,uBAAuB;CACvB,WAAW;CACX,yBAAyB;CACzB,qBAAqB;CACrB,gBAAgB;CAChB,QAAQ;CACR,0CAA0C;CAC1C,0BAA0B;CAC1B,8BAA8B;CAC9B,uBAAuB;CACvB,iCAAiC;CACjC,4BAA4B;CAC5B,uBAAuB;CACvB,oBAAoB;CACpB,kBAAkB;CAClB,kBAAkB;AACpB;;;AC5CA,MAAa,gBAAgB;CAC3B,aAAa;CACb,eAAe;CACf,WAAW;AACb;;ACLA,MAAa,eAAe;CAC1B,cAAc;CACd,aAAa;CACb,kBAAkB;CAClB,WAAW;CACX,iBAAiB;CACjB,qBAAqB;CACrB,SAAS;CACT,oCAAoC;CACpC,YAAY;CACZ,YAAY;CACZ,mBAAmB;CACnB,sBAAsB;AACxB;;ACbA,MAAa,eAAe;CAC1B,0BAA0B;CAC1B,0BAA0B;CAC1B,mBAAmB;CACnB,gBAAgB;CAChB,0BAA0B;CAC1B,wBAAwB;CACxB,sBAAsB;CACtB,oBAAoB;CACpB,yBAAyB;CACzB,WAAW;CACX,wBAAwB;AAC1B;;ACZA,MAAa,UAAU;CACrB,WAAW;CACX,UAAU;AACZ;;ACHA,MAAa,WAAW;CACtB,KAAK;CACL,OAAO;CACP,KAAK;AACP;AAIA,MAAa,YAAY;CACvB,IAAI;CACJ,QAAQ;AACV;;;;;;;;;AA4KA,MAAa,SAA8D;CA3JzE,oBAAoB;EAClB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,QAAQ;CACV;CACA,kBAAkB;EAChB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,eAAe;EACb,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,kBAAkB;EAChB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;CACb;CACA,eAAe;EACb,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,QAAQ;CACV;CAIA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,WAAW;EACT,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,WAAW;EACT,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,SAAS;EACP,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,aAAa;EACX,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,OAAO;EACL,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;CAClB;CACA,KAAK;EACH,IAAI;EACJ,MAAM;EACN,gBAAgB;EAChB,UAAU;EACV,WAAW;CACb;CAIA,sBAAsB;EACpB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,mBAAmB;EACjB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,uBAAuB;EACrB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,qBAAqB;EACnB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,WAAW;CACb;CACA,0BAA0B;EACxB,IAAI;EACJ,QAAQ;EACR,MAAM;EACN,UAAU;EACV,WAAW;EACX,UAAU;CACZ;AAWyE;;AC3K3E,MAAa,OAAO;CAClB,oBAAoB;CACpB,YAAY;CACZ,0BAA0B;CAC1B,SAAS;CACT,oBAAoB;CACpB,WAAW;CACX,gBAAgB;CAChB,KAAK;CACL,KAAK;CACL,SAAS;CACT,mBAAmB;CAEnB,+BAA+B;CAC/B,kBAAkB;CAClB,gCAAgC;CAChC,0BAA0B;CAC1B,sBAAsB;CACtB,yBAAyB;CACzB,yBAAyB;CACzB,yBAAyB;CACzB,sBAAsB;AACxB"}

package/dist/domain/permissions/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_admin = require("../../admin-Di-MmGFP.cjs");
-const require_project = require("../../project-Onf-IcPW.cjs");
-const require_configurations = require("../../configurations-WI8H4zLk.cjs");
+const require_admin = require("../../admin-BZ7knTd0.cjs");
+const require_project = require("../../project-BQ2oD6IW.cjs");
+const require_configurations = require("../../configurations-BM63ep1s.cjs");
 exports.PermissionDeniedError = require_admin.PermissionDeniedError;
 exports.assertCanAdmin = require_admin.assertCanAdmin;
 exports.assertCanAdminOrShare = require_admin.assertCanAdminOrShare;
@@ -25,6 +25,7 @@ exports.canPurgeConfiguration = require_configurations.canPurgeConfiguration;
 exports.canUpdateConfiguration = require_configurations.canUpdateConfiguration;
 exports.canWriteKaiSettings = require_admin.canWriteKaiSettings;
 exports.canWriteKaiSpendCaps = require_project.canWriteKaiSpendCaps;
+exports.canWriteSecurityPolicies = require_admin.canWriteSecurityPolicies;
 exports.canWriteSemanticLayer = require_admin.canWriteSemanticLayer;
 exports.hasAdminFeature = require_project.hasAdminFeature;
 exports.hasFeature = require_project.hasFeature;

package/dist/domain/permissions/index.d.cts

@@ -51,6 +51,14 @@ declare const assertCanWriteKaiSettings: (token: StorageToken) => void;
  * - Organization-scope promotion is left to the metastore's 403.
  */
 declare const canWriteSemanticLayer: (token: StorageToken) => boolean;
+/**
+ * Whether this token may author row- and column-level security policies in the metastore.
+ *
+ * - Reads `token.admin.role` as the metastore does: `admin`, `productionManager` or `share`.
+ * - A limited token has no `admin` block, so it never matches.
+ * - `targeted` scope only: `organization` scope and grants are organization-admin, a metastore 403.
+ */
+declare const canWriteSecurityPolicies: (token: StorageToken) => boolean;
 declare const assertCanAdmin: (token: StorageToken) => void;
 declare const assertCanAdminOrShare: (token: StorageToken) => void;
 declare const assertCanProductionManage: (token: StorageToken) => void;
@@ -99,5 +107,5 @@ declare const assertCanCopyConfiguration: (token: StorageToken, ctx: Configurati
 declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
-export { ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAdministerOrganization, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, assertCanWriteKaiSpendCaps, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canListSharingTargets, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, canWriteKaiSpendCaps, canWriteSemanticLayer, hasAdminFeature, hasFeature, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isOrganizationAdmin, isOrganizationMember, isProductionManager, isReadOnlyRole };
+export { ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAdministerOrganization, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, assertCanWriteKaiSpendCaps, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canListSharingTargets, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, canWriteKaiSpendCaps, canWriteSecurityPolicies, canWriteSemanticLayer, hasAdminFeature, hasFeature, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isOrganizationAdmin, isOrganizationMember, isProductionManager, isReadOnlyRole };
 //# sourceMappingURL=index.d.cts.map

package/dist/domain/permissions/index.d.ts

@@ -51,6 +51,14 @@ declare const assertCanWriteKaiSettings: (token: StorageToken) => void;
  * - Organization-scope promotion is left to the metastore's 403.
  */
 declare const canWriteSemanticLayer: (token: StorageToken) => boolean;
+/**
+ * Whether this token may author row- and column-level security policies in the metastore.
+ *
+ * - Reads `token.admin.role` as the metastore does: `admin`, `productionManager` or `share`.
+ * - A limited token has no `admin` block, so it never matches.
+ * - `targeted` scope only: `organization` scope and grants are organization-admin, a metastore 403.
+ */
+declare const canWriteSecurityPolicies: (token: StorageToken) => boolean;
 declare const assertCanAdmin: (token: StorageToken) => void;
 declare const assertCanAdminOrShare: (token: StorageToken) => void;
 declare const assertCanProductionManage: (token: StorageToken) => void;
@@ -99,5 +107,5 @@ declare const assertCanCopyConfiguration: (token: StorageToken, ctx: Configurati
 declare const assertCanMigrateFromTemplate: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => void;
 declare const assertCanAssignFolder: (token: StorageToken, ctx: ConfigurationCtx) => void;
-export { ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAdministerOrganization, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, assertCanWriteKaiSpendCaps, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canListSharingTargets, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, canWriteKaiSpendCaps, canWriteSemanticLayer, hasAdminFeature, hasFeature, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isOrganizationAdmin, isOrganizationMember, isProductionManager, isReadOnlyRole };
+export { ConfigurationCtx, PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAdministerOrganization, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, assertCanWriteKaiSpendCaps, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canListSharingTargets, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, canWriteKaiSpendCaps, canWriteSecurityPolicies, canWriteSemanticLayer, hasAdminFeature, hasFeature, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isOrganizationAdmin, isOrganizationMember, isProductionManager, isReadOnlyRole };
 //# sourceMappingURL=index.d.ts.map

package/dist/domain/permissions/index.js

@@ -1,4 +1,4 @@
-import { a as assertCanWriteKaiSettings, c as isAdmin, d as isKaiSettingsWriterRole, f as isKnownAdminRole, h as PermissionDeniedError, i as assertCanProductionManage, l as isAdminOrShare, m as isReadOnlyRole, n as assertCanAdminOrShare, o as canWriteKaiSettings, p as isProductionManager, r as assertCanDevelopOrReview, s as canWriteSemanticLayer, t as assertCanAdmin, u as isDeveloperOrReviewer } from "../../admin-CbMOsfgs.js";
-import { a as assertCanAdministerOrganization, c as isOrganizationAdmin, i as canListSharingTargets, l as isOrganizationMember, n as hasAdminFeature, o as assertCanWriteKaiSpendCaps, r as hasFeature, s as canWriteKaiSpendCaps } from "../../project-DmuC0bMK.js";
-import { a as assertCanPurgeConfiguration, c as canCopyConfiguration, d as canPurgeConfiguration, f as canUpdateConfiguration, i as assertCanMigrateFromTemplate, l as canCreateConfiguration, n as assertCanCopyConfiguration, o as assertCanUpdateConfiguration, r as assertCanCreateConfiguration, s as canAssignFolder, t as assertCanAssignFolder, u as canMigrateFromTemplate } from "../../configurations-Cd6Nsox-.js";
-export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAdministerOrganization, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, assertCanWriteKaiSpendCaps, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canListSharingTargets, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, canWriteKaiSpendCaps, canWriteSemanticLayer, hasAdminFeature, hasFeature, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isOrganizationAdmin, isOrganizationMember, isProductionManager, isReadOnlyRole };
+import { a as assertCanWriteKaiSettings, c as canWriteSemanticLayer, d as isDeveloperOrReviewer, f as isKaiSettingsWriterRole, g as PermissionDeniedError, h as isReadOnlyRole, i as assertCanProductionManage, l as isAdmin, m as isProductionManager, n as assertCanAdminOrShare, o as canWriteKaiSettings, p as isKnownAdminRole, r as assertCanDevelopOrReview, s as canWriteSecurityPolicies, t as assertCanAdmin, u as isAdminOrShare } from "../../admin-xFfHSZHQ.js";
+import { a as assertCanAdministerOrganization, c as isOrganizationAdmin, i as canListSharingTargets, l as isOrganizationMember, n as hasAdminFeature, o as assertCanWriteKaiSpendCaps, r as hasFeature, s as canWriteKaiSpendCaps } from "../../project-aAVAOcmx.js";
+import { a as assertCanPurgeConfiguration, c as canCopyConfiguration, d as canPurgeConfiguration, f as canUpdateConfiguration, i as assertCanMigrateFromTemplate, l as canCreateConfiguration, n as assertCanCopyConfiguration, o as assertCanUpdateConfiguration, r as assertCanCreateConfiguration, s as canAssignFolder, t as assertCanAssignFolder, u as canMigrateFromTemplate } from "../../configurations-BqvtIQm4.js";
+export { PermissionDeniedError, assertCanAdmin, assertCanAdminOrShare, assertCanAdministerOrganization, assertCanAssignFolder, assertCanCopyConfiguration, assertCanCreateConfiguration, assertCanDevelopOrReview, assertCanMigrateFromTemplate, assertCanProductionManage, assertCanPurgeConfiguration, assertCanUpdateConfiguration, assertCanWriteKaiSettings, assertCanWriteKaiSpendCaps, canAssignFolder, canCopyConfiguration, canCreateConfiguration, canListSharingTargets, canMigrateFromTemplate, canPurgeConfiguration, canUpdateConfiguration, canWriteKaiSettings, canWriteKaiSpendCaps, canWriteSecurityPolicies, canWriteSemanticLayer, hasAdminFeature, hasFeature, isAdmin, isAdminOrShare, isDeveloperOrReviewer, isKaiSettingsWriterRole, isKnownAdminRole, isOrganizationAdmin, isOrganizationMember, isProductionManager, isReadOnlyRole };

package/dist/encryption/index.d.cts

@@ -1,2 +1,2 @@
-import { t as createEncryptionClient } from "../index-BUKMdbKh.cjs";
+import { t as createEncryptionClient } from "../index-CmyFWQXn.cjs";
 export { createEncryptionClient };

package/dist/encryption/index.d.ts

@@ -1,2 +1,2 @@
-import { t as createEncryptionClient } from "../index-BxgHNJ3Q.js";
+import { t as createEncryptionClient } from "../index-CQPs3hrp.js";
 export { createEncryptionClient };

package/dist/encryption/types.d.cts

@@ -1,2 +1,2 @@
-import { a as EncryptParamsByScope, c as ScopedSecrets, i as EncryptParams, n as BranchType, o as EncryptQuery, r as EncryptBody, s as EncryptionScope } from "../index-BUKMdbKh.cjs";
+import { a as EncryptParamsByScope, c as ScopedSecrets, i as EncryptParams, n as BranchType, o as EncryptQuery, r as EncryptBody, s as EncryptionScope } from "../index-CmyFWQXn.cjs";
 export { BranchType, EncryptBody, EncryptParams, EncryptParamsByScope, EncryptQuery, EncryptionScope, ScopedSecrets };

package/dist/encryption/types.d.ts

@@ -1,2 +1,2 @@
-import { a as EncryptParamsByScope, c as ScopedSecrets, i as EncryptParams, n as BranchType, o as EncryptQuery, r as EncryptBody, s as EncryptionScope } from "../index-BxgHNJ3Q.js";
+import { a as EncryptParamsByScope, c as ScopedSecrets, i as EncryptParams, n as BranchType, o as EncryptQuery, r as EncryptBody, s as EncryptionScope } from "../index-CQPs3hrp.js";
 export { BranchType, EncryptBody, EncryptParams, EncryptParamsByScope, EncryptQuery, EncryptionScope, ScopedSecrets };