@keboola/api-client 54.0.0 → 56.0.0

package/dist/sdk/configurations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["snowflakeCommon"],"sources":["../../../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../../../src/sdks/configurations/schemas/common/dbConfig.ts","../../../src/sdks/configurations/schemas/common/dbConnection.ts","../../../src/sdks/configurations/schemas/common/forbidden.ts","../../../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../../../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../../../src/sdks/configurations/schemas/common/sslSchema.ts","../../../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../../../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../../../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../../../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../../../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../../../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../../../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../../../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../../../src/sdks/configurations/schemas/googleAdsSchema.ts","../../../src/sdks/configurations/schemas/schedulerSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../../../src/sdks/configurations/createRegistry/createRegistry.ts","../../../src/sdks/configurations/registry.ts","../../../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials with an optional SSH tunnel, for the generic SSH-only drivers.\n *\n * - Keep in sync with kbc-ui's `hasSshTunnel` / `hasSsl` (`ex-db-generic/helpers.ts`).\n * - SSL-capable, tunnel-less and extra-field drivers get their own schema.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    continueOnFailure: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { BranchRefs } from '../../domain/branchRefs';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  branchRefs: BranchRefs;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are\n *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.\n * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,\n *   e.g. `storage`, is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.branchRefs.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.branchRefs.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;AAOA,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO,EACnB,IAAI,EAAE,OAAO,EACX,aAAa,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;ACVD,MAAa,YAAkC,OAC7C,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;ACI3C,MAAa,qBAAqB,EAAE,OAAO;CACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;ACLD,MAAa,YAAY,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;ACFhD,MAAa,2BAA2B,EAAE,OAAO,EAC/C,WAAW,EAAE,OAAO;CAClB,IAAI,EAAE,OAAO;CACb,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;ACVD,MAAa,kBAAkB,EAAE,OAAO;CACtC,SAAS,EAAE,QAAQ;CACnB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAM,EACH,OAAO;EACN,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;ACZD,MAAa,YAAY,EAAE,OAAO;CAChC,SAAS,EAAE,QAAQ;CACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;ACAD,MAAM,gBAAgB,EAAE,OAAO;CAC7B,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,iBAAiB,EAAE,OAAO;CAC1B,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+B,EAAE,OAAO,EACnD,YAAY,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoB,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuB,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;ACfD,MAAM,qBAAqB,EACxB,OAAO;CACN,WAAW,EAAE,QAAQ,aAAa;CAClC,aAAa,EAAE,OAAO;CACtB,oBAAoB,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAc,EACjB,OAAO;CACN,WAAW,EAAE,QAAQ,MAAM;CAC3B,WAAW,EAAE,OAAO;CACpB,UAAU,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgB,EAC1B,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;AChCT,MAAa,oBAAoB,EAC9B,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;ACVT,MAAa,wBAAwB,EAClC,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;ACZT,MAAM,gBAAgB,EAAE,OAAO;CAC7B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,gBAAgB,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAU,EAAE,OAAO;CACnB,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAc,EACxB,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;AC/BT,MAAa,eAAe,EACzB,OAAO,EACN,YAAY,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;ACJT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;ACPA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2B,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACTA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,MAAM,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO;AAAE,CAAC,CAC5E;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAY,EAAE,OAAO;CACrB,UAAU,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;ACDA,MAAMA,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACNA,kBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5EA,kBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;ACdA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CACP,WAAW,EAAE,OAAO;CACpB,QAAQ,EAAE,OAAO;CACjB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;ACfA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,MAAM,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAU,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqB,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgB,EAAE,OAAO;CAC7B,OAAO,EAAE,OAAO;CAChB,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoB,EAAE,OAAO;CACjC,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO;CACnB,SAAS,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAM,EAAE,OAAO;EAAE,OAAO,EAAE,OAAO;EAAG,aAAa,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;ACjED,MAAa,oBAAoB,EAAE,OAAO;CACxC,eAAe;CACf,YAAY,EAAE,OAAO;EACnB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;EAC9B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,mBAAmB,EAAE,QAAQ,CAAC,CAAC,SAAS;EACxC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;ACLD,MAAa,kBAAkB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO;EACjB,SAAS,EAAE,OAAO;EAGlB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAO,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQ,EAAE,OAAO;EACf,aAAa,EAAE,OAAO;EACtB,iBAAiB,EAAE,OAAO;EAC1B,MAAM,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAY,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAW,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;ACGA,MAAM,aAAa,EAAE,OAAO;CAC1B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5B,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkB,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;ACjBA,MAAa,mBAAmB,SAC9B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;CACnB,gBAAgB,EAAE,OAAO;CACzB,uBAAuB,EAAE,OAAO;CAChC,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgB,EAAE,OAAO;CACzB,kBAAkB,EAAE,OAAO;CAC3B,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAAS,EAAE,OAAO;CAClB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CACH;;;ACNA,MAAa,kBAAkB,SAC7B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkB,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkB,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAO,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiB,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;ACnBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAI,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAI,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAI,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAI,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAI,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAI,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAI,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAI,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAI,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAI,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAI,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAI,YAAY,SAAS,YAAY,CAAC,CACtC,IAAI,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAI,YAAY,aAAa,WAAW,CAAC,CACzC,IAAI,YAAY,WAAW,aAAa,CAAC,CACzC,IAAI,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAI,YAAY,6BAA6B,qBAAqB;;ACrErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,WAAW,MAAM,QAAQ,EACpD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,WAAW,MAAM,QAAQ,EACpD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}
+{"version":3,"file":"index.js","names":["snowflakeCommon"],"sources":["../../../src/sdks/configurations/schemas/appDataGatewaySchema.ts","../../../src/sdks/configurations/schemas/common/dbConfig.ts","../../../src/sdks/configurations/schemas/common/dbConnection.ts","../../../src/sdks/configurations/schemas/common/forbidden.ts","../../../src/sdks/configurations/schemas/common/oauthAuthorization.ts","../../../src/sdks/configurations/schemas/common/sshTunnelSchema.ts","../../../src/sdks/configurations/schemas/common/sslSchema.ts","../../../src/sdks/configurations/schemas/appSnowflakeDwhManagerSchema.ts","../../../src/sdks/configurations/schemas/ex/exAwsS3Schema.ts","../../../src/sdks/configurations/schemas/ex/exAzureBlobStorageSchema.ts","../../../src/sdks/configurations/schemas/ex/exAzureDataLakeSchema.ts","../../../src/sdks/configurations/schemas/ex/exFtpSchema.ts","../../../src/sdks/configurations/schemas/ex/exHttpSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbDefaultSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbPgsqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbProgressSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbMysqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbMssqlSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbOracleSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbOracleAdwSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbFirebirdSchema.ts","../../../src/sdks/configurations/schemas/exDb/exTeradataSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbInformixSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbSnowflakeSchema.ts","../../../src/sdks/configurations/schemas/exDb/exDbNetsuiteSchema.ts","../../../src/sdks/configurations/schemas/gooddataWriterSchema.ts","../../../src/sdks/configurations/schemas/googleAdsSchema.ts","../../../src/sdks/configurations/schemas/schedulerSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbDefaultSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbPgsqlSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbOracleSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbOracleAdwSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrSynapseSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrRedshiftSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbMssqlSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbImpalaSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrExasolSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrFireboltSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrHiveCsasSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrThoughtspotSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrSisenseSchema.ts","../../../src/sdks/configurations/schemas/wrDb/wrDbSnowflakeSchema.ts","../../../src/sdks/configurations/createRegistry/createRegistry.ts","../../../src/sdks/configurations/registry.ts","../../../src/sdks/configurations/configurationsSdk.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * `keboola.app-data-gateway` — the Data Gateway provisions and manages its own Snowflake\n * workspace, so the config carries no credentials: just the id of the workspace it runs\n * against, stored at `parameters.db.workspaceId`.\n */\nexport const appDataGatewaySchema = z.object({\n  parameters: z.object({\n    db: z.object({\n      workspaceId: z.number(),\n    }),\n  }),\n});\n","import { z } from 'zod';\n\n/** Wrap a `parameters.db` credential schema into the full component config shape. */\nexport const dbConfig = <Db extends z.ZodType>(db: Db) =>\n  z.object({ parameters: z.object({ db }) });\n","import { z } from 'zod';\n\n/**\n * The credential fields shared by virtually every DB writer, stored at `parameters.db`.\n * Components extend this with driver-specific fields (`schema`, `warehouse`, `ssh`, …) and\n * override where they differ (e.g. Snowflake makes `#password` optional). Secret leaves use\n * the `#` prefix the encryption service recognizes.\n */\nexport const dbConnectionSchema = z.object({\n  host: z.string().describe('Hostname'),\n  port: z.number().describe('Port'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  database: z.string().describe('Database Name'),\n});\n","import { z } from 'zod';\n\n/**\n * Marks a field as \"must be absent\" in one arm of a mutually-exclusive union: `z.undefined()`\n * rejects any value while `.optional()` lets the key be omitted entirely. Pairing it with a\n * required field in the sibling arm (e.g. `#password` XOR `#privateKey`) is what makes an\n * \"exactly one of\" union reject configs that set both keys — or neither — at runtime and in\n * the inferred type. Without it the arms would be open objects that silently strip the extra key.\n */\nexport const forbidden = z.undefined().optional();\n","import { z } from 'zod';\n\n/**\n * The OAuth credential reference components store under a top-level `authorization` key. `id`\n * points at the vault-stored credential; `version` is the OAuth-API version (3 on modern stacks).\n * Shared by every OAuth-backed component (Google family, Facebook, …).\n */\nexport const oauthAuthorizationSchema = z.object({\n  oauth_api: z.object({\n    id: z.string(),\n    version: z.number().optional(),\n  }),\n});\n","import { z } from 'zod';\n\nexport const sshTunnelSchema = z.object({\n  enabled: z.boolean(),\n  sshHost: z.string().optional(),\n  user: z.string().optional(),\n  sshPort: z.number().optional(),\n  /** FTP passive-mode port range (e.g. `10000:10005`); only relevant to FTP extractors. */\n  passivePortRange: z.string().optional(),\n  keys: z\n    .object({\n      public: z.string().optional(),\n      '#private': z.string().optional(),\n    })\n    .optional(),\n});\n","import { z } from 'zod';\n\n/** SSL options nested at `parameters.db.ssl` (drivers that support it, e.g. MySQL, Hive). */\nexport const sslSchema = z.object({\n  enabled: z.boolean(),\n  cert: z.string().optional(),\n  '#key': z.string().optional(),\n  ca: z.string().optional(),\n  cipher: z.string().optional(),\n  verifyServerCert: z.boolean().optional(),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from './common';\n\n/**\n * `keboola.app-snowflake-dwh-manager` — master Snowflake connection. Auth is a password OR a\n * key-pair (exactly one). The common fields are shared; each variant requires its own secret and\n * *forbids the other* (`forbidden`), so a config carrying both — or neither — is rejected at\n * runtime and at the type level, matching the `wr-db-snowflake` XOR pattern.\n */\nconst dwhMasterBase = z.object({\n  master_host: z.string(),\n  master_user: z.string(),\n  master_database: z.string(),\n  warehouse: z.string(),\n});\n\nexport const appSnowflakeDwhManagerSchema = z.object({\n  parameters: z.union([\n    dwhMasterBase.extend({ '#master_password': z.string(), '#master_private_key': forbidden }),\n    dwhMasterBase.extend({ '#master_private_key': z.string(), '#master_password': forbidden }),\n  ]),\n});\n","import { z } from 'zod';\n\nimport { forbidden } from '../common';\n\n// `.loose()`: the auth block is validated, but the extractor's other `parameters` (bucket, key,\n// saveAs, …) are component-managed and must pass through rather than be stripped on create/update.\n/** Access-key credentials — forbids the IAM-role fields so the variants stay exclusive. */\nconst awsCredentialsAuth = z\n  .object({\n    loginType: z.literal('credentials'),\n    accessKeyId: z.string(),\n    '#secretAccessKey': z.string(),\n    accountId: forbidden,\n    roleName: forbidden,\n  })\n  .loose();\n\n/** IAM-role auth — forbids the access-key fields so the variants stay exclusive. */\nconst awsRoleAuth = z\n  .object({\n    loginType: z.literal('role'),\n    accountId: z.string(),\n    roleName: z.string(),\n    accessKeyId: forbidden,\n    '#secretAccessKey': forbidden,\n  })\n  .loose();\n\n/**\n * `keboola.ex-aws-s3` — access-key credentials OR IAM-role auth (exactly one). `loginType` is the\n * discriminant, and each arm *forbids the other* variant's fields (`z.undefined()`) so a config\n * mixing both — e.g. credentials + a stale `roleName` — is rejected rather than silently stripped.\n * The outer object is `.loose()` so top-level component-managed keys (`storage`, `processors`)\n * pass through.\n */\nexport const exAwsS3Schema = z\n  .object({\n    parameters: z.union([awsCredentialsAuth, awsRoleAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-blob-storage-v2` — account name + key + container. Both levels are `.loose()`:\n * the connection block is validated, but component-managed `parameters` and top-level keys\n * (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureBlobSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        container_name: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `kds-team.ex-azure-data-lake-gen2` — like Blob, but a `file_system` instead of a container. Both\n * levels are `.loose()`: the connection block is validated, but component-managed `parameters` and\n * top-level keys (`storage`, `processors`) pass through rather than being stripped on create/update.\n */\nexport const exAzureDataLakeSchema = z\n  .object({\n    parameters: z\n      .object({\n        account_name: z.string(),\n        '#account_key': z.string(),\n        file_system: z.string(),\n      })\n      .loose(),\n  })\n  .loose();\n","import { z } from 'zod';\n\nimport { forbidden, sshTunnelSchema } from '../common';\n\n/** Connection fields shared by both auth variants. */\nconst ftpConnection = z.object({\n  host: z.string(),\n  port: z.number(),\n  connectionType: z.enum(['FTP', 'FTPS', 'SFTP']),\n  username: z.string(),\n  ignorePassiveAddress: z.boolean().optional(),\n  ssh: sshTunnelSchema.optional(),\n  path: z.string().optional(),\n  onlyNewFiles: z.boolean().optional(),\n});\n\n// `.loose()`: validate the connection block but let component-managed parameter keys pass through.\n/** Password auth — forbids the private key so the variants stay exclusive. */\nconst ftpPasswordAuth = ftpConnection\n  .extend({ '#password': z.string(), '#privateKey': forbidden })\n  .loose();\n\n/** Private-key auth — forbids the password so the variants stay exclusive. */\nconst ftpPrivateKeyAuth = ftpConnection\n  .extend({ '#privateKey': z.string(), '#password': forbidden })\n  .loose();\n\n/**\n * `keboola.ex-ftp` / `keboola.ex-ftp-csas` — FTP/FTPS/SFTP server connection. Auth is a password\n * OR a private key (exactly one): each variant requires its secret and *forbids the other*\n * (`z.undefined()`), so a config with both — or neither — is rejected, and switching variants via\n * an update drops the abandoned secret (the whole `parameters` union subtree is replaced wholesale\n * by `schemaGuidedMerge`, so a partial patch must carry the complete connection block). The outer\n * object is `.loose()` so top-level component-managed keys (`storage`, `processors`) pass through.\n */\nexport const exFtpSchema = z\n  .object({\n    parameters: z.union([ftpPasswordAuth, ftpPrivateKeyAuth]),\n  })\n  .loose();\n","import { z } from 'zod';\n\n/**\n * `keboola.ex-http` — only the connection block is stable here. The request/job definitions are\n * component-managed and left unvalidated, so both levels are `.loose()`: extra `parameters` keys\n * and top-level keys (`storage`, `processors`) pass through `schema`/`inputSchema` unchanged rather\n * than being stripped on create/update.\n */\nexport const exHttpSchema = z\n  .object({\n    parameters: z.object({ baseUrl: z.string(), maxRedirects: z.number().optional() }).loose(),\n  })\n  .loose();\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * Default extractor credentials with an optional SSH tunnel, for the generic SSH-only drivers.\n *\n * - Keep in sync with kbc-ui's `hasSshTunnel` / `hasSsl` (`ex-db-generic/helpers.ts`).\n * - SSL-capable, tunnel-less and extra-field drivers get their own schema.\n */\nexport const exDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-pgsql` — generic credentials that also accept SSL. */\nexport const exDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { dbConfig, dbConnectionSchema } from '../common';\n\n/** `kds-team.ex-progress-db` — generic credentials, no SSH tunnel or SSL. */\nexport const exDbProgressSchema = dbConfig(dbConnectionSchema);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mysql` — `database` optional + transaction-isolation / network-compression. */\nexport const exDbMysqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    database: z.string().optional(),\n    transactionIsolationLevel: z\n      .enum(['REPEATABLE READ', 'READ COMMITTED', 'READ UNCOMMITTED', 'SERIALIZABLE'])\n      .optional(),\n    networkCompression: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/** `keboola.ex-db-mssql` — `port` optional, otherwise the shared base. */\nexport const exDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    port: z.number().optional(),\n    ssh: sshTunnelSchema.optional(),\n    ssl: sslSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.ex-db-oracle` — host/port/database all optional (tnsnames is the alternative). */\nexport const exDbOracleSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * `keboola.ex-db-oracle-adw` — the Oracle extractor with Oracle Cloud Autonomous Database support.\n * Same connection as `keboola.ex-db-oracle` (host/port/database all optional, tnsnames is the\n * alternative), plus the database wallet: `walletServiceName` with `walletFileId`.\n */\nexport const exDbOracleAdwSchema = dbConfig(\n  dbConnectionSchema.omit({ host: true, port: true, database: true }).extend({\n    host: z.string().optional(),\n    port: z.number().optional(),\n    database: z.string().optional(),\n    tnsnames: z.string().optional(),\n    walletServiceName: z.string().optional(),\n    walletFileId: z.union([z.number(), z.literal('')]).optional(),\n    connectThrough: z.boolean().optional(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-firebird` — `dbname` + user/#password only (no host/port/database fields). */\nexport const exDbFirebirdSchema = dbConfig(\n  z.object({ dbname: z.string(), user: z.string(), '#password': z.string() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-teradata` — shared base with optional `database`. */\nexport const exTeradataSchema = dbConfig(\n  dbConnectionSchema.extend({ database: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.ex-db-informix` — Informix server name + protocol + optional locale. */\nexport const exDbInformixSchema = dbConfig(\n  dbConnectionSchema.extend({\n    serverName: z.string(),\n    protocol: z.enum(['onsoctcp', 'onsocssl']),\n    dbLocale: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.ex-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database + optional schema/warehouse) are shared; each variant requires\n * its own secret and forbids the other, so a config carrying both — or neither — is rejected at\n * runtime and at the type level.\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string().optional(), warehouse: z.string().optional() });\n\nexport const exDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.ex-db-netsuite` — SuiteAnalytics account/role + user/#password (no host/port/db). */\nexport const exDbNetsuiteSchema = dbConfig(\n  z.object({\n    accountId: z.string(),\n    roleId: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n\n/** `kds-team.ex-netsuite` — Connect host/port + server data source + account/role. */\nexport const exKdsNetsuiteSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    server_data_source: z.enum(['NetSuite.com', 'NetSuite2.com']),\n    account_id: z.string(),\n    role_id: z.string(),\n    user: z.string(),\n    '#password': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\n/**\n * A single exported column. `type` is always present and drives which of the other fields the\n * UI shows (and persists): `dataType`/`dataTypeSize` for the base types + LABEL, `reference` for\n * LABEL/HYPERLINK, `schemaReference` for REFERENCE, `format`/`dateDimension` for DATE, and\n * `sortLabel`/`sortOrder` + the `identifier*` fields for ATTRIBUTE. They're optional here since a\n * given column only carries the subset relevant to its type. Mirrors the kbc-ui column adapter\n * (`apps/kbc-ui/src/scripts/modules/gooddata-writer-v3/helpers/makeColumnDefinition.ts`).\n */\nconst gooddataColumn = z.object({\n  type: z.enum([\n    'ATTRIBUTE',\n    'CONNECTION_POINT',\n    'DATE',\n    'FACT',\n    'HYPERLINK',\n    'LABEL',\n    'REFERENCE',\n    'IGNORE',\n  ]),\n  id: z.string().optional(),\n  title: z.string().optional(),\n  dataType: z.enum(['BIGINT', 'DATE', 'DECIMAL', 'INT', 'VARCHAR']).optional(),\n  dataTypeSize: z.string().optional(),\n  reference: z.string().optional(),\n  schemaReference: z.string().optional(),\n  sortLabel: z.string().optional(),\n  sortOrder: z.enum(['ASC', 'DESC']).optional(),\n  format: z.string().optional(),\n  dateDimension: z.string().optional(),\n  identifier: z.string().optional(),\n  identifierLabel: z.string().optional(),\n  identifierSortLabel: z.string().optional(),\n});\n\n/** One exported table: a GoodData `title`, its `columns` keyed by source column name, and an\n *  optional `disabled` flag toggled when export is switched off. */\nconst gooddataTable = z.object({\n  title: z.string(),\n  disabled: z.boolean().optional(),\n  identifier: z.string().optional(),\n  columns: z.record(z.string(), gooddataColumn),\n});\n\n/** One date dimension; `template` selects the date-dimension template (`gooddata` / `keboola` /\n *  a custom template id). */\nconst gooddataDimension = z.object({\n  template: z.string(),\n  includeTime: z.boolean().optional(),\n  identifier: z.string().optional(),\n});\n\n/**\n * `keboola.gooddata-writer` — GoodData project + login credentials plus the exported model:\n * `tables` (keyed by source table id) and `dimensions` (keyed by dimension name). Both are\n * optional — a fresh config has credentials before any table/dimension is mapped — and must be\n * declared: the registry validates create/update input with a deep-partial that strips keys\n * absent from this shape, so an undeclared `tables`/`dimensions` payload would be dropped before\n * it's stored.\n */\nexport const gooddataWriterSchema = z.object({\n  parameters: z.object({\n    project: z.object({ pid: z.string(), backendUrl: z.string().optional() }),\n    user: z.object({ login: z.string(), '#password': z.string() }),\n    loadOnly: z.boolean().optional(),\n    multiLoad: z.boolean().optional(),\n    tables: z.record(z.string(), gooddataTable).optional(),\n    dimensions: z.record(z.string(), gooddataDimension).optional(),\n  }),\n});\n","import { z } from 'zod';\n\nimport { oauthAuthorizationSchema } from './common';\n\n/** `keboola.ex-google-ads` — OAuth credential reference + account selection. */\nexport const exGoogleAdsSchema = z.object({\n  authorization: oauthAuthorizationSchema,\n  parameters: z.object({\n    customerId: z.array(z.string()),\n    onlyEnabledCustomers: z.boolean().optional(),\n    continueOnFailure: z.boolean().optional(),\n    getAccountChildren: z.boolean().optional(),\n  }),\n});\n","import { z } from 'zod';\n\n/**\n * `keboola.scheduler` — drives a target component config on a cron schedule. Unlike the\n * writer configs, scheduler state lives at the top level (no `parameters` wrapper):\n * `schedule` holds the cron expression + timezone + enabled/disabled state, `target`\n * identifies which component configuration to run.\n */\nexport const schedulerSchema = z.object({\n  schedule: z.object({\n    cronTab: z.string(),\n    // Legacy configs predate the timezone field; the UI falls back to 'UTC' when it's\n    // missing, so a config without it is still runnable. Keep it optional to match.\n    timezone: z.string().optional(),\n    state: z.enum(['enabled', 'disabled']),\n  }),\n  target: z.object({\n    componentId: z.string(),\n    configurationId: z.string(),\n    mode: z.literal('run'),\n  }),\n});\n","import { dbConfig, dbConnectionSchema, sshTunnelSchema, sslSchema } from '../common';\n\n/**\n * Default writer credentials — host/port/user/#password/database + optional SSH and SSL tunnels.\n * Shared by the writers that add no extra fields (`keboola.wr-db-mysql`, `keboola.wr-db-hive`);\n * writers that add or rename fields get their own schema.\n */\nexport const wrDbDefaultSchema = dbConfig(\n  dbConnectionSchema.extend({ ssh: sshTunnelSchema.optional(), ssl: sslSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-pgsql` — adds a required `schema`, optional SSH. */\nexport const wrDbPgsqlSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-oracle` — optional `schema`, optional SSH. */\nexport const wrDbOracleSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/**\n * `keboola.wr-db-oracle-adw` — the Oracle writer with Oracle Cloud Autonomous Database support.\n * Connects by host/port/database (optional `schema`, optional SSH) like `keboola.wr-db-oracle`,\n * or through the database wallet: `walletServiceName` (a service from the wallet's tnsnames.ora)\n * plus `walletFileId` (the wallet ZIP in Storage). Wallet mode refuses `host` and ignores the\n * `port` that the credentials form saves by default. The form saves a cleared field as an empty\n * string, so `''` counts as \"not set\" on both sides.\n */\nconst hostConnection = dbConnectionSchema.extend({\n  schema: z.string().optional(),\n  ssh: sshTunnelSchema.optional(),\n  walletServiceName: z.literal('').optional(),\n  walletFileId: z.literal('').optional(),\n});\n\nconst walletConnection = z.object({\n  walletServiceName: z.string().min(1).describe('Wallet Service Name'),\n  walletFileId: z\n    .union([z.number(), z.literal('')])\n    .optional()\n    .describe('Wallet File ID'),\n  user: z.string().describe('Username'),\n  '#password': z.string().describe('Password'),\n  schema: z.string().optional(),\n  port: z.number().optional(),\n  host: z.literal('').optional(),\n});\n\nexport const wrDbOracleAdwSchema = dbConfig(z.union([hostConnection, walletConnection]));\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-synapse` — optional `schema` (defaults to `dbo` in the UI). */\nexport const wrSynapseSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string().optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-redshift-v2` — required `schema`, optional SSH. */\nexport const wrRedshiftSchema = dbConfig(\n  dbConnectionSchema.extend({ schema: z.string(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-mssql-v2` — optional `instance`, required `tdsVersion`, optional SSH. */\nexport const wrDbMssqlSchema = dbConfig(\n  dbConnectionSchema.extend({\n    instance: z.string().optional(),\n    tdsVersion: z.enum(['7.0', '7.1', '7.2', '7.3', '7.4']),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `keboola.wr-db-impala` — adds `auth_mech`, optional SSH. */\nexport const wrDbImpalaSchema = dbConfig(\n  dbConnectionSchema.extend({ auth_mech: z.number(), ssh: sshTunnelSchema.optional() }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/**\n * `kds-team.wr-exasol` — no `database`; auth is password OR SaaS personal-access-token\n * (`#refresh_token`), at least one required (both may coexist). Mirrors kbc-ui's\n * `apps/kbc-ui/src/scripts/modules/wr-db/templates/hasValidCredentials.ts`, which drops the\n * `#password` requirement once a `#refresh_token` is present.\n */\nconst exasolBase = z.object({\n  host: z.string(),\n  port: z.number(),\n  user: z.string(),\n  schema: z.string(),\n});\n\nexport const wrExasolSchema = dbConfig(\n  z.union([\n    exasolBase.extend({ '#password': z.string(), '#refresh_token': z.string().optional() }),\n    exasolBase.extend({ '#refresh_token': z.string(), '#password': z.string().optional() }),\n  ]),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `kds-team.wr-firebolt` — no host/port; engine + AWS staging credentials. */\nexport const wrFireboltSchema = dbConfig(\n  z.object({\n    user: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n    aws_api_key_id: z.string(),\n    '#aws_api_key_secret': z.string(),\n    staging_bucket: z.string(),\n    engine_name: z.string().optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, sshTunnelSchema } from '../common';\n\n/** `kds-team.wr-hive-csas` — Hive base + Kerberos auth. */\nexport const wrHiveCsasSchema = dbConfig(\n  dbConnectionSchema.extend({\n    kinitPrincipal: z.string(),\n    servicePrincipal: z.string(),\n    config: z.string(),\n    '#keytab': z.string(),\n    ssh: sshTunnelSchema.optional(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema } from '../common';\n\n/** `keboola.wr-thoughtspot` — SSH tunnel creds carried as top-level fields, not nested. */\nexport const wrThoughtspotSchema = dbConfig(\n  dbConnectionSchema.extend({\n    schema: z.string().optional(),\n    sshUser: z.string(),\n    '#sshPassword': z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig } from '../common';\n\n/** `keboola.wr-sisense` — uses `username` (not `user`). */\nexport const wrSisenseSchema = dbConfig(\n  z.object({\n    host: z.string(),\n    port: z.number(),\n    username: z.string(),\n    '#password': z.string(),\n    database: z.string(),\n  }),\n);\n","import { z } from 'zod';\n\nimport { dbConfig, dbConnectionSchema, forbidden } from '../common';\n\n/**\n * `keboola.wr-db-snowflake` — auth is a union: password OR key-pair (exactly one). The common\n * fields (host/port/user/database/schema/warehouse) are shared; each variant requires its own\n * secret and *forbids the other* (`z.undefined()`), so a config carrying both — or neither —\n * is rejected at runtime and at the type level. Without the `forbidden` half, the variants\n * would be open objects: the extra key is excess (TS allows it) and stripped (Zod accepts it).\n */\nconst snowflakeCommon = dbConnectionSchema\n  .omit({ '#password': true })\n  .extend({ schema: z.string(), warehouse: z.string().optional() });\n\nexport const wrDbSnowflakeSchema = dbConfig(\n  z.union([\n    snowflakeCommon.extend({ '#password': z.string(), '#privateKey': forbidden }),\n    snowflakeCommon.extend({ '#privateKey': z.string(), '#password': forbidden }),\n  ]),\n);\n","import { z } from 'zod';\n\n/** Deep-partial any schema: objects → keys optional (recursing), unions → each member\n *  deep-partialed, anything else left as-is. Lets a union schema (e.g. Snowflake's\n *  password | key-pair auth) still produce a partial input schema. */\nconst partialize = (schema: z.ZodType): z.ZodType => {\n  if (schema instanceof z.ZodObject) return deepPartial(schema);\n  if (schema instanceof z.ZodUnion) {\n    const options = (schema.options as z.ZodType[]).map(partialize);\n    return z.union(options as [z.ZodType, z.ZodType, ...z.ZodType[]]);\n  }\n  return schema;\n};\n\nconst deepPartial = (schema: z.ZodObject): z.ZodObject => {\n  const shape: Record<string, z.ZodType> = {};\n  for (const [key, value] of Object.entries(schema.shape)) {\n    const field = value as z.ZodType;\n    const inner = field instanceof z.ZodOptional ? (field.unwrap() as z.ZodType) : field;\n    shape[key] = partialize(inner);\n  }\n  const partial = z.object(shape).partial();\n  // Preserve the source object's catchall (e.g. a `.loose()` `parameters` block that must let\n  // component-managed keys pass through) — rebuilding via `z.object` would otherwise strip it.\n  return schema.def.catchall ? partial.catchall(schema.def.catchall) : partial;\n};\n\nexport type Registry<M extends Record<string, z.ZodObject>> = {\n  add: <const Id extends string, Schema extends z.ZodObject>(\n    componentId: Id,\n    schema: Schema,\n  ) => Registry<M & Record<Id, Schema>>;\n  get: <Id extends keyof M>(\n    componentId: Id,\n  ) => {\n    /** The component's complete runnable schema (precise per id). */\n    schema: M[Id];\n    /** Its deep-partial — the accepted create/update input. Loose `z.ZodObject` (the precise\n     *  partial type isn't worth deriving; callers get input typing from `schema` via `z.input`). */\n    inputSchema: z.ZodObject;\n  };\n  has: (componentId: string) => boolean;\n};\n\n/** Extracts the registered component-id union from a registry instance type. */\nexport type InferComponentId<R> = R extends Registry<infer M> ? keyof M & string : never;\n\nexport const createRegistry = (): Registry<Record<never, never>> => {\n  const map = new Map<string, z.ZodObject>();\n\n  const registry = {\n    add(componentId: string, schema: z.ZodObject) {\n      map.set(componentId, schema);\n      return registry;\n    },\n    get(componentId: string) {\n      const schema = map.get(componentId);\n      if (!schema) throw new Error(`No configuration registered for component \"${componentId}\".`);\n      return { schema, inputSchema: deepPartial(schema) };\n    },\n    has: (componentId: string) => map.has(componentId),\n  };\n\n  return registry as unknown as Registry<Record<never, never>>;\n};\n","import { ComponentId } from '../../constants/componentId';\n\nimport { appDataGatewaySchema } from './schemas/appDataGatewaySchema';\nimport { appSnowflakeDwhManagerSchema } from './schemas/appSnowflakeDwhManagerSchema';\nimport {\n  exAwsS3Schema,\n  exAzureBlobSchema,\n  exAzureDataLakeSchema,\n  exFtpSchema,\n  exHttpSchema,\n} from './schemas/ex';\nimport {\n  exDbDefaultSchema,\n  exDbFirebirdSchema,\n  exDbInformixSchema,\n  exDbMssqlSchema,\n  exDbMysqlSchema,\n  exDbNetsuiteSchema,\n  exDbOracleAdwSchema,\n  exDbOracleSchema,\n  exDbPgsqlSchema,\n  exDbProgressSchema,\n  exDbSnowflakeSchema,\n  exKdsNetsuiteSchema,\n  exTeradataSchema,\n} from './schemas/exDb';\nimport { gooddataWriterSchema } from './schemas/gooddataWriterSchema';\nimport { exGoogleAdsSchema } from './schemas/googleAdsSchema';\nimport { schedulerSchema } from './schemas/schedulerSchema';\nimport {\n  wrDbDefaultSchema,\n  wrDbImpalaSchema,\n  wrDbMssqlSchema,\n  wrDbOracleAdwSchema,\n  wrDbOracleSchema,\n  wrDbPgsqlSchema,\n  wrDbSnowflakeSchema,\n  wrExasolSchema,\n  wrFireboltSchema,\n  wrHiveCsasSchema,\n  wrRedshiftSchema,\n  wrSisenseSchema,\n  wrSynapseSchema,\n  wrThoughtspotSchema,\n} from './schemas/wrDb';\nimport { createRegistry, type GetRegisteredId } from './createRegistry';\n\nexport const registry = createRegistry()\n  /**\n   * DB writers (`wr-db-*` family + related SaaS targets). Split into the standard writers\n   * built on the shared `parameters.db` connection base and the special-cased targets whose\n   * config diverges (extra auth, no host/port, or a provisioned workspace).\n   */\n\n  // Standard writers — host/port/user/#password/database, plus per-driver extras (schema, ssh…).\n  .add(ComponentId.WR_DB_MYSQL, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_PGSQL, wrDbPgsqlSchema)\n  .add(ComponentId.WR_PAIRITY, wrDbPgsqlSchema) // pgsql variant\n  .add(ComponentId.WR_DB_ORACLE, wrDbOracleSchema)\n  .add(ComponentId.WR_DB_ORACLE_ADW, wrDbOracleAdwSchema) // oracle + Autonomous Database wallet\n  .add(ComponentId.WR_DB_SNOWFLAKE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_DB_SNOWFLAKE_GCS_S3, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_SNOWFLAKE_BLOB_STORAGE, wrDbSnowflakeSchema)\n  .add(ComponentId.WR_LOOKER_V2, wrDbSnowflakeSchema) // legacy snowflake\n  .add(ComponentId.WR_SYNAPSE, wrSynapseSchema)\n  .add(ComponentId.WR_REDSHIFT, wrRedshiftSchema)\n  .add(ComponentId.WR_DB_MSSQL, wrDbMssqlSchema)\n  .add(ComponentId.WR_DB_HIVE, wrDbDefaultSchema)\n  .add(ComponentId.WR_DB_IMPALA, wrDbImpalaSchema)\n\n  // Special-cased targets — diverging auth or credential shape.\n  .add(ComponentId.WR_HIVE_CSAS, wrHiveCsasSchema) // Kerberos auth\n  .add(ComponentId.WR_THOUGHTSPOT, wrThoughtspotSchema) // top-level SSH creds\n  .add(ComponentId.WR_EXASOL, wrExasolSchema)\n  .add(ComponentId.WR_FIREBOLT, wrFireboltSchema)\n  .add(ComponentId.WR_SISENSE, wrSisenseSchema)\n  .add(ComponentId.APP_DATA_GATEWAY, appDataGatewaySchema) // provisioned workspace, no creds\n  .add(ComponentId.SCHEDULER, schedulerSchema)\n\n  // App-specific writers — bespoke credential blocks.\n  .add(ComponentId.APP_SNOWFLAKE_DWH_MANAGER, appSnowflakeDwhManagerSchema)\n  .add(ComponentId.GOODDATA_WRITER, gooddataWriterSchema)\n\n  /**\n   * DB extractors (`ex-db-*` family) — same `parameters.db` credentials as the writers above.\n   * Split into the generic-credentials drivers that reuse `exDbDefaultSchema` and the drivers\n   * whose credentials diverge enough to need their own schema.\n   */\n\n  // Default credentials — host/port/user/#password/database + optional SSH tunnel.\n  .add(ComponentId.EX_DB_REDSHIFT, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_DB2_BATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_MSSQL_CDATA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_IMPALA, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS, exDbDefaultSchema)\n  .add(ComponentId.EX_DB_HIVE_CSAS_TEST, exDbDefaultSchema)\n\n  // Driver-specific credentials — extra/renamed fields or different SSH tunnel / SSL support.\n  .add(ComponentId.EX_DB_PGSQL, exDbPgsqlSchema) // generic creds + SSL\n  .add(ComponentId.EX_DB_MYSQL, exDbMysqlSchema)\n  .add(ComponentId.EX_DB_MSSQL, exDbMssqlSchema)\n  .add(ComponentId.EX_DB_ORACLE, exDbOracleSchema)\n  .add(ComponentId.EX_DB_ORACLE_ADW, exDbOracleAdwSchema) // oracle + Autonomous Database wallet\n  .add(ComponentId.EX_DB_SNOWFLAKE, exDbSnowflakeSchema)\n  .add(ComponentId.EX_DB_FIREBIRD, exDbFirebirdSchema)\n  .add(ComponentId.EX_DB_NETSUITE, exDbNetsuiteSchema)\n  .add(ComponentId.EX_DB_INFORMIX, exDbInformixSchema)\n  .add(ComponentId.EX_TERADATA, exTeradataSchema)\n  .add(ComponentId.KDS_EX_NETSUITE, exKdsNetsuiteSchema)\n  .add(ComponentId.KDS_EX_PROGRESS_DB, exDbProgressSchema) // generic creds, no SSH/SSL\n  // Google (OAuth) components\n  .add(ComponentId.EX_GOOGLE_ADS, exGoogleAdsSchema)\n\n  /**\n   * File/connection extractors (`ex` family) — no shared credential base; each has its own\n   * connection/credentials shape, so each is its own schema (ftp-csas reuses ftp).\n   */\n  .add(ComponentId.EX_HTTP, exHttpSchema)\n  .add(ComponentId.EX_FTP, exFtpSchema)\n  .add(ComponentId.EX_FTP_CSAS, exFtpSchema) // same shape as ftp\n  .add(ComponentId.EX_AWS_S3, exAwsS3Schema)\n  .add(ComponentId.KDS_EX_AZURE_BLOB_STORAGE_V2, exAzureBlobSchema)\n  .add(ComponentId.KDS_EX_AZURE_DATA_LAKE_GEN2, exAzureDataLakeSchema);\n\nexport type RegisteredComponentId = GetRegisteredId<typeof registry>;\n","import type { z } from 'zod';\n\nimport type { createEncryptionClient } from '../../clients/encryption/encryptionClient';\nimport type * as storage from '../../clients/storage';\nimport type {\n  BaseComponentConfig,\n  ConfigurationPath,\n  CreateConfigurationInput,\n  UpdateConfigurationInput,\n} from '../../clients/storage/types';\nimport type { BranchRefs } from '../../domain/branchRefs';\nimport {\n  assertCanCreateConfiguration,\n  assertCanUpdateConfiguration,\n} from '../../domain/permissions/configurations';\nimport type { Project } from '../../domain/project';\nimport { isEmptyDeep } from '../../utils/isEmptyDeep';\nimport { schemaGuidedMerge } from '../../utils/schemaGuidedMerge';\n\nimport { type RegisteredComponentId, registry } from './registry';\n\ntype ConfigurationSdkContext = {\n  project: Project;\n  branchRefs: BranchRefs;\n};\n\ntype Options = {\n  storageClient: ReturnType<typeof storage.createStorageClient>;\n  encryptionClient: ReturnType<typeof createEncryptionClient>;\n  context: ConfigurationSdkContext;\n};\n\ntype DeepPartial<T> = T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;\n\ntype ConfigurationSchema<ComponentId extends RegisteredComponentId> = z.input<\n  ReturnType<typeof registry.get<ComponentId>>['schema']\n>;\n\ntype TypedConfiguration<ComponentId extends RegisteredComponentId> = {\n  componentId: ComponentId;\n  configuration: DeepPartial<ConfigurationSchema<ComponentId>>;\n};\n\n/**\n * How an update writes the patch against the stored configuration:\n * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are\n *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.\n * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,\n *   e.g. `storage`, is gone.\n */\ntype UpdateMode = 'merge' | 'replace';\n\nconst toConfigResult = <ComponentId extends RegisteredComponentId>(\n  data: BaseComponentConfig,\n  schema: z.ZodType,\n) => {\n  const result = schema.safeParse(data.configuration);\n\n  return {\n    data: data as BaseComponentConfig<ConfigurationSchema<ComponentId>>,\n    runnable: result.success,\n    error: result.error,\n  };\n};\n\nexport const createConfigurationSdk = ({ storageClient, encryptionClient, context }: Options) => {\n  const _encrypt = async (\n    componentId: RegisteredComponentId,\n    data: Record<string, unknown>,\n  ): Promise<Record<string, unknown>> => {\n    if (isEmptyDeep(data)) return data;\n\n    return encryptionClient.encryptScopedSecrets({\n      scope: 'ProjectSecure',\n      componentId,\n      projectId: context.project.sapiToken.owner.id,\n      data,\n    });\n  };\n\n  const getConfiguration = async <ComponentId extends RegisteredComponentId>(\n    path: ConfigurationPath<ComponentId>,\n  ) => {\n    const data = await storageClient.configurations.getConfiguration(path);\n    const def = registry.get(path.componentId);\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const createConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<CreateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId>,\n  ) => {\n    const { componentId, branchId, configuration, ...rest } = input;\n    assertCanCreateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.branchRefs.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    const data = await storageClient.configurations.createConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configuration: encrypted,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  const updateConfiguration = async <ComponentId extends RegisteredComponentId>(\n    input: Omit<UpdateConfigurationInput<ComponentId>, 'componentId' | 'configuration'> &\n      TypedConfiguration<ComponentId> & { mode?: UpdateMode },\n  ) => {\n    const { componentId, branchId, configId, configuration, mode = 'merge', ...rest } = input;\n    assertCanUpdateConfiguration(context.project.sapiToken, {\n      isDevModeActive: context.branchRefs.isDev(branchId),\n    });\n    const def = registry.get(componentId);\n\n    const validated = def.inputSchema.parse(configuration);\n    const encrypted = await _encrypt(componentId, validated);\n\n    let newConfiguration: Record<string, unknown> = encrypted;\n    if (mode === 'merge') {\n      const original = await storageClient.configurations.getConfiguration({\n        componentId,\n        branchId,\n        configId,\n      });\n      newConfiguration = schemaGuidedMerge(def.schema, original.configuration ?? {}, encrypted);\n    }\n\n    const { configuration: data } = await storageClient.configurations.updateConfiguration({\n      ...rest,\n      branchId,\n      componentId,\n      configId,\n      configuration: newConfiguration,\n    });\n\n    return toConfigResult<ComponentId>(data, def.schema);\n  };\n\n  return { getConfiguration, createConfiguration, updateConfiguration };\n};\n"],"mappings":";;;;;;;;;;AAOA,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO,EACnB,IAAI,EAAE,OAAO,EACX,aAAa,EAAE,OAAO,EACxB,CAAC,EACH,CAAC,EACH,CAAC;;;ACVD,MAAa,YAAkC,OAC7C,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;;;;;;;;ACI3C,MAAa,qBAAqB,EAAE,OAAO;CACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,MAAM;CAChC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe;AAC/C,CAAC;;;;;;;;;ACLD,MAAa,YAAY,EAAE,UAAU,CAAC,CAAC,SAAS;;;;;;;ACFhD,MAAa,2BAA2B,EAAE,OAAO,EAC/C,WAAW,EAAE,OAAO;CAClB,IAAI,EAAE,OAAO;CACb,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;AAC/B,CAAC,EACH,CAAC;;ACVD,MAAa,kBAAkB,EAAE,OAAO;CACtC,SAAS,EAAE,QAAQ;CACnB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,MAAM,EACH,OAAO;EACN,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;ACZD,MAAa,YAAY,EAAE,OAAO;CAChC,SAAS,EAAE,QAAQ;CACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC;;;;;;;;ACAD,MAAM,gBAAgB,EAAE,OAAO;CAC7B,aAAa,EAAE,OAAO;CACtB,aAAa,EAAE,OAAO;CACtB,iBAAiB,EAAE,OAAO;CAC1B,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAa,+BAA+B,EAAE,OAAO,EACnD,YAAY,EAAE,MAAM,CAClB,cAAc,OAAO;CAAE,oBAAoB,EAAE,OAAO;CAAG,uBAAuB;AAAU,CAAC,GACzF,cAAc,OAAO;CAAE,uBAAuB,EAAE,OAAO;CAAG,oBAAoB;AAAU,CAAC,CAC3F,CAAC,EACH,CAAC;;;ACfD,MAAM,qBAAqB,EACxB,OAAO;CACN,WAAW,EAAE,QAAQ,aAAa;CAClC,aAAa,EAAE,OAAO;CACtB,oBAAoB,EAAE,OAAO;CAC7B,WAAW;CACX,UAAU;AACZ,CAAC,CAAC,CACD,MAAM;;AAGT,MAAM,cAAc,EACjB,OAAO;CACN,WAAW,EAAE,QAAQ,MAAM;CAC3B,WAAW,EAAE,OAAO;CACpB,UAAU,EAAE,OAAO;CACnB,aAAa;CACb,oBAAoB;AACtB,CAAC,CAAC,CACD,MAAM;;;;;;;;AAST,MAAa,gBAAgB,EAC1B,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,oBAAoB,WAAW,CAAC,EACvD,CAAC,CAAC,CACD,MAAM;;;;;;;AChCT,MAAa,oBAAoB,EAC9B,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;;;;;ACVT,MAAa,wBAAwB,EAClC,OAAO,EACN,YAAY,EACT,OAAO;CACN,cAAc,EAAE,OAAO;CACvB,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO;AACxB,CAAC,CAAC,CACD,MAAM,EACX,CAAC,CAAC,CACD,MAAM;;;ACZT,MAAM,gBAAgB,EAAE,OAAO;CAC7B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,gBAAgB,EAAE,KAAK;EAAC;EAAO;EAAQ;CAAM,CAAC;CAC9C,UAAU,EAAE,OAAO;CACnB,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,KAAK,gBAAgB,SAAS;CAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;;AAID,MAAM,kBAAkB,cACrB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,CAAC,CAC7D,MAAM;;AAGT,MAAM,oBAAoB,cACvB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAAC,CAC7D,MAAM;;;;;;;;;AAUT,MAAa,cAAc,EACxB,OAAO,EACN,YAAY,EAAE,MAAM,CAAC,iBAAiB,iBAAiB,CAAC,EAC1D,CAAC,CAAC,CACD,MAAM;;;;;;;;AC/BT,MAAa,eAAe,EACzB,OAAO,EACN,YAAY,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CAAC,CAAC,MAAM,EAC3F,CAAC,CAAC,CACD,MAAM;;;;;;;;ACJT,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,CAC/D;;;ACPA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;ACFA,MAAa,qBAAqB,SAAS,kBAAkB;;;ACE7D,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,2BAA2B,EACxB,KAAK;EAAC;EAAmB;EAAkB;EAAoB;CAAc,CAAC,CAAC,CAC/E,SAAS;CACZ,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACzC,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;ACVA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,KAAK,gBAAgB,SAAS;CAC9B,KAAK,UAAU,SAAS;AAC1B,CAAC,CACH;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;;;;;ACLA,MAAa,sBAAsB,SACjC,mBAAmB,KAAK;CAAE,MAAM;CAAM,MAAM;CAAM,UAAU;AAAK,CAAC,CAAC,CAAC,OAAO;CACzE,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,mBAAmB,EAAE,OAAO,CAAC,CAAC,SAAS;CACvC,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;CAC5D,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACfA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,MAAM,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO;AAAE,CAAC,CAC5E;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC/D;;;ACFA,MAAa,qBAAqB,SAChC,mBAAmB,OAAO;CACxB,YAAY,EAAE,OAAO;CACrB,UAAU,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;CACzC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;AAChC,CAAC,CACH;;;;;;;;ACDA,MAAMA,oBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE7E,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACNA,kBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5EA,kBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;ACdA,MAAa,qBAAqB,SAChC,EAAE,OAAO;CACP,WAAW,EAAE,OAAO;CACpB,QAAQ,EAAE,OAAO;CACjB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;AAGA,MAAa,sBAAsB,SACjC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,eAAe,CAAC;CAC5D,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;AACxB,CAAC,CACH;;;;;;;;;;ACfA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,MAAM,EAAE,KAAK;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;CACxB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,UAAU,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAW;EAAO;CAAS,CAAC,CAAC,CAAC,SAAS;CAC3E,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqB,EAAE,OAAO,CAAC,CAAC,SAAS;AAC3C,CAAC;;;AAID,MAAM,gBAAgB,EAAE,OAAO;CAC7B,OAAO,EAAE,OAAO;CAChB,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc;AAC9C,CAAC;;;AAID,MAAM,oBAAoB,EAAE,OAAO;CACjC,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;AAClC,CAAC;;;;;;;;;AAUD,MAAa,uBAAuB,EAAE,OAAO,EAC3C,YAAY,EAAE,OAAO;CACnB,SAAS,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAAE,CAAC;CACxE,MAAM,EAAE,OAAO;EAAE,OAAO,EAAE,OAAO;EAAG,aAAa,EAAE,OAAO;CAAE,CAAC;CAC7D,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS;CACrD,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,SAAS;AAC/D,CAAC,EACH,CAAC;;;ACjED,MAAa,oBAAoB,EAAE,OAAO;CACxC,eAAe;CACf,YAAY,EAAE,OAAO;EACnB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;EAC9B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;EAC3C,mBAAmB,EAAE,QAAQ,CAAC,CAAC,SAAS;EACxC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC3C,CAAC;AACH,CAAC;;;;;;;;ACLD,MAAa,kBAAkB,EAAE,OAAO;CACtC,UAAU,EAAE,OAAO;EACjB,SAAS,EAAE,OAAO;EAGlB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,OAAO,EAAE,KAAK,CAAC,WAAW,UAAU,CAAC;CACvC,CAAC;CACD,QAAQ,EAAE,OAAO;EACf,aAAa,EAAE,OAAO;EACtB,iBAAiB,EAAE,OAAO;EAC1B,MAAM,EAAE,QAAQ,KAAK;CACvB,CAAC;AACH,CAAC;;;;;;;ACdD,MAAa,oBAAoB,SAC/B,mBAAmB,OAAO;CAAE,KAAK,gBAAgB,SAAS;CAAG,KAAK,UAAU,SAAS;AAAE,CAAC,CAC1F;;;ACJA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CAC9F;;;;;;;;;;ACKA,MAAM,iBAAiB,mBAAmB,OAAO;CAC/C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,KAAK,gBAAgB,SAAS;CAC9B,mBAAmB,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS;CAC1C,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS;AACvC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;CAChC,mBAAmB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,qBAAqB;CACnE,cAAc,EACX,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAClC,SAAS,CAAC,CACV,SAAS,gBAAgB;CAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS,UAAU;CAC3C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS;AAC/B,CAAC;AAED,MAAa,sBAAsB,SAAS,EAAE,MAAM,CAAC,gBAAgB,gBAAgB,CAAC,CAAC;;;AC3BvF,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAC7D;;;ACFA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACnF;;;ACFA,MAAa,kBAAkB,SAC7B,mBAAmB,OAAO;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,YAAY,EAAE,KAAK;EAAC;EAAO;EAAO;EAAO;EAAO;CAAK,CAAC;CACtD,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACNA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CAAE,WAAW,EAAE,OAAO;CAAG,KAAK,gBAAgB,SAAS;AAAE,CAAC,CACtF;;;;;;;;ACGA,MAAM,aAAa,EAAE,OAAO;CAC1B,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,MAAa,iBAAiB,SAC5B,EAAE,MAAM,CACN,WAAW,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,GACtF,WAAW,OAAO;CAAE,kBAAkB,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC,CACxF,CAAC,CACH;;;ACjBA,MAAa,mBAAmB,SAC9B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;CACnB,gBAAgB,EAAE,OAAO;CACzB,uBAAuB,EAAE,OAAO;CAChC,gBAAgB,EAAE,OAAO;CACzB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH;;;ACVA,MAAa,mBAAmB,SAC9B,mBAAmB,OAAO;CACxB,gBAAgB,EAAE,OAAO;CACzB,kBAAkB,EAAE,OAAO;CAC3B,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,OAAO;CACpB,KAAK,gBAAgB,SAAS;AAChC,CAAC,CACH;;;ACRA,MAAa,sBAAsB,SACjC,mBAAmB,OAAO;CACxB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,SAAS,EAAE,OAAO;CAClB,gBAAgB,EAAE,OAAO;AAC3B,CAAC,CACH;;;ACNA,MAAa,kBAAkB,SAC7B,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO;CACf,UAAU,EAAE,OAAO;CACnB,aAAa,EAAE,OAAO;CACtB,UAAU,EAAE,OAAO;AACrB,CAAC,CACH;;;;;;;;;ACFA,MAAM,kBAAkB,mBACrB,KAAK,EAAE,aAAa,KAAK,CAAC,CAAC,CAC3B,OAAO;CAAE,QAAQ,EAAE,OAAO;CAAG,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAElE,MAAa,sBAAsB,SACjC,EAAE,MAAM,CACN,gBAAgB,OAAO;CAAE,aAAa,EAAE,OAAO;CAAG,eAAe;AAAU,CAAC,GAC5E,gBAAgB,OAAO;CAAE,eAAe,EAAE,OAAO;CAAG,aAAa;AAAU,CAAC,CAC9E,CAAC,CACH;;;;;ACfA,MAAM,cAAc,WAAiC;CACnD,IAAI,kBAAkB,EAAE,WAAW,OAAO,YAAY,MAAM;CAC5D,IAAI,kBAAkB,EAAE,UAAU;EAChC,MAAM,UAAW,OAAO,QAAwB,IAAI,UAAU;EAC9D,OAAO,EAAE,MAAM,OAAiD;CAClE;CACA,OAAO;AACT;AAEA,MAAM,eAAe,WAAqC;CACxD,MAAM,QAAmC,CAAC;CAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,KAAK,GAAG;EACvD,MAAM,QAAQ;EACd,MAAM,QAAQ,iBAAiB,EAAE,cAAe,MAAM,OAAO,IAAkB;EAC/E,MAAM,OAAO,WAAW,KAAK;CAC/B;CACA,MAAM,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,QAAQ;CAGxC,OAAO,OAAO,IAAI,WAAW,QAAQ,SAAS,OAAO,IAAI,QAAQ,IAAI;AACvE;AAsBA,MAAa,uBAAuD;CAClE,MAAM,sBAAM,IAAI,IAAyB;CAEzC,MAAM,WAAW;EACf,IAAI,aAAqB,QAAqB;GAC5C,IAAI,IAAI,aAAa,MAAM;GAC3B,OAAO;EACT;EACA,IAAI,aAAqB;GACvB,MAAM,SAAS,IAAI,IAAI,WAAW;GAClC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,8CAA8C,YAAY,GAAG;GAC1F,OAAO;IAAE;IAAQ,aAAa,YAAY,MAAM;GAAE;EACpD;EACA,MAAM,gBAAwB,IAAI,IAAI,WAAW;CACnD;CAEA,OAAO;AACT;;ACjBA,MAAa,WAAW,eAAe,CAAC,CAQrC,IAAI,YAAY,aAAa,iBAAiB,CAAC,CAC/C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,kBAAkB,mBAAmB,CAAC,CACtD,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,qBAAqB,mBAAmB,CAAC,CACzD,IAAI,YAAY,wBAAwB,mBAAmB,CAAC,CAC5D,IAAI,YAAY,2BAA2B,mBAAmB,CAAC,CAC/D,IAAI,YAAY,cAAc,mBAAmB,CAAC,CAClD,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAG/C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,gBAAgB,mBAAmB,CAAC,CACpD,IAAI,YAAY,WAAW,cAAc,CAAC,CAC1C,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,YAAY,eAAe,CAAC,CAC5C,IAAI,YAAY,kBAAkB,oBAAoB,CAAC,CACvD,IAAI,YAAY,WAAW,eAAe,CAAC,CAG3C,IAAI,YAAY,2BAA2B,4BAA4B,CAAC,CACxE,IAAI,YAAY,iBAAiB,oBAAoB,CAAC,CAStD,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,WAAW,iBAAiB,CAAC,CAC7C,IAAI,YAAY,gBAAgB,iBAAiB,CAAC,CAClD,IAAI,YAAY,mBAAmB,iBAAiB,CAAC,CACrD,IAAI,YAAY,cAAc,iBAAiB,CAAC,CAChD,IAAI,YAAY,YAAY,iBAAiB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,iBAAiB,CAAC,CACnD,IAAI,YAAY,sBAAsB,iBAAiB,CAAC,CAGxD,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,aAAa,eAAe,CAAC,CAC7C,IAAI,YAAY,cAAc,gBAAgB,CAAC,CAC/C,IAAI,YAAY,kBAAkB,mBAAmB,CAAC,CACtD,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,gBAAgB,kBAAkB,CAAC,CACnD,IAAI,YAAY,aAAa,gBAAgB,CAAC,CAC9C,IAAI,YAAY,iBAAiB,mBAAmB,CAAC,CACrD,IAAI,YAAY,oBAAoB,kBAAkB,CAAC,CAEvD,IAAI,YAAY,eAAe,iBAAiB,CAAC,CAMjD,IAAI,YAAY,SAAS,YAAY,CAAC,CACtC,IAAI,YAAY,QAAQ,WAAW,CAAC,CACpC,IAAI,YAAY,aAAa,WAAW,CAAC,CACzC,IAAI,YAAY,WAAW,aAAa,CAAC,CACzC,IAAI,YAAY,8BAA8B,iBAAiB,CAAC,CAChE,IAAI,YAAY,6BAA6B,qBAAqB;;ACzErE,MAAM,kBACJ,MACA,WACG;CACH,MAAM,SAAS,OAAO,UAAU,KAAK,aAAa;CAElD,OAAO;EACC;EACN,UAAU,OAAO;EACjB,OAAO,OAAO;CAChB;AACF;AAEA,MAAa,0BAA0B,EAAE,eAAe,kBAAkB,cAAuB;CAC/F,MAAM,WAAW,OACf,aACA,SACqC;EACrC,IAAI,YAAY,IAAI,GAAG,OAAO;EAE9B,OAAO,iBAAiB,qBAAqB;GAC3C,OAAO;GACP;GACA,WAAW,QAAQ,QAAQ,UAAU,MAAM;GAC3C;EACF,CAAC;CACH;CAEA,MAAM,mBAAmB,OACvB,SACG;EACH,MAAM,OAAO,MAAM,cAAc,eAAe,iBAAiB,IAAI;EACrE,MAAM,MAAM,SAAS,IAAI,KAAK,WAAW;EAEzC,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,eAAe,GAAG,SAAS;EAC1D,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,WAAW,MAAM,QAAQ,EACpD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EACpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,MAAM,OAAO,MAAM,cAAc,eAAe,oBAAoB;GAClE,GAAG;GACH;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,MAAM,sBAAsB,OAC1B,UAEG;EACH,MAAM,EAAE,aAAa,UAAU,UAAU,eAAe,OAAO,SAAS,GAAG,SAAS;EACpF,6BAA6B,QAAQ,QAAQ,WAAW,EACtD,iBAAiB,QAAQ,WAAW,MAAM,QAAQ,EACpD,CAAC;EACD,MAAM,MAAM,SAAS,IAAI,WAAW;EAEpC,MAAM,YAAY,IAAI,YAAY,MAAM,aAAa;EACrD,MAAM,YAAY,MAAM,SAAS,aAAa,SAAS;EAEvD,IAAI,mBAA4C;EAChD,IAAI,SAAS,SAAS;GACpB,MAAM,WAAW,MAAM,cAAc,eAAe,iBAAiB;IACnE;IACA;IACA;GACF,CAAC;GACD,mBAAmB,kBAAkB,IAAI,QAAQ,SAAS,iBAAiB,CAAC,GAAG,SAAS;EAC1F;EAEA,MAAM,EAAE,eAAe,SAAS,MAAM,cAAc,eAAe,oBAAoB;GACrF,GAAG;GACH;GACA;GACA;GACA,eAAe;EACjB,CAAC;EAED,OAAO,eAA4B,MAAM,IAAI,MAAM;CACrD;CAEA,OAAO;EAAE;EAAkB;EAAqB;CAAoB;AACtE"}

package/dist/sdk/dataAppServer/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_createFetchClient = require("../../createFetchClient-CDKSkd7i.cjs");
-const require_storage = require("../../storage-BMrYlyLB.cjs");
+const require_storage = require("../../storage-jLhVrKZh.cjs");
 const require_RowLevelSecurityError = require("../../RowLevelSecurityError-RK_NhhAx.cjs");
 const require_transientRetries = require("../../transientRetries-CBorl4Ue.cjs");
 const require_isPlainObject = require("../../isPlainObject-CcvQt0qB.cjs");

package/dist/sdk/dataAppServer/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isRowLevelSecurityError","HttpStatus","APP_USER_TOKEN_HEADER","readJwtClaims","AsyncLocalStorage","APP_USER_TOKEN_HEADER","cellParser","createQueryServiceSdk","createQueryServiceClient","isRowLevelSecurityError","readFile","isPlainObject","createStorageClient","ServiceId","lazy"],"sources":["../../../src/sdks/dataAppServer/express.ts","../../../src/sdks/dataAppServer/requestContext.ts","../../../src/sdks/dataAppServer/runQuery.ts","../../../src/sdks/dataAppServer/settings.ts","../../../src/sdks/dataAppServer/initializeApp.ts"],"sourcesContent":["import { isRowLevelSecurityError } from '../../errors';\nimport { HttpStatus } from '../../internal';\n\ntype ErrorResponse = {\n  headersSent: boolean;\n  status(code: number): { json(body: unknown): unknown };\n};\n\n/** Answers a row-level security refusal with 403 and passes any other error on. */\nexport const createExpressErrorHandler =\n  () => (err: unknown, _req: unknown, res: ErrorResponse, next: (err?: unknown) => void) => {\n    if (res.headersSent || !isRowLevelSecurityError(err)) {\n      next(err);\n      return;\n    }\n    res.status(HttpStatus.FORBIDDEN).json({ error: err.message, code: 'ROW_LEVEL_SECURITY' });\n  };\n","import { AsyncLocalStorage } from 'node:async_hooks';\n\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { readJwtClaims } from '../../utils/readJwtClaims';\n\ntype NodeHeaders = Record<string, string | string[] | undefined>;\n\ntype HeadersLike = { get(name: string): string | null };\n\n/** A Fetch `Request` or `Headers`, or a Node request (Express, Fastify) with its lower-case `headers`. */\nexport type AppRequest = HeadersLike | { headers: HeadersLike | NodeHeaders };\n\n/** The signed-in user as the app user token names them; `email` only when the IdP verified it. */\nexport type AppUser = { idp: string; sub: string; email?: string };\n\ntype Scope = { appUserToken: string | undefined; user: AppUser | undefined };\n\nexport type RequestContext = ReturnType<typeof createRequestContext>;\n\nconst isHeadersLike = (headers: object): headers is HeadersLike =>\n  'get' in headers && typeof headers.get === 'function';\n\nconst appUserTokenOf = (request: AppRequest): string | undefined => {\n  const headers = 'headers' in request ? request.headers : request;\n  if (isHeadersLike(headers)) return headers.get(APP_USER_TOKEN_HEADER) || undefined;\n  const value = headers[APP_USER_TOKEN_HEADER.toLowerCase()];\n  return (Array.isArray(value) ? value[0] : value) || undefined;\n};\n\nconst userOf = (token: string): AppUser | undefined => {\n  const { idp, sub, email } = readJwtClaims(token) ?? {};\n  if (typeof idp !== 'string' || typeof sub !== 'string' || !idp || !sub) return undefined;\n  return typeof email === 'string' && email ? { idp, sub, email } : { idp, sub };\n};\n\n/**\n * The signed-in user of the request being handled, kept across every `await` the request makes.\n *\n * - Work the request starts keeps its user: a timer, a promise cached at module level, a listener.\n * - `currentUser()` reads the token payload unverified: safe only behind Keboola's apps proxy.\n * - `currentUserKey()` is the same for every token of one user (`idp` + `sub`): a per-user cache key.\n */\nexport const createRequestContext = () => {\n  const storage = new AsyncLocalStorage<Scope>();\n  const current = () => storage.getStore();\n\n  return {\n    runWithRequest: <T>(request: AppRequest, fn: () => T): T => {\n      const appUserToken = appUserTokenOf(request);\n      return storage.run(\n        { appUserToken, user: appUserToken ? userOf(appUserToken) : undefined },\n        fn,\n      );\n    },\n    current,\n    currentUser: () => current()?.user,\n    currentUserKey: () => {\n      const user = current()?.user;\n      return user && JSON.stringify([user.idp, user.sub]);\n    },\n  };\n};\n","import { createQueryServiceClient, type QueryServiceCredential } from '../../clients/queryService';\nimport type { QueryResult } from '../../clients/queryService/types';\nimport { isRowLevelSecurityError } from '../../errors';\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { cellParser, createQueryServiceSdk, type ExecuteQueryOptions } from '../queryService';\n\nimport type { RequestContext } from './requestContext';\nimport type { Settings } from './settings';\n\nexport type RunQueryOptions = Pick<ExecuteQueryOptions, 'timeout' | 'maxRows' | 'signal'>;\n\nconst PAGE_SIZE = 10_000;\nconst TIMEOUT = 60_000;\n\nconst refusalWarning = (scope: ReturnType<RequestContext['current']>) => {\n  const prefix = '[dataAppServer] row-level security refused';\n  if (scope?.appUserToken) return `${prefix} the query for this user`;\n  const reason = scope\n    ? 'the request has none'\n    : 'it ran outside a user request (startup, timer, background job)';\n  return `${prefix} a query sent without ${APP_USER_TOKEN_HEADER}: ${reason}`;\n};\n\nconst toRecords = ({ columns = [], data = [], numberOfRows }: QueryResult, capped: boolean) => {\n  const parsers = columns.map(({ name, type }) => ({\n    key: name.toLowerCase(),\n    parse: cellParser(type),\n  }));\n  const keys = new Set<string>();\n  for (const { key } of parsers) {\n    if (keys.has(key))\n      throw new Error(`runQuery: two columns are named \"${key}\"; alias one with AS`);\n    keys.add(key);\n  }\n  const rows = data.map((row) => {\n    const record: Record<string, unknown> = {};\n    parsers.forEach(({ key, parse }, i) => {\n      const cell = row[i];\n      record[key] = cell == null ? null : parse(cell);\n    });\n    return record;\n  });\n  if (!capped && numberOfRows !== undefined && rows.length < numberOfRows) {\n    throw new Error(`runQuery: got ${rows.length} of ${numberOfRows} rows`);\n  }\n  return rows;\n};\n\n/**\n * Runs one SQL statement in the app's workspace and resolves every row as a record.\n *\n * - Sends the request's user token with the app's Storage token; without a user, the Storage token.\n * - A repeated column name, or fewer rows than counted (no `maxRows`), throws instead of losing data.\n */\nexport const createRunQuery = (settings: Settings, requestContext: RequestContext) => {\n  const queryService = createQueryServiceSdk({\n    queryServiceClient: createQueryServiceClient({\n      baseUrl: settings.queryServiceUrl,\n      auth: async (): Promise<QueryServiceCredential> => {\n        const storageToken = await settings.storageToken();\n        const appUserToken = requestContext.current()?.appUserToken;\n        return appUserToken\n          ? { type: 'app-user-token', token: appUserToken, storageToken }\n          : { type: 'sapi-token', token: storageToken };\n      },\n    }),\n  });\n\n  return async (sql: string, options: RunQueryOptions = {}): Promise<Record<string, unknown>[]> => {\n    const scope = requestContext.current();\n    const [result] = await queryService\n      .executeQuery(\n        settings.branchId(),\n        await settings.workspaceId(),\n        { statements: [sql], transactional: false },\n        { ...options, pageSize: PAGE_SIZE, timeout: options.timeout ?? TIMEOUT },\n      )\n      .catch((error: unknown) => {\n        if (isRowLevelSecurityError(error)) console.warn(refusalWarning(scope));\n        throw error;\n      });\n    return result ? toRecords(result, options.maxRows !== undefined) : [];\n  };\n};\n","import { readFile } from 'node:fs/promises';\n\nimport { createStorageClient } from '../../clients/storage';\nimport { ServiceId } from '../../constants/serviceIds';\nimport { lazy } from '../../utils/async';\nimport { isPlainObject } from '../../utils/isPlainObject';\n\nexport type Env = Record<string, string | undefined>;\n\n/** A setting the app needs is missing or unreadable; the message names the variable or file. */\nexport class AppConfigError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'AppConfigError';\n  }\n}\n\nexport type Settings = ReturnType<typeof createSettings>;\n\nconst STACK_INDEX_TIMEOUT = 10_000;\n\nconst required = (env: Env, name: string) => {\n  const value = env[name];\n  if (!value) throw new AppConfigError(`Missing environment variable ${name}`);\n  return value;\n};\n\nconst storageTokenFrom = async (env: Env) => {\n  const file = env.STORAGE_API_TOKEN_PATH;\n  if (!file) {\n    if (env.KBC_TOKEN) return env.KBC_TOKEN;\n    throw new AppConfigError('Missing Storage token: set STORAGE_API_TOKEN_PATH or KBC_TOKEN');\n  }\n  const content = await readFile(file, 'utf8').catch((error: unknown) => {\n    throw new AppConfigError(`Cannot read the file in STORAGE_API_TOKEN_PATH: ${file}`, {\n      cause: error,\n    });\n  });\n  const token = content.trim();\n  if (!token)\n    throw new AppConfigError(`The token file in STORAGE_API_TOKEN_PATH is empty: ${file}`);\n  return token;\n};\n\nconst manifestWorkspaceId = async (file: string) => {\n  let manifest: unknown;\n  try {\n    manifest = JSON.parse(await readFile(file, 'utf8'));\n  } catch (error) {\n    throw new AppConfigError(`Cannot read the JSON in KBC_WORKSPACE_MANIFEST_PATH: ${file}`, {\n      cause: error,\n    });\n  }\n  const id = isPlainObject(manifest) ? manifest.workspaceId : undefined;\n  if ((typeof id === 'string' && id) || typeof id === 'number') return String(id);\n  throw new AppConfigError(\n    `The manifest in KBC_WORKSPACE_MANIFEST_PATH has no workspaceId: ${file}`,\n  );\n};\n\nconst queryServiceUrlFromIndex = async (kbcUrl: string, token: string) => {\n  const { services } = await createStorageClient({\n    baseUrl: kbcUrl,\n    auth: { type: 'sapi-token', token },\n  }).getStackInfo({ exclude: 'components' }, AbortSignal.timeout(STACK_INDEX_TIMEOUT));\n  const url = services.find(({ id }) => id === ServiceId.Query)?.url;\n  if (!url) throw new AppConfigError('The stack index of KBC_URL lists no query service');\n  return url;\n};\n\n/**\n * What the platform provides a data app, read on first use; a missing value throws `AppConfigError`.\n *\n * - The Storage token is read on every call: the platform rotates the file in `STORAGE_API_TOKEN_PATH`.\n * - The workspace ID and the Query Service URL are read once per process.\n * - The Query Service URL is `QUERY_SERVICE_URL`, or the stack index of `KBC_URL` (local runs).\n */\nexport const createSettings = (env: Env) => {\n  const storageToken = () => storageTokenFrom(env);\n  const manifest = env.KBC_WORKSPACE_MANIFEST_PATH;\n\n  return {\n    branchId: () => required(env, 'BRANCH_ID'),\n    storageToken,\n    workspaceId: lazy(() =>\n      manifest ? manifestWorkspaceId(manifest) : required(env, 'WORKSPACE_ID'),\n    ),\n    queryServiceUrl: lazy(\n      async () =>\n        env.QUERY_SERVICE_URL ||\n        queryServiceUrlFromIndex(required(env, 'KBC_URL'), await storageToken()),\n    ),\n    hasWorkspace: Boolean(manifest || env.WORKSPACE_ID),\n  };\n};\n","import { createExpressErrorHandler } from './express';\nimport { type AppRequest, createRequestContext } from './requestContext';\nimport { createRunQuery } from './runQuery';\nimport { createSettings, type Env } from './settings';\n\n/** `env` replaces `process.env` (tests, local runs). */\nexport type DataAppServerOptions = { env?: Env };\n\n/**\n * Sets up Keboola access for this data app process; call it once.\n *\n * - Synchronous, no network call, never throws: each setting is read on first use.\n * - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).\n * - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.\n */\nexport const initializeApp = ({ env = process.env }: DataAppServerOptions = {}) => {\n  const settings = createSettings(env);\n  const requestContext = createRequestContext();\n\n  return {\n    server: {\n      runWithRequest: requestContext.runWithRequest,\n      currentUser: requestContext.currentUser,\n      currentUserKey: requestContext.currentUserKey,\n      expressMiddleware: () => (req: AppRequest, _res: unknown, next: () => void) =>\n        requestContext.runWithRequest(req, next),\n      expressErrorHandler: createExpressErrorHandler,\n    },\n    workspace: settings.hasWorkspace\n      ? { runQuery: createRunQuery(settings, requestContext) }\n      : undefined,\n  };\n};\n\nexport type DataAppServer = ReturnType<typeof initializeApp>;\n"],"mappings":";;;;;;;;;;;;;;AASA,MAAa,mCACJ,KAAc,MAAe,KAAoB,SAAkC;CACxF,IAAI,IAAI,eAAe,CAACA,8BAAAA,wBAAwB,GAAG,GAAG;EACpD,KAAK,GAAG;EACR;CACF;CACA,IAAI,OAAOC,0BAAAA,WAAW,SAAS,CAAC,CAAC,KAAK;EAAE,OAAO,IAAI;EAAS,MAAM;CAAqB,CAAC;AAC1F;;ACGF,MAAM,iBAAiB,YACrB,SAAS,WAAW,OAAO,QAAQ,QAAQ;AAE7C,MAAM,kBAAkB,YAA4C;CAClE,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU;CACzD,IAAI,cAAc,OAAO,GAAG,OAAO,QAAQ,IAAA,sBAAyB,KAAK,KAAA;CACzE,MAAM,QAAQ,QAAQC,0BAAAA,sBAAsB,YAAY;CACxD,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,UAAU,KAAA;AACtD;AAEA,MAAM,UAAU,UAAuC;CACrD,MAAM,EAAE,KAAK,KAAK,UAAUC,sBAAAA,cAAc,KAAK,KAAK,CAAC;CACrD,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,CAAC,OAAO,CAAC,KAAK,OAAO,KAAA;CAC/E,OAAO,OAAO,UAAU,YAAY,QAAQ;EAAE;EAAK;EAAK;CAAM,IAAI;EAAE;EAAK;CAAI;AAC/E;;;;;;;;AASA,MAAa,6BAA6B;CACxC,MAAM,UAAU,IAAIC,iBAAAA,kBAAyB;CAC7C,MAAM,gBAAgB,QAAQ,SAAS;CAEvC,OAAO;EACL,iBAAoB,SAAqB,OAAmB;GAC1D,MAAM,eAAe,eAAe,OAAO;GAC3C,OAAO,QAAQ,IACb;IAAE;IAAc,MAAM,eAAe,OAAO,YAAY,IAAI,KAAA;GAAU,GACtE,EACF;EACF;EACA;EACA,mBAAmB,QAAQ,CAAC,EAAE;EAC9B,sBAAsB;GACpB,MAAM,OAAO,QAAQ,CAAC,EAAE;GACxB,OAAO,QAAQ,KAAK,UAAU,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;EACpD;CACF;AACF;;AClDA,MAAM,YAAY;AAClB,MAAM,UAAU;AAEhB,MAAM,kBAAkB,UAAiD;CACvE,MAAM,SAAS;CACf,IAAI,OAAO,cAAc,OAAO,GAAG,OAAO;CAI1C,OAAO,GAAG,OAAO,wBAAwBC,0BAAAA,sBAAsB,IAHhD,QACX,yBACA;AAEN;AAEA,MAAM,aAAa,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,gBAA6B,WAAoB;CAC7F,MAAM,UAAU,QAAQ,KAAK,EAAE,MAAM,YAAY;EAC/C,KAAK,KAAK,YAAY;EACtB,OAAOC,uBAAAA,WAAW,IAAI;CACxB,EAAE;CACF,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,EAAE,SAAS,SAAS;EAC7B,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,oCAAoC,IAAI,qBAAqB;EAC/E,KAAK,IAAI,GAAG;CACd;CACA,MAAM,OAAO,KAAK,KAAK,QAAQ;EAC7B,MAAM,SAAkC,CAAC;EACzC,QAAQ,SAAS,EAAE,KAAK,SAAS,MAAM;GACrC,MAAM,OAAO,IAAI;GACjB,OAAO,OAAO,QAAQ,OAAO,OAAO,MAAM,IAAI;EAChD,CAAC;EACD,OAAO;CACT,CAAC;CACD,IAAI,CAAC,UAAU,iBAAiB,KAAA,KAAa,KAAK,SAAS,cACzD,MAAM,IAAI,MAAM,iBAAiB,KAAK,OAAO,MAAM,aAAa,MAAM;CAExE,OAAO;AACT;;;;;;;AAQA,MAAa,kBAAkB,UAAoB,mBAAmC;CACpF,MAAM,eAAeC,uBAAAA,sBAAsB,EACzC,oBAAoBC,qBAAAA,yBAAyB;EAC3C,SAAS,SAAS;EAClB,MAAM,YAA6C;GACjD,MAAM,eAAe,MAAM,SAAS,aAAa;GACjD,MAAM,eAAe,eAAe,QAAQ,CAAC,EAAE;GAC/C,OAAO,eACH;IAAE,MAAM;IAAkB,OAAO;IAAc;GAAa,IAC5D;IAAE,MAAM;IAAc,OAAO;GAAa;EAChD;CACF,CAAC,EACH,CAAC;CAED,OAAO,OAAO,KAAa,UAA2B,CAAC,MAA0C;EAC/F,MAAM,QAAQ,eAAe,QAAQ;EACrC,MAAM,CAAC,UAAU,MAAM,aACpB,aACC,SAAS,SAAS,GAClB,MAAM,SAAS,YAAY,GAC3B;GAAE,YAAY,CAAC,GAAG;GAAG,eAAe;EAAM,GAC1C;GAAE,GAAG;GAAS,UAAU;GAAW,SAAS,QAAQ,WAAW;EAAQ,CACzE,CAAC,CACA,OAAO,UAAmB;GACzB,IAAIC,8BAAAA,wBAAwB,KAAK,GAAG,QAAQ,KAAK,eAAe,KAAK,CAAC;GACtE,MAAM;EACR,CAAC;EACH,OAAO,SAAS,UAAU,QAAQ,QAAQ,YAAY,KAAA,CAAS,IAAI,CAAC;CACtE;AACF;;;ACzEA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAIA,MAAM,sBAAsB;AAE5B,MAAM,YAAY,KAAU,SAAiB;CAC3C,MAAM,QAAQ,IAAI;CAClB,IAAI,CAAC,OAAO,MAAM,IAAI,eAAe,gCAAgC,MAAM;CAC3E,OAAO;AACT;AAEA,MAAM,mBAAmB,OAAO,QAAa;CAC3C,MAAM,OAAO,IAAI;CACjB,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,WAAW,OAAO,IAAI;EAC9B,MAAM,IAAI,eAAe,gEAAgE;CAC3F;CAMA,MAAM,SAAQ,OAAA,GALQC,iBAAAA,SAAAA,CAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACrE,MAAM,IAAI,eAAe,mDAAmD,QAAQ,EAClF,OAAO,MACT,CAAC;CACH,CAAC,EAAA,CACqB,KAAK;CAC3B,IAAI,CAAC,OACH,MAAM,IAAI,eAAe,sDAAsD,MAAM;CACvF,OAAO;AACT;AAEA,MAAM,sBAAsB,OAAO,SAAiB;CAClD,IAAI;CACJ,IAAI;EACF,WAAW,KAAK,MAAM,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,MAAM,MAAM,CAAC;CACpD,SAAS,OAAO;EACd,MAAM,IAAI,eAAe,wDAAwD,QAAQ,EACvF,OAAO,MACT,CAAC;CACH;CACA,MAAM,KAAKC,sBAAAA,cAAc,QAAQ,IAAI,SAAS,cAAc,KAAA;CAC5D,IAAK,OAAO,OAAO,YAAY,MAAO,OAAO,OAAO,UAAU,OAAO,OAAO,EAAE;CAC9E,MAAM,IAAI,eACR,mEAAmE,MACrE;AACF;AAEA,MAAM,2BAA2B,OAAO,QAAgB,UAAkB;CACxE,MAAM,EAAE,aAAa,MAAMC,gBAAAA,oBAAoB;EAC7C,SAAS;EACT,MAAM;GAAE,MAAM;GAAc;EAAM;CACpC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,aAAa,GAAG,YAAY,QAAQ,mBAAmB,CAAC;CACnF,MAAM,MAAM,SAAS,MAAM,EAAE,SAAS,OAAOC,mBAAAA,UAAU,KAAK,CAAC,EAAE;CAC/D,IAAI,CAAC,KAAK,MAAM,IAAI,eAAe,mDAAmD;CACtF,OAAO;AACT;;;;;;;;AASA,MAAa,kBAAkB,QAAa;CAC1C,MAAM,qBAAqB,iBAAiB,GAAG;CAC/C,MAAM,WAAW,IAAI;CAErB,OAAO;EACL,gBAAgB,SAAS,KAAK,WAAW;EACzC;EACA,aAAaC,yBAAAA,WACX,WAAW,oBAAoB,QAAQ,IAAI,SAAS,KAAK,cAAc,CACzE;EACA,iBAAiBA,yBAAAA,KACf,YACE,IAAI,qBACJ,yBAAyB,SAAS,KAAK,SAAS,GAAG,MAAM,aAAa,CAAC,CAC3E;EACA,cAAc,QAAQ,YAAY,IAAI,YAAY;CACpD;AACF;;;;;;;;;AC/EA,MAAa,iBAAiB,EAAE,MAAM,QAAQ,QAA8B,CAAC,MAAM;CACjF,MAAM,WAAW,eAAe,GAAG;CACnC,MAAM,iBAAiB,qBAAqB;CAE5C,OAAO;EACL,QAAQ;GACN,gBAAgB,eAAe;GAC/B,aAAa,eAAe;GAC5B,gBAAgB,eAAe;GAC/B,0BAA0B,KAAiB,MAAe,SACxD,eAAe,eAAe,KAAK,IAAI;GACzC,qBAAqB;EACvB;EACA,WAAW,SAAS,eAChB,EAAE,UAAU,eAAe,UAAU,cAAc,EAAE,IACrD,KAAA;CACN;AACF"}
+{"version":3,"file":"index.cjs","names":["isRowLevelSecurityError","HttpStatus","APP_USER_TOKEN_HEADER","readJwtClaims","AsyncLocalStorage","APP_USER_TOKEN_HEADER","cellParser","createQueryServiceSdk","createQueryServiceClient","isRowLevelSecurityError","readFile","isPlainObject","createStorageClient","ServiceId","lazy"],"sources":["../../../src/sdks/dataAppServer/express.ts","../../../src/sdks/dataAppServer/requestContext.ts","../../../src/sdks/dataAppServer/runQuery.ts","../../../src/sdks/dataAppServer/settings.ts","../../../src/sdks/dataAppServer/initializeApp.ts"],"sourcesContent":["import { isRowLevelSecurityError } from '../../errors';\nimport { HttpStatus } from '../../internal';\n\ntype ErrorResponse = {\n  headersSent: boolean;\n  status(code: number): { json(body: unknown): unknown };\n};\n\n/** Answers a row-level security refusal with 403 and passes any other error on. */\nexport const createExpressErrorHandler =\n  () => (err: unknown, _req: unknown, res: ErrorResponse, next: (err?: unknown) => void) => {\n    if (res.headersSent || !isRowLevelSecurityError(err)) {\n      next(err);\n      return;\n    }\n    res.status(HttpStatus.FORBIDDEN).json({ error: err.message, code: 'ROW_LEVEL_SECURITY' });\n  };\n","import { AsyncLocalStorage } from 'node:async_hooks';\n\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { readJwtClaims } from '../../utils/readJwtClaims';\n\ntype NodeHeaders = Record<string, string | string[] | undefined>;\n\ntype HeadersLike = { get(name: string): string | null };\n\n/** A Fetch `Request` or `Headers`, or a Node request (Express, Fastify) with its lower-case `headers`. */\nexport type AppRequest = HeadersLike | { headers: HeadersLike | NodeHeaders };\n\n/** The signed-in user as the app user token names them; `email` only when the IdP verified it. */\nexport type AppUser = { idp: string; sub: string; email?: string };\n\ntype Scope = { appUserToken: string | undefined; user: AppUser | undefined };\n\nexport type RequestContext = ReturnType<typeof createRequestContext>;\n\nconst isHeadersLike = (headers: HeadersLike | NodeHeaders): headers is HeadersLike =>\n  'get' in headers && typeof headers.get === 'function';\n\nconst appUserTokenOf = (request: AppRequest): string | undefined => {\n  const headers = 'headers' in request ? request.headers : request;\n  if (isHeadersLike(headers)) return headers.get(APP_USER_TOKEN_HEADER) || undefined;\n  const value = headers[APP_USER_TOKEN_HEADER.toLowerCase()];\n  return (Array.isArray(value) ? value[0] : value) || undefined;\n};\n\nconst userOf = (token: string): AppUser | undefined => {\n  const { idp, sub, email } = readJwtClaims(token) ?? {};\n  if (typeof idp !== 'string' || typeof sub !== 'string' || !idp || !sub) return undefined;\n  return typeof email === 'string' && email ? { idp, sub, email } : { idp, sub };\n};\n\n/**\n * The signed-in user of the request being handled, kept across every `await` the request makes.\n *\n * - Work the request starts keeps its user: a timer, a promise cached at module level, a listener.\n * - `currentUser()` reads the token payload unverified: safe only behind Keboola's apps proxy.\n * - `currentUserKey()` is the same for every token of one user (`idp` + `sub`): a per-user cache key.\n */\nexport const createRequestContext = () => {\n  const storage = new AsyncLocalStorage<Scope>();\n  const current = () => storage.getStore();\n\n  return {\n    runWithRequest: <T>(request: AppRequest, fn: () => T): T => {\n      const appUserToken = appUserTokenOf(request);\n      return storage.run(\n        { appUserToken, user: appUserToken ? userOf(appUserToken) : undefined },\n        fn,\n      );\n    },\n    current,\n    currentUser: () => current()?.user,\n    currentUserKey: () => {\n      const user = current()?.user;\n      return user && JSON.stringify([user.idp, user.sub]);\n    },\n  };\n};\n","import { createQueryServiceClient, type QueryServiceCredential } from '../../clients/queryService';\nimport type { QueryResult } from '../../clients/queryService/types';\nimport { isRowLevelSecurityError } from '../../errors';\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { cellParser, createQueryServiceSdk, type ExecuteQueryOptions } from '../queryService';\n\nimport type { RequestContext } from './requestContext';\nimport type { Settings } from './settings';\n\nexport type RunQueryOptions = Pick<ExecuteQueryOptions, 'timeout' | 'maxRows' | 'signal'>;\n\nconst PAGE_SIZE = 10_000;\nconst TIMEOUT = 60_000;\n\nconst refusalWarning = (scope: ReturnType<RequestContext['current']>) => {\n  const prefix = '[dataAppServer] row-level security refused';\n  if (scope?.appUserToken) return `${prefix} the query for this user`;\n  const reason = scope\n    ? 'the request has none'\n    : 'it ran outside a user request (startup, timer, background job)';\n  return `${prefix} a query sent without ${APP_USER_TOKEN_HEADER}: ${reason}`;\n};\n\nconst toRecords = ({ columns = [], data = [], numberOfRows }: QueryResult, capped: boolean) => {\n  const parsers = columns.map(({ name, type }) => ({\n    key: name.toLowerCase(),\n    parse: cellParser(type),\n  }));\n  const keys = new Set<string>();\n  for (const { key } of parsers) {\n    if (keys.has(key))\n      throw new Error(`runQuery: two columns are named \"${key}\"; alias one with AS`);\n    keys.add(key);\n  }\n  const rows = data.map((row) => {\n    const record: Record<string, unknown> = {};\n    parsers.forEach(({ key, parse }, i) => {\n      const cell = row[i];\n      record[key] = cell == null ? null : parse(cell);\n    });\n    return record;\n  });\n  if (!capped && numberOfRows !== undefined && rows.length < numberOfRows) {\n    throw new Error(`runQuery: got ${rows.length} of ${numberOfRows} rows`);\n  }\n  return rows;\n};\n\n/**\n * Runs one SQL statement in the app's workspace and resolves every row as a record.\n *\n * - Sends the request's user token with the app's Storage token; without a user, the Storage token.\n * - A repeated column name, or fewer rows than counted (no `maxRows`), throws instead of losing data.\n */\nexport const createRunQuery = (settings: Settings, requestContext: RequestContext) => {\n  const queryService = createQueryServiceSdk({\n    queryServiceClient: createQueryServiceClient({\n      baseUrl: settings.queryServiceUrl,\n      auth: async (): Promise<QueryServiceCredential> => {\n        const storageToken = await settings.storageToken();\n        const appUserToken = requestContext.current()?.appUserToken;\n        return appUserToken\n          ? { type: 'app-user-token', token: appUserToken, storageToken }\n          : { type: 'sapi-token', token: storageToken };\n      },\n    }),\n  });\n\n  return async (sql: string, options: RunQueryOptions = {}): Promise<Record<string, unknown>[]> => {\n    const scope = requestContext.current();\n    const [result] = await queryService\n      .executeQuery(\n        settings.branchId(),\n        await settings.workspaceId(),\n        { statements: [sql], transactional: false },\n        { ...options, pageSize: PAGE_SIZE, timeout: options.timeout ?? TIMEOUT },\n      )\n      .catch((error: unknown) => {\n        if (isRowLevelSecurityError(error)) console.warn(refusalWarning(scope));\n        throw error;\n      });\n    return result ? toRecords(result, options.maxRows !== undefined) : [];\n  };\n};\n","import { readFile } from 'node:fs/promises';\n\nimport { createStorageClient } from '../../clients/storage';\nimport { ServiceId } from '../../constants/serviceIds';\nimport { lazy } from '../../utils/async';\nimport { isPlainObject } from '../../utils/isPlainObject';\n\nexport type Env = Record<string, string | undefined>;\n\n/** A setting the app needs is missing or unreadable; the message names the variable or file. */\nexport class AppConfigError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'AppConfigError';\n  }\n}\n\nexport type Settings = ReturnType<typeof createSettings>;\n\nconst STACK_INDEX_TIMEOUT = 10_000;\n\nconst required = (env: Env, name: string) => {\n  const value = env[name];\n  if (!value) throw new AppConfigError(`Missing environment variable ${name}`);\n  return value;\n};\n\nconst storageTokenFrom = async (env: Env) => {\n  const file = env.STORAGE_API_TOKEN_PATH;\n  if (!file) {\n    if (env.KBC_TOKEN) return env.KBC_TOKEN;\n    throw new AppConfigError('Missing Storage token: set STORAGE_API_TOKEN_PATH or KBC_TOKEN');\n  }\n  const content = await readFile(file, 'utf8').catch((error: unknown) => {\n    throw new AppConfigError(`Cannot read the file in STORAGE_API_TOKEN_PATH: ${file}`, {\n      cause: error,\n    });\n  });\n  const token = content.trim();\n  if (!token)\n    throw new AppConfigError(`The token file in STORAGE_API_TOKEN_PATH is empty: ${file}`);\n  return token;\n};\n\nconst manifestWorkspaceId = async (file: string) => {\n  let manifest: unknown;\n  try {\n    manifest = JSON.parse(await readFile(file, 'utf8'));\n  } catch (error) {\n    throw new AppConfigError(`Cannot read the JSON in KBC_WORKSPACE_MANIFEST_PATH: ${file}`, {\n      cause: error,\n    });\n  }\n  const id = isPlainObject(manifest) ? manifest.workspaceId : undefined;\n  if ((typeof id === 'string' && id) || typeof id === 'number') return String(id);\n  throw new AppConfigError(\n    `The manifest in KBC_WORKSPACE_MANIFEST_PATH has no workspaceId: ${file}`,\n  );\n};\n\nconst queryServiceUrlFromIndex = async (kbcUrl: string, token: string) => {\n  const { services } = await createStorageClient({\n    baseUrl: kbcUrl,\n    auth: { type: 'sapi-token', token },\n  }).getStackInfo({ exclude: 'components' }, AbortSignal.timeout(STACK_INDEX_TIMEOUT));\n  const url = services.find(({ id }) => id === ServiceId.Query)?.url;\n  if (!url) throw new AppConfigError('The stack index of KBC_URL lists no query service');\n  return url;\n};\n\n/**\n * What the platform provides a data app, read on first use; a missing value throws `AppConfigError`.\n *\n * - The Storage token is read on every call: the platform rotates the file in `STORAGE_API_TOKEN_PATH`.\n * - The workspace ID and the Query Service URL are read once per process.\n * - The Query Service URL is `QUERY_SERVICE_URL`, or the stack index of `KBC_URL` (local runs).\n */\nexport const createSettings = (env: Env) => {\n  const storageToken = () => storageTokenFrom(env);\n  const manifest = env.KBC_WORKSPACE_MANIFEST_PATH;\n\n  return {\n    branchId: () => required(env, 'BRANCH_ID'),\n    storageToken,\n    workspaceId: lazy(() =>\n      manifest ? manifestWorkspaceId(manifest) : required(env, 'WORKSPACE_ID'),\n    ),\n    queryServiceUrl: lazy(\n      async () =>\n        env.QUERY_SERVICE_URL ||\n        queryServiceUrlFromIndex(required(env, 'KBC_URL'), await storageToken()),\n    ),\n    hasWorkspace: Boolean(manifest || env.WORKSPACE_ID),\n  };\n};\n","import { createExpressErrorHandler } from './express';\nimport { type AppRequest, createRequestContext } from './requestContext';\nimport { createRunQuery } from './runQuery';\nimport { createSettings, type Env } from './settings';\n\n/** `env` replaces `process.env` (tests, local runs). */\nexport type DataAppServerOptions = { env?: Env };\n\n/**\n * Sets up Keboola access for this data app process; call it once.\n *\n * - Synchronous, no network call, never throws: each setting is read on first use.\n * - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).\n * - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.\n */\nexport const initializeApp = ({ env = process.env }: DataAppServerOptions = {}) => {\n  const settings = createSettings(env);\n  const requestContext = createRequestContext();\n\n  return {\n    server: {\n      runWithRequest: requestContext.runWithRequest,\n      currentUser: requestContext.currentUser,\n      currentUserKey: requestContext.currentUserKey,\n      expressMiddleware: () => (req: AppRequest, _res: unknown, next: () => void) =>\n        requestContext.runWithRequest(req, next),\n      expressErrorHandler: createExpressErrorHandler,\n    },\n    workspace: settings.hasWorkspace\n      ? { runQuery: createRunQuery(settings, requestContext) }\n      : undefined,\n  };\n};\n\nexport type DataAppServer = ReturnType<typeof initializeApp>;\n"],"mappings":";;;;;;;;;;;;;;AASA,MAAa,mCACJ,KAAc,MAAe,KAAoB,SAAkC;CACxF,IAAI,IAAI,eAAe,CAACA,8BAAAA,wBAAwB,GAAG,GAAG;EACpD,KAAK,GAAG;EACR;CACF;CACA,IAAI,OAAOC,0BAAAA,WAAW,SAAS,CAAC,CAAC,KAAK;EAAE,OAAO,IAAI;EAAS,MAAM;CAAqB,CAAC;AAC1F;;ACGF,MAAM,iBAAiB,YACrB,SAAS,WAAW,OAAO,QAAQ,QAAQ;AAE7C,MAAM,kBAAkB,YAA4C;CAClE,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU;CACzD,IAAI,cAAc,OAAO,GAAG,OAAO,QAAQ,IAAA,sBAAyB,KAAK,KAAA;CACzE,MAAM,QAAQ,QAAQC,0BAAAA,sBAAsB,YAAY;CACxD,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,UAAU,KAAA;AACtD;AAEA,MAAM,UAAU,UAAuC;CACrD,MAAM,EAAE,KAAK,KAAK,UAAUC,sBAAAA,cAAc,KAAK,KAAK,CAAC;CACrD,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,CAAC,OAAO,CAAC,KAAK,OAAO,KAAA;CAC/E,OAAO,OAAO,UAAU,YAAY,QAAQ;EAAE;EAAK;EAAK;CAAM,IAAI;EAAE;EAAK;CAAI;AAC/E;;;;;;;;AASA,MAAa,6BAA6B;CACxC,MAAM,UAAU,IAAIC,iBAAAA,kBAAyB;CAC7C,MAAM,gBAAgB,QAAQ,SAAS;CAEvC,OAAO;EACL,iBAAoB,SAAqB,OAAmB;GAC1D,MAAM,eAAe,eAAe,OAAO;GAC3C,OAAO,QAAQ,IACb;IAAE;IAAc,MAAM,eAAe,OAAO,YAAY,IAAI,KAAA;GAAU,GACtE,EACF;EACF;EACA;EACA,mBAAmB,QAAQ,CAAC,EAAE;EAC9B,sBAAsB;GACpB,MAAM,OAAO,QAAQ,CAAC,EAAE;GACxB,OAAO,QAAQ,KAAK,UAAU,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;EACpD;CACF;AACF;;AClDA,MAAM,YAAY;AAClB,MAAM,UAAU;AAEhB,MAAM,kBAAkB,UAAiD;CACvE,MAAM,SAAS;CACf,IAAI,OAAO,cAAc,OAAO,GAAG,OAAO;CAI1C,OAAO,GAAG,OAAO,wBAAwBC,0BAAAA,sBAAsB,IAHhD,QACX,yBACA;AAEN;AAEA,MAAM,aAAa,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,gBAA6B,WAAoB;CAC7F,MAAM,UAAU,QAAQ,KAAK,EAAE,MAAM,YAAY;EAC/C,KAAK,KAAK,YAAY;EACtB,OAAOC,uBAAAA,WAAW,IAAI;CACxB,EAAE;CACF,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,EAAE,SAAS,SAAS;EAC7B,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,oCAAoC,IAAI,qBAAqB;EAC/E,KAAK,IAAI,GAAG;CACd;CACA,MAAM,OAAO,KAAK,KAAK,QAAQ;EAC7B,MAAM,SAAkC,CAAC;EACzC,QAAQ,SAAS,EAAE,KAAK,SAAS,MAAM;GACrC,MAAM,OAAO,IAAI;GACjB,OAAO,OAAO,QAAQ,OAAO,OAAO,MAAM,IAAI;EAChD,CAAC;EACD,OAAO;CACT,CAAC;CACD,IAAI,CAAC,UAAU,iBAAiB,KAAA,KAAa,KAAK,SAAS,cACzD,MAAM,IAAI,MAAM,iBAAiB,KAAK,OAAO,MAAM,aAAa,MAAM;CAExE,OAAO;AACT;;;;;;;AAQA,MAAa,kBAAkB,UAAoB,mBAAmC;CACpF,MAAM,eAAeC,uBAAAA,sBAAsB,EACzC,oBAAoBC,qBAAAA,yBAAyB;EAC3C,SAAS,SAAS;EAClB,MAAM,YAA6C;GACjD,MAAM,eAAe,MAAM,SAAS,aAAa;GACjD,MAAM,eAAe,eAAe,QAAQ,CAAC,EAAE;GAC/C,OAAO,eACH;IAAE,MAAM;IAAkB,OAAO;IAAc;GAAa,IAC5D;IAAE,MAAM;IAAc,OAAO;GAAa;EAChD;CACF,CAAC,EACH,CAAC;CAED,OAAO,OAAO,KAAa,UAA2B,CAAC,MAA0C;EAC/F,MAAM,QAAQ,eAAe,QAAQ;EACrC,MAAM,CAAC,UAAU,MAAM,aACpB,aACC,SAAS,SAAS,GAClB,MAAM,SAAS,YAAY,GAC3B;GAAE,YAAY,CAAC,GAAG;GAAG,eAAe;EAAM,GAC1C;GAAE,GAAG;GAAS,UAAU;GAAW,SAAS,QAAQ,WAAW;EAAQ,CACzE,CAAC,CACA,OAAO,UAAmB;GACzB,IAAIC,8BAAAA,wBAAwB,KAAK,GAAG,QAAQ,KAAK,eAAe,KAAK,CAAC;GACtE,MAAM;EACR,CAAC;EACH,OAAO,SAAS,UAAU,QAAQ,QAAQ,YAAY,KAAA,CAAS,IAAI,CAAC;CACtE;AACF;;;ACzEA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAIA,MAAM,sBAAsB;AAE5B,MAAM,YAAY,KAAU,SAAiB;CAC3C,MAAM,QAAQ,IAAI;CAClB,IAAI,CAAC,OAAO,MAAM,IAAI,eAAe,gCAAgC,MAAM;CAC3E,OAAO;AACT;AAEA,MAAM,mBAAmB,OAAO,QAAa;CAC3C,MAAM,OAAO,IAAI;CACjB,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,WAAW,OAAO,IAAI;EAC9B,MAAM,IAAI,eAAe,gEAAgE;CAC3F;CAMA,MAAM,SAAQ,OAAA,GALQC,iBAAAA,SAAAA,CAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACrE,MAAM,IAAI,eAAe,mDAAmD,QAAQ,EAClF,OAAO,MACT,CAAC;CACH,CAAC,EAAA,CACqB,KAAK;CAC3B,IAAI,CAAC,OACH,MAAM,IAAI,eAAe,sDAAsD,MAAM;CACvF,OAAO;AACT;AAEA,MAAM,sBAAsB,OAAO,SAAiB;CAClD,IAAI;CACJ,IAAI;EACF,WAAW,KAAK,MAAM,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,MAAM,MAAM,CAAC;CACpD,SAAS,OAAO;EACd,MAAM,IAAI,eAAe,wDAAwD,QAAQ,EACvF,OAAO,MACT,CAAC;CACH;CACA,MAAM,KAAKC,sBAAAA,cAAc,QAAQ,IAAI,SAAS,cAAc,KAAA;CAC5D,IAAK,OAAO,OAAO,YAAY,MAAO,OAAO,OAAO,UAAU,OAAO,OAAO,EAAE;CAC9E,MAAM,IAAI,eACR,mEAAmE,MACrE;AACF;AAEA,MAAM,2BAA2B,OAAO,QAAgB,UAAkB;CACxE,MAAM,EAAE,aAAa,MAAMC,gBAAAA,oBAAoB;EAC7C,SAAS;EACT,MAAM;GAAE,MAAM;GAAc;EAAM;CACpC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,aAAa,GAAG,YAAY,QAAQ,mBAAmB,CAAC;CACnF,MAAM,MAAM,SAAS,MAAM,EAAE,SAAS,OAAOC,mBAAAA,UAAU,KAAK,CAAC,EAAE;CAC/D,IAAI,CAAC,KAAK,MAAM,IAAI,eAAe,mDAAmD;CACtF,OAAO;AACT;;;;;;;;AASA,MAAa,kBAAkB,QAAa;CAC1C,MAAM,qBAAqB,iBAAiB,GAAG;CAC/C,MAAM,WAAW,IAAI;CAErB,OAAO;EACL,gBAAgB,SAAS,KAAK,WAAW;EACzC;EACA,aAAaC,yBAAAA,WACX,WAAW,oBAAoB,QAAQ,IAAI,SAAS,KAAK,cAAc,CACzE;EACA,iBAAiBA,yBAAAA,KACf,YACE,IAAI,qBACJ,yBAAyB,SAAS,KAAK,SAAS,GAAG,MAAM,aAAa,CAAC,CAC3E;EACA,cAAc,QAAQ,YAAY,IAAI,YAAY;CACpD;AACF;;;;;;;;;AC/EA,MAAa,iBAAiB,EAAE,MAAM,QAAQ,QAA8B,CAAC,MAAM;CACjF,MAAM,WAAW,eAAe,GAAG;CACnC,MAAM,iBAAiB,qBAAqB;CAE5C,OAAO;EACL,QAAQ;GACN,gBAAgB,eAAe;GAC/B,aAAa,eAAe;GAC5B,gBAAgB,eAAe;GAC/B,0BAA0B,KAAiB,MAAe,SACxD,eAAe,eAAe,KAAK,IAAI;GACzC,qBAAqB;EACvB;EACA,WAAW,SAAS,eAChB,EAAE,UAAU,eAAe,UAAU,cAAc,EAAE,IACrD,KAAA;CACN;AACF"}

package/dist/sdk/dataAppServer/index.d.cts

@@ -1,4 +1,4 @@
-import { x as ExecuteQueryOptions } from "../../index-BtvWJBYh.cjs";
+import { x as ExecuteQueryOptions } from "../../index-DPhGNQC5.cjs";
 type NodeHeaders = Record<string, string | string[] | undefined>;
 type HeadersLike = {
   get(name: string): string | null;

package/dist/sdk/dataAppServer/index.d.ts

@@ -1,4 +1,4 @@
-import { x as ExecuteQueryOptions } from "../../index-Df30jjpZ.js";
+import { x as ExecuteQueryOptions } from "../../index-GlHJ4j3a.js";
 type NodeHeaders = Record<string, string | string[] | undefined>;
 type HeadersLike = {
   get(name: string): string | null;

package/dist/sdk/dataAppServer/index.js

@@ -1,5 +1,5 @@
 import { _ as HttpStatus, m as APP_USER_TOKEN_HEADER } from "../../createFetchClient-Dc_ZMuq7.js";
-import { t as createStorageClient } from "../../storage--2FvvLAw.js";
+import { t as createStorageClient } from "../../storage-Bw-HSnPp.js";
 import { n as isRowLevelSecurityError } from "../../RowLevelSecurityError-CObFqj3E.js";
 import { u as lazy } from "../../transientRetries-BORv47mH.js";
 import { t as isPlainObject } from "../../isPlainObject-BxsT8_t2.js";

package/dist/sdk/dataAppServer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/dataAppServer/express.ts","../../../src/sdks/dataAppServer/requestContext.ts","../../../src/sdks/dataAppServer/runQuery.ts","../../../src/sdks/dataAppServer/settings.ts","../../../src/sdks/dataAppServer/initializeApp.ts"],"sourcesContent":["import { isRowLevelSecurityError } from '../../errors';\nimport { HttpStatus } from '../../internal';\n\ntype ErrorResponse = {\n  headersSent: boolean;\n  status(code: number): { json(body: unknown): unknown };\n};\n\n/** Answers a row-level security refusal with 403 and passes any other error on. */\nexport const createExpressErrorHandler =\n  () => (err: unknown, _req: unknown, res: ErrorResponse, next: (err?: unknown) => void) => {\n    if (res.headersSent || !isRowLevelSecurityError(err)) {\n      next(err);\n      return;\n    }\n    res.status(HttpStatus.FORBIDDEN).json({ error: err.message, code: 'ROW_LEVEL_SECURITY' });\n  };\n","import { AsyncLocalStorage } from 'node:async_hooks';\n\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { readJwtClaims } from '../../utils/readJwtClaims';\n\ntype NodeHeaders = Record<string, string | string[] | undefined>;\n\ntype HeadersLike = { get(name: string): string | null };\n\n/** A Fetch `Request` or `Headers`, or a Node request (Express, Fastify) with its lower-case `headers`. */\nexport type AppRequest = HeadersLike | { headers: HeadersLike | NodeHeaders };\n\n/** The signed-in user as the app user token names them; `email` only when the IdP verified it. */\nexport type AppUser = { idp: string; sub: string; email?: string };\n\ntype Scope = { appUserToken: string | undefined; user: AppUser | undefined };\n\nexport type RequestContext = ReturnType<typeof createRequestContext>;\n\nconst isHeadersLike = (headers: object): headers is HeadersLike =>\n  'get' in headers && typeof headers.get === 'function';\n\nconst appUserTokenOf = (request: AppRequest): string | undefined => {\n  const headers = 'headers' in request ? request.headers : request;\n  if (isHeadersLike(headers)) return headers.get(APP_USER_TOKEN_HEADER) || undefined;\n  const value = headers[APP_USER_TOKEN_HEADER.toLowerCase()];\n  return (Array.isArray(value) ? value[0] : value) || undefined;\n};\n\nconst userOf = (token: string): AppUser | undefined => {\n  const { idp, sub, email } = readJwtClaims(token) ?? {};\n  if (typeof idp !== 'string' || typeof sub !== 'string' || !idp || !sub) return undefined;\n  return typeof email === 'string' && email ? { idp, sub, email } : { idp, sub };\n};\n\n/**\n * The signed-in user of the request being handled, kept across every `await` the request makes.\n *\n * - Work the request starts keeps its user: a timer, a promise cached at module level, a listener.\n * - `currentUser()` reads the token payload unverified: safe only behind Keboola's apps proxy.\n * - `currentUserKey()` is the same for every token of one user (`idp` + `sub`): a per-user cache key.\n */\nexport const createRequestContext = () => {\n  const storage = new AsyncLocalStorage<Scope>();\n  const current = () => storage.getStore();\n\n  return {\n    runWithRequest: <T>(request: AppRequest, fn: () => T): T => {\n      const appUserToken = appUserTokenOf(request);\n      return storage.run(\n        { appUserToken, user: appUserToken ? userOf(appUserToken) : undefined },\n        fn,\n      );\n    },\n    current,\n    currentUser: () => current()?.user,\n    currentUserKey: () => {\n      const user = current()?.user;\n      return user && JSON.stringify([user.idp, user.sub]);\n    },\n  };\n};\n","import { createQueryServiceClient, type QueryServiceCredential } from '../../clients/queryService';\nimport type { QueryResult } from '../../clients/queryService/types';\nimport { isRowLevelSecurityError } from '../../errors';\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { cellParser, createQueryServiceSdk, type ExecuteQueryOptions } from '../queryService';\n\nimport type { RequestContext } from './requestContext';\nimport type { Settings } from './settings';\n\nexport type RunQueryOptions = Pick<ExecuteQueryOptions, 'timeout' | 'maxRows' | 'signal'>;\n\nconst PAGE_SIZE = 10_000;\nconst TIMEOUT = 60_000;\n\nconst refusalWarning = (scope: ReturnType<RequestContext['current']>) => {\n  const prefix = '[dataAppServer] row-level security refused';\n  if (scope?.appUserToken) return `${prefix} the query for this user`;\n  const reason = scope\n    ? 'the request has none'\n    : 'it ran outside a user request (startup, timer, background job)';\n  return `${prefix} a query sent without ${APP_USER_TOKEN_HEADER}: ${reason}`;\n};\n\nconst toRecords = ({ columns = [], data = [], numberOfRows }: QueryResult, capped: boolean) => {\n  const parsers = columns.map(({ name, type }) => ({\n    key: name.toLowerCase(),\n    parse: cellParser(type),\n  }));\n  const keys = new Set<string>();\n  for (const { key } of parsers) {\n    if (keys.has(key))\n      throw new Error(`runQuery: two columns are named \"${key}\"; alias one with AS`);\n    keys.add(key);\n  }\n  const rows = data.map((row) => {\n    const record: Record<string, unknown> = {};\n    parsers.forEach(({ key, parse }, i) => {\n      const cell = row[i];\n      record[key] = cell == null ? null : parse(cell);\n    });\n    return record;\n  });\n  if (!capped && numberOfRows !== undefined && rows.length < numberOfRows) {\n    throw new Error(`runQuery: got ${rows.length} of ${numberOfRows} rows`);\n  }\n  return rows;\n};\n\n/**\n * Runs one SQL statement in the app's workspace and resolves every row as a record.\n *\n * - Sends the request's user token with the app's Storage token; without a user, the Storage token.\n * - A repeated column name, or fewer rows than counted (no `maxRows`), throws instead of losing data.\n */\nexport const createRunQuery = (settings: Settings, requestContext: RequestContext) => {\n  const queryService = createQueryServiceSdk({\n    queryServiceClient: createQueryServiceClient({\n      baseUrl: settings.queryServiceUrl,\n      auth: async (): Promise<QueryServiceCredential> => {\n        const storageToken = await settings.storageToken();\n        const appUserToken = requestContext.current()?.appUserToken;\n        return appUserToken\n          ? { type: 'app-user-token', token: appUserToken, storageToken }\n          : { type: 'sapi-token', token: storageToken };\n      },\n    }),\n  });\n\n  return async (sql: string, options: RunQueryOptions = {}): Promise<Record<string, unknown>[]> => {\n    const scope = requestContext.current();\n    const [result] = await queryService\n      .executeQuery(\n        settings.branchId(),\n        await settings.workspaceId(),\n        { statements: [sql], transactional: false },\n        { ...options, pageSize: PAGE_SIZE, timeout: options.timeout ?? TIMEOUT },\n      )\n      .catch((error: unknown) => {\n        if (isRowLevelSecurityError(error)) console.warn(refusalWarning(scope));\n        throw error;\n      });\n    return result ? toRecords(result, options.maxRows !== undefined) : [];\n  };\n};\n","import { readFile } from 'node:fs/promises';\n\nimport { createStorageClient } from '../../clients/storage';\nimport { ServiceId } from '../../constants/serviceIds';\nimport { lazy } from '../../utils/async';\nimport { isPlainObject } from '../../utils/isPlainObject';\n\nexport type Env = Record<string, string | undefined>;\n\n/** A setting the app needs is missing or unreadable; the message names the variable or file. */\nexport class AppConfigError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'AppConfigError';\n  }\n}\n\nexport type Settings = ReturnType<typeof createSettings>;\n\nconst STACK_INDEX_TIMEOUT = 10_000;\n\nconst required = (env: Env, name: string) => {\n  const value = env[name];\n  if (!value) throw new AppConfigError(`Missing environment variable ${name}`);\n  return value;\n};\n\nconst storageTokenFrom = async (env: Env) => {\n  const file = env.STORAGE_API_TOKEN_PATH;\n  if (!file) {\n    if (env.KBC_TOKEN) return env.KBC_TOKEN;\n    throw new AppConfigError('Missing Storage token: set STORAGE_API_TOKEN_PATH or KBC_TOKEN');\n  }\n  const content = await readFile(file, 'utf8').catch((error: unknown) => {\n    throw new AppConfigError(`Cannot read the file in STORAGE_API_TOKEN_PATH: ${file}`, {\n      cause: error,\n    });\n  });\n  const token = content.trim();\n  if (!token)\n    throw new AppConfigError(`The token file in STORAGE_API_TOKEN_PATH is empty: ${file}`);\n  return token;\n};\n\nconst manifestWorkspaceId = async (file: string) => {\n  let manifest: unknown;\n  try {\n    manifest = JSON.parse(await readFile(file, 'utf8'));\n  } catch (error) {\n    throw new AppConfigError(`Cannot read the JSON in KBC_WORKSPACE_MANIFEST_PATH: ${file}`, {\n      cause: error,\n    });\n  }\n  const id = isPlainObject(manifest) ? manifest.workspaceId : undefined;\n  if ((typeof id === 'string' && id) || typeof id === 'number') return String(id);\n  throw new AppConfigError(\n    `The manifest in KBC_WORKSPACE_MANIFEST_PATH has no workspaceId: ${file}`,\n  );\n};\n\nconst queryServiceUrlFromIndex = async (kbcUrl: string, token: string) => {\n  const { services } = await createStorageClient({\n    baseUrl: kbcUrl,\n    auth: { type: 'sapi-token', token },\n  }).getStackInfo({ exclude: 'components' }, AbortSignal.timeout(STACK_INDEX_TIMEOUT));\n  const url = services.find(({ id }) => id === ServiceId.Query)?.url;\n  if (!url) throw new AppConfigError('The stack index of KBC_URL lists no query service');\n  return url;\n};\n\n/**\n * What the platform provides a data app, read on first use; a missing value throws `AppConfigError`.\n *\n * - The Storage token is read on every call: the platform rotates the file in `STORAGE_API_TOKEN_PATH`.\n * - The workspace ID and the Query Service URL are read once per process.\n * - The Query Service URL is `QUERY_SERVICE_URL`, or the stack index of `KBC_URL` (local runs).\n */\nexport const createSettings = (env: Env) => {\n  const storageToken = () => storageTokenFrom(env);\n  const manifest = env.KBC_WORKSPACE_MANIFEST_PATH;\n\n  return {\n    branchId: () => required(env, 'BRANCH_ID'),\n    storageToken,\n    workspaceId: lazy(() =>\n      manifest ? manifestWorkspaceId(manifest) : required(env, 'WORKSPACE_ID'),\n    ),\n    queryServiceUrl: lazy(\n      async () =>\n        env.QUERY_SERVICE_URL ||\n        queryServiceUrlFromIndex(required(env, 'KBC_URL'), await storageToken()),\n    ),\n    hasWorkspace: Boolean(manifest || env.WORKSPACE_ID),\n  };\n};\n","import { createExpressErrorHandler } from './express';\nimport { type AppRequest, createRequestContext } from './requestContext';\nimport { createRunQuery } from './runQuery';\nimport { createSettings, type Env } from './settings';\n\n/** `env` replaces `process.env` (tests, local runs). */\nexport type DataAppServerOptions = { env?: Env };\n\n/**\n * Sets up Keboola access for this data app process; call it once.\n *\n * - Synchronous, no network call, never throws: each setting is read on first use.\n * - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).\n * - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.\n */\nexport const initializeApp = ({ env = process.env }: DataAppServerOptions = {}) => {\n  const settings = createSettings(env);\n  const requestContext = createRequestContext();\n\n  return {\n    server: {\n      runWithRequest: requestContext.runWithRequest,\n      currentUser: requestContext.currentUser,\n      currentUserKey: requestContext.currentUserKey,\n      expressMiddleware: () => (req: AppRequest, _res: unknown, next: () => void) =>\n        requestContext.runWithRequest(req, next),\n      expressErrorHandler: createExpressErrorHandler,\n    },\n    workspace: settings.hasWorkspace\n      ? { runQuery: createRunQuery(settings, requestContext) }\n      : undefined,\n  };\n};\n\nexport type DataAppServer = ReturnType<typeof initializeApp>;\n"],"mappings":";;;;;;;;;;;;;AASA,MAAa,mCACJ,KAAc,MAAe,KAAoB,SAAkC;CACxF,IAAI,IAAI,eAAe,CAAC,wBAAwB,GAAG,GAAG;EACpD,KAAK,GAAG;EACR;CACF;CACA,IAAI,OAAO,WAAW,SAAS,CAAC,CAAC,KAAK;EAAE,OAAO,IAAI;EAAS,MAAM;CAAqB,CAAC;AAC1F;;ACGF,MAAM,iBAAiB,YACrB,SAAS,WAAW,OAAO,QAAQ,QAAQ;AAE7C,MAAM,kBAAkB,YAA4C;CAClE,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU;CACzD,IAAI,cAAc,OAAO,GAAG,OAAO,QAAQ,IAAA,sBAAyB,KAAK,KAAA;CACzE,MAAM,QAAQ,QAAQ,sBAAsB,YAAY;CACxD,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,UAAU,KAAA;AACtD;AAEA,MAAM,UAAU,UAAuC;CACrD,MAAM,EAAE,KAAK,KAAK,UAAU,cAAc,KAAK,KAAK,CAAC;CACrD,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,CAAC,OAAO,CAAC,KAAK,OAAO,KAAA;CAC/E,OAAO,OAAO,UAAU,YAAY,QAAQ;EAAE;EAAK;EAAK;CAAM,IAAI;EAAE;EAAK;CAAI;AAC/E;;;;;;;;AASA,MAAa,6BAA6B;CACxC,MAAM,UAAU,IAAI,kBAAyB;CAC7C,MAAM,gBAAgB,QAAQ,SAAS;CAEvC,OAAO;EACL,iBAAoB,SAAqB,OAAmB;GAC1D,MAAM,eAAe,eAAe,OAAO;GAC3C,OAAO,QAAQ,IACb;IAAE;IAAc,MAAM,eAAe,OAAO,YAAY,IAAI,KAAA;GAAU,GACtE,EACF;EACF;EACA;EACA,mBAAmB,QAAQ,CAAC,EAAE;EAC9B,sBAAsB;GACpB,MAAM,OAAO,QAAQ,CAAC,EAAE;GACxB,OAAO,QAAQ,KAAK,UAAU,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;EACpD;CACF;AACF;;AClDA,MAAM,YAAY;AAClB,MAAM,UAAU;AAEhB,MAAM,kBAAkB,UAAiD;CACvE,MAAM,SAAS;CACf,IAAI,OAAO,cAAc,OAAO,GAAG,OAAO;CAI1C,OAAO,GAAG,OAAO,wBAAwB,sBAAsB,IAHhD,QACX,yBACA;AAEN;AAEA,MAAM,aAAa,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,gBAA6B,WAAoB;CAC7F,MAAM,UAAU,QAAQ,KAAK,EAAE,MAAM,YAAY;EAC/C,KAAK,KAAK,YAAY;EACtB,OAAO,WAAW,IAAI;CACxB,EAAE;CACF,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,EAAE,SAAS,SAAS;EAC7B,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,oCAAoC,IAAI,qBAAqB;EAC/E,KAAK,IAAI,GAAG;CACd;CACA,MAAM,OAAO,KAAK,KAAK,QAAQ;EAC7B,MAAM,SAAkC,CAAC;EACzC,QAAQ,SAAS,EAAE,KAAK,SAAS,MAAM;GACrC,MAAM,OAAO,IAAI;GACjB,OAAO,OAAO,QAAQ,OAAO,OAAO,MAAM,IAAI;EAChD,CAAC;EACD,OAAO;CACT,CAAC;CACD,IAAI,CAAC,UAAU,iBAAiB,KAAA,KAAa,KAAK,SAAS,cACzD,MAAM,IAAI,MAAM,iBAAiB,KAAK,OAAO,MAAM,aAAa,MAAM;CAExE,OAAO;AACT;;;;;;;AAQA,MAAa,kBAAkB,UAAoB,mBAAmC;CACpF,MAAM,eAAe,sBAAsB,EACzC,oBAAoB,yBAAyB;EAC3C,SAAS,SAAS;EAClB,MAAM,YAA6C;GACjD,MAAM,eAAe,MAAM,SAAS,aAAa;GACjD,MAAM,eAAe,eAAe,QAAQ,CAAC,EAAE;GAC/C,OAAO,eACH;IAAE,MAAM;IAAkB,OAAO;IAAc;GAAa,IAC5D;IAAE,MAAM;IAAc,OAAO;GAAa;EAChD;CACF,CAAC,EACH,CAAC;CAED,OAAO,OAAO,KAAa,UAA2B,CAAC,MAA0C;EAC/F,MAAM,QAAQ,eAAe,QAAQ;EACrC,MAAM,CAAC,UAAU,MAAM,aACpB,aACC,SAAS,SAAS,GAClB,MAAM,SAAS,YAAY,GAC3B;GAAE,YAAY,CAAC,GAAG;GAAG,eAAe;EAAM,GAC1C;GAAE,GAAG;GAAS,UAAU;GAAW,SAAS,QAAQ,WAAW;EAAQ,CACzE,CAAC,CACA,OAAO,UAAmB;GACzB,IAAI,wBAAwB,KAAK,GAAG,QAAQ,KAAK,eAAe,KAAK,CAAC;GACtE,MAAM;EACR,CAAC;EACH,OAAO,SAAS,UAAU,QAAQ,QAAQ,YAAY,KAAA,CAAS,IAAI,CAAC;CACtE;AACF;;;ACzEA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAIA,MAAM,sBAAsB;AAE5B,MAAM,YAAY,KAAU,SAAiB;CAC3C,MAAM,QAAQ,IAAI;CAClB,IAAI,CAAC,OAAO,MAAM,IAAI,eAAe,gCAAgC,MAAM;CAC3E,OAAO;AACT;AAEA,MAAM,mBAAmB,OAAO,QAAa;CAC3C,MAAM,OAAO,IAAI;CACjB,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,WAAW,OAAO,IAAI;EAC9B,MAAM,IAAI,eAAe,gEAAgE;CAC3F;CAMA,MAAM,SAAQ,MALQ,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACrE,MAAM,IAAI,eAAe,mDAAmD,QAAQ,EAClF,OAAO,MACT,CAAC;CACH,CAAC,EAAA,CACqB,KAAK;CAC3B,IAAI,CAAC,OACH,MAAM,IAAI,eAAe,sDAAsD,MAAM;CACvF,OAAO;AACT;AAEA,MAAM,sBAAsB,OAAO,SAAiB;CAClD,IAAI;CACJ,IAAI;EACF,WAAW,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;CACpD,SAAS,OAAO;EACd,MAAM,IAAI,eAAe,wDAAwD,QAAQ,EACvF,OAAO,MACT,CAAC;CACH;CACA,MAAM,KAAK,cAAc,QAAQ,IAAI,SAAS,cAAc,KAAA;CAC5D,IAAK,OAAO,OAAO,YAAY,MAAO,OAAO,OAAO,UAAU,OAAO,OAAO,EAAE;CAC9E,MAAM,IAAI,eACR,mEAAmE,MACrE;AACF;AAEA,MAAM,2BAA2B,OAAO,QAAgB,UAAkB;CACxE,MAAM,EAAE,aAAa,MAAM,oBAAoB;EAC7C,SAAS;EACT,MAAM;GAAE,MAAM;GAAc;EAAM;CACpC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,aAAa,GAAG,YAAY,QAAQ,mBAAmB,CAAC;CACnF,MAAM,MAAM,SAAS,MAAM,EAAE,SAAS,OAAO,UAAU,KAAK,CAAC,EAAE;CAC/D,IAAI,CAAC,KAAK,MAAM,IAAI,eAAe,mDAAmD;CACtF,OAAO;AACT;;;;;;;;AASA,MAAa,kBAAkB,QAAa;CAC1C,MAAM,qBAAqB,iBAAiB,GAAG;CAC/C,MAAM,WAAW,IAAI;CAErB,OAAO;EACL,gBAAgB,SAAS,KAAK,WAAW;EACzC;EACA,aAAa,WACX,WAAW,oBAAoB,QAAQ,IAAI,SAAS,KAAK,cAAc,CACzE;EACA,iBAAiB,KACf,YACE,IAAI,qBACJ,yBAAyB,SAAS,KAAK,SAAS,GAAG,MAAM,aAAa,CAAC,CAC3E;EACA,cAAc,QAAQ,YAAY,IAAI,YAAY;CACpD;AACF;;;;;;;;;AC/EA,MAAa,iBAAiB,EAAE,MAAM,QAAQ,QAA8B,CAAC,MAAM;CACjF,MAAM,WAAW,eAAe,GAAG;CACnC,MAAM,iBAAiB,qBAAqB;CAE5C,OAAO;EACL,QAAQ;GACN,gBAAgB,eAAe;GAC/B,aAAa,eAAe;GAC5B,gBAAgB,eAAe;GAC/B,0BAA0B,KAAiB,MAAe,SACxD,eAAe,eAAe,KAAK,IAAI;GACzC,qBAAqB;EACvB;EACA,WAAW,SAAS,eAChB,EAAE,UAAU,eAAe,UAAU,cAAc,EAAE,IACrD,KAAA;CACN;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/dataAppServer/express.ts","../../../src/sdks/dataAppServer/requestContext.ts","../../../src/sdks/dataAppServer/runQuery.ts","../../../src/sdks/dataAppServer/settings.ts","../../../src/sdks/dataAppServer/initializeApp.ts"],"sourcesContent":["import { isRowLevelSecurityError } from '../../errors';\nimport { HttpStatus } from '../../internal';\n\ntype ErrorResponse = {\n  headersSent: boolean;\n  status(code: number): { json(body: unknown): unknown };\n};\n\n/** Answers a row-level security refusal with 403 and passes any other error on. */\nexport const createExpressErrorHandler =\n  () => (err: unknown, _req: unknown, res: ErrorResponse, next: (err?: unknown) => void) => {\n    if (res.headersSent || !isRowLevelSecurityError(err)) {\n      next(err);\n      return;\n    }\n    res.status(HttpStatus.FORBIDDEN).json({ error: err.message, code: 'ROW_LEVEL_SECURITY' });\n  };\n","import { AsyncLocalStorage } from 'node:async_hooks';\n\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { readJwtClaims } from '../../utils/readJwtClaims';\n\ntype NodeHeaders = Record<string, string | string[] | undefined>;\n\ntype HeadersLike = { get(name: string): string | null };\n\n/** A Fetch `Request` or `Headers`, or a Node request (Express, Fastify) with its lower-case `headers`. */\nexport type AppRequest = HeadersLike | { headers: HeadersLike | NodeHeaders };\n\n/** The signed-in user as the app user token names them; `email` only when the IdP verified it. */\nexport type AppUser = { idp: string; sub: string; email?: string };\n\ntype Scope = { appUserToken: string | undefined; user: AppUser | undefined };\n\nexport type RequestContext = ReturnType<typeof createRequestContext>;\n\nconst isHeadersLike = (headers: HeadersLike | NodeHeaders): headers is HeadersLike =>\n  'get' in headers && typeof headers.get === 'function';\n\nconst appUserTokenOf = (request: AppRequest): string | undefined => {\n  const headers = 'headers' in request ? request.headers : request;\n  if (isHeadersLike(headers)) return headers.get(APP_USER_TOKEN_HEADER) || undefined;\n  const value = headers[APP_USER_TOKEN_HEADER.toLowerCase()];\n  return (Array.isArray(value) ? value[0] : value) || undefined;\n};\n\nconst userOf = (token: string): AppUser | undefined => {\n  const { idp, sub, email } = readJwtClaims(token) ?? {};\n  if (typeof idp !== 'string' || typeof sub !== 'string' || !idp || !sub) return undefined;\n  return typeof email === 'string' && email ? { idp, sub, email } : { idp, sub };\n};\n\n/**\n * The signed-in user of the request being handled, kept across every `await` the request makes.\n *\n * - Work the request starts keeps its user: a timer, a promise cached at module level, a listener.\n * - `currentUser()` reads the token payload unverified: safe only behind Keboola's apps proxy.\n * - `currentUserKey()` is the same for every token of one user (`idp` + `sub`): a per-user cache key.\n */\nexport const createRequestContext = () => {\n  const storage = new AsyncLocalStorage<Scope>();\n  const current = () => storage.getStore();\n\n  return {\n    runWithRequest: <T>(request: AppRequest, fn: () => T): T => {\n      const appUserToken = appUserTokenOf(request);\n      return storage.run(\n        { appUserToken, user: appUserToken ? userOf(appUserToken) : undefined },\n        fn,\n      );\n    },\n    current,\n    currentUser: () => current()?.user,\n    currentUserKey: () => {\n      const user = current()?.user;\n      return user && JSON.stringify([user.idp, user.sub]);\n    },\n  };\n};\n","import { createQueryServiceClient, type QueryServiceCredential } from '../../clients/queryService';\nimport type { QueryResult } from '../../clients/queryService/types';\nimport { isRowLevelSecurityError } from '../../errors';\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { cellParser, createQueryServiceSdk, type ExecuteQueryOptions } from '../queryService';\n\nimport type { RequestContext } from './requestContext';\nimport type { Settings } from './settings';\n\nexport type RunQueryOptions = Pick<ExecuteQueryOptions, 'timeout' | 'maxRows' | 'signal'>;\n\nconst PAGE_SIZE = 10_000;\nconst TIMEOUT = 60_000;\n\nconst refusalWarning = (scope: ReturnType<RequestContext['current']>) => {\n  const prefix = '[dataAppServer] row-level security refused';\n  if (scope?.appUserToken) return `${prefix} the query for this user`;\n  const reason = scope\n    ? 'the request has none'\n    : 'it ran outside a user request (startup, timer, background job)';\n  return `${prefix} a query sent without ${APP_USER_TOKEN_HEADER}: ${reason}`;\n};\n\nconst toRecords = ({ columns = [], data = [], numberOfRows }: QueryResult, capped: boolean) => {\n  const parsers = columns.map(({ name, type }) => ({\n    key: name.toLowerCase(),\n    parse: cellParser(type),\n  }));\n  const keys = new Set<string>();\n  for (const { key } of parsers) {\n    if (keys.has(key))\n      throw new Error(`runQuery: two columns are named \"${key}\"; alias one with AS`);\n    keys.add(key);\n  }\n  const rows = data.map((row) => {\n    const record: Record<string, unknown> = {};\n    parsers.forEach(({ key, parse }, i) => {\n      const cell = row[i];\n      record[key] = cell == null ? null : parse(cell);\n    });\n    return record;\n  });\n  if (!capped && numberOfRows !== undefined && rows.length < numberOfRows) {\n    throw new Error(`runQuery: got ${rows.length} of ${numberOfRows} rows`);\n  }\n  return rows;\n};\n\n/**\n * Runs one SQL statement in the app's workspace and resolves every row as a record.\n *\n * - Sends the request's user token with the app's Storage token; without a user, the Storage token.\n * - A repeated column name, or fewer rows than counted (no `maxRows`), throws instead of losing data.\n */\nexport const createRunQuery = (settings: Settings, requestContext: RequestContext) => {\n  const queryService = createQueryServiceSdk({\n    queryServiceClient: createQueryServiceClient({\n      baseUrl: settings.queryServiceUrl,\n      auth: async (): Promise<QueryServiceCredential> => {\n        const storageToken = await settings.storageToken();\n        const appUserToken = requestContext.current()?.appUserToken;\n        return appUserToken\n          ? { type: 'app-user-token', token: appUserToken, storageToken }\n          : { type: 'sapi-token', token: storageToken };\n      },\n    }),\n  });\n\n  return async (sql: string, options: RunQueryOptions = {}): Promise<Record<string, unknown>[]> => {\n    const scope = requestContext.current();\n    const [result] = await queryService\n      .executeQuery(\n        settings.branchId(),\n        await settings.workspaceId(),\n        { statements: [sql], transactional: false },\n        { ...options, pageSize: PAGE_SIZE, timeout: options.timeout ?? TIMEOUT },\n      )\n      .catch((error: unknown) => {\n        if (isRowLevelSecurityError(error)) console.warn(refusalWarning(scope));\n        throw error;\n      });\n    return result ? toRecords(result, options.maxRows !== undefined) : [];\n  };\n};\n","import { readFile } from 'node:fs/promises';\n\nimport { createStorageClient } from '../../clients/storage';\nimport { ServiceId } from '../../constants/serviceIds';\nimport { lazy } from '../../utils/async';\nimport { isPlainObject } from '../../utils/isPlainObject';\n\nexport type Env = Record<string, string | undefined>;\n\n/** A setting the app needs is missing or unreadable; the message names the variable or file. */\nexport class AppConfigError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'AppConfigError';\n  }\n}\n\nexport type Settings = ReturnType<typeof createSettings>;\n\nconst STACK_INDEX_TIMEOUT = 10_000;\n\nconst required = (env: Env, name: string) => {\n  const value = env[name];\n  if (!value) throw new AppConfigError(`Missing environment variable ${name}`);\n  return value;\n};\n\nconst storageTokenFrom = async (env: Env) => {\n  const file = env.STORAGE_API_TOKEN_PATH;\n  if (!file) {\n    if (env.KBC_TOKEN) return env.KBC_TOKEN;\n    throw new AppConfigError('Missing Storage token: set STORAGE_API_TOKEN_PATH or KBC_TOKEN');\n  }\n  const content = await readFile(file, 'utf8').catch((error: unknown) => {\n    throw new AppConfigError(`Cannot read the file in STORAGE_API_TOKEN_PATH: ${file}`, {\n      cause: error,\n    });\n  });\n  const token = content.trim();\n  if (!token)\n    throw new AppConfigError(`The token file in STORAGE_API_TOKEN_PATH is empty: ${file}`);\n  return token;\n};\n\nconst manifestWorkspaceId = async (file: string) => {\n  let manifest: unknown;\n  try {\n    manifest = JSON.parse(await readFile(file, 'utf8'));\n  } catch (error) {\n    throw new AppConfigError(`Cannot read the JSON in KBC_WORKSPACE_MANIFEST_PATH: ${file}`, {\n      cause: error,\n    });\n  }\n  const id = isPlainObject(manifest) ? manifest.workspaceId : undefined;\n  if ((typeof id === 'string' && id) || typeof id === 'number') return String(id);\n  throw new AppConfigError(\n    `The manifest in KBC_WORKSPACE_MANIFEST_PATH has no workspaceId: ${file}`,\n  );\n};\n\nconst queryServiceUrlFromIndex = async (kbcUrl: string, token: string) => {\n  const { services } = await createStorageClient({\n    baseUrl: kbcUrl,\n    auth: { type: 'sapi-token', token },\n  }).getStackInfo({ exclude: 'components' }, AbortSignal.timeout(STACK_INDEX_TIMEOUT));\n  const url = services.find(({ id }) => id === ServiceId.Query)?.url;\n  if (!url) throw new AppConfigError('The stack index of KBC_URL lists no query service');\n  return url;\n};\n\n/**\n * What the platform provides a data app, read on first use; a missing value throws `AppConfigError`.\n *\n * - The Storage token is read on every call: the platform rotates the file in `STORAGE_API_TOKEN_PATH`.\n * - The workspace ID and the Query Service URL are read once per process.\n * - The Query Service URL is `QUERY_SERVICE_URL`, or the stack index of `KBC_URL` (local runs).\n */\nexport const createSettings = (env: Env) => {\n  const storageToken = () => storageTokenFrom(env);\n  const manifest = env.KBC_WORKSPACE_MANIFEST_PATH;\n\n  return {\n    branchId: () => required(env, 'BRANCH_ID'),\n    storageToken,\n    workspaceId: lazy(() =>\n      manifest ? manifestWorkspaceId(manifest) : required(env, 'WORKSPACE_ID'),\n    ),\n    queryServiceUrl: lazy(\n      async () =>\n        env.QUERY_SERVICE_URL ||\n        queryServiceUrlFromIndex(required(env, 'KBC_URL'), await storageToken()),\n    ),\n    hasWorkspace: Boolean(manifest || env.WORKSPACE_ID),\n  };\n};\n","import { createExpressErrorHandler } from './express';\nimport { type AppRequest, createRequestContext } from './requestContext';\nimport { createRunQuery } from './runQuery';\nimport { createSettings, type Env } from './settings';\n\n/** `env` replaces `process.env` (tests, local runs). */\nexport type DataAppServerOptions = { env?: Env };\n\n/**\n * Sets up Keboola access for this data app process; call it once.\n *\n * - Synchronous, no network call, never throws: each setting is read on first use.\n * - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).\n * - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.\n */\nexport const initializeApp = ({ env = process.env }: DataAppServerOptions = {}) => {\n  const settings = createSettings(env);\n  const requestContext = createRequestContext();\n\n  return {\n    server: {\n      runWithRequest: requestContext.runWithRequest,\n      currentUser: requestContext.currentUser,\n      currentUserKey: requestContext.currentUserKey,\n      expressMiddleware: () => (req: AppRequest, _res: unknown, next: () => void) =>\n        requestContext.runWithRequest(req, next),\n      expressErrorHandler: createExpressErrorHandler,\n    },\n    workspace: settings.hasWorkspace\n      ? { runQuery: createRunQuery(settings, requestContext) }\n      : undefined,\n  };\n};\n\nexport type DataAppServer = ReturnType<typeof initializeApp>;\n"],"mappings":";;;;;;;;;;;;;AASA,MAAa,mCACJ,KAAc,MAAe,KAAoB,SAAkC;CACxF,IAAI,IAAI,eAAe,CAAC,wBAAwB,GAAG,GAAG;EACpD,KAAK,GAAG;EACR;CACF;CACA,IAAI,OAAO,WAAW,SAAS,CAAC,CAAC,KAAK;EAAE,OAAO,IAAI;EAAS,MAAM;CAAqB,CAAC;AAC1F;;ACGF,MAAM,iBAAiB,YACrB,SAAS,WAAW,OAAO,QAAQ,QAAQ;AAE7C,MAAM,kBAAkB,YAA4C;CAClE,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU;CACzD,IAAI,cAAc,OAAO,GAAG,OAAO,QAAQ,IAAA,sBAAyB,KAAK,KAAA;CACzE,MAAM,QAAQ,QAAQ,sBAAsB,YAAY;CACxD,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,UAAU,KAAA;AACtD;AAEA,MAAM,UAAU,UAAuC;CACrD,MAAM,EAAE,KAAK,KAAK,UAAU,cAAc,KAAK,KAAK,CAAC;CACrD,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,CAAC,OAAO,CAAC,KAAK,OAAO,KAAA;CAC/E,OAAO,OAAO,UAAU,YAAY,QAAQ;EAAE;EAAK;EAAK;CAAM,IAAI;EAAE;EAAK;CAAI;AAC/E;;;;;;;;AASA,MAAa,6BAA6B;CACxC,MAAM,UAAU,IAAI,kBAAyB;CAC7C,MAAM,gBAAgB,QAAQ,SAAS;CAEvC,OAAO;EACL,iBAAoB,SAAqB,OAAmB;GAC1D,MAAM,eAAe,eAAe,OAAO;GAC3C,OAAO,QAAQ,IACb;IAAE;IAAc,MAAM,eAAe,OAAO,YAAY,IAAI,KAAA;GAAU,GACtE,EACF;EACF;EACA;EACA,mBAAmB,QAAQ,CAAC,EAAE;EAC9B,sBAAsB;GACpB,MAAM,OAAO,QAAQ,CAAC,EAAE;GACxB,OAAO,QAAQ,KAAK,UAAU,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;EACpD;CACF;AACF;;AClDA,MAAM,YAAY;AAClB,MAAM,UAAU;AAEhB,MAAM,kBAAkB,UAAiD;CACvE,MAAM,SAAS;CACf,IAAI,OAAO,cAAc,OAAO,GAAG,OAAO;CAI1C,OAAO,GAAG,OAAO,wBAAwB,sBAAsB,IAHhD,QACX,yBACA;AAEN;AAEA,MAAM,aAAa,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,gBAA6B,WAAoB;CAC7F,MAAM,UAAU,QAAQ,KAAK,EAAE,MAAM,YAAY;EAC/C,KAAK,KAAK,YAAY;EACtB,OAAO,WAAW,IAAI;CACxB,EAAE;CACF,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,EAAE,SAAS,SAAS;EAC7B,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,oCAAoC,IAAI,qBAAqB;EAC/E,KAAK,IAAI,GAAG;CACd;CACA,MAAM,OAAO,KAAK,KAAK,QAAQ;EAC7B,MAAM,SAAkC,CAAC;EACzC,QAAQ,SAAS,EAAE,KAAK,SAAS,MAAM;GACrC,MAAM,OAAO,IAAI;GACjB,OAAO,OAAO,QAAQ,OAAO,OAAO,MAAM,IAAI;EAChD,CAAC;EACD,OAAO;CACT,CAAC;CACD,IAAI,CAAC,UAAU,iBAAiB,KAAA,KAAa,KAAK,SAAS,cACzD,MAAM,IAAI,MAAM,iBAAiB,KAAK,OAAO,MAAM,aAAa,MAAM;CAExE,OAAO;AACT;;;;;;;AAQA,MAAa,kBAAkB,UAAoB,mBAAmC;CACpF,MAAM,eAAe,sBAAsB,EACzC,oBAAoB,yBAAyB;EAC3C,SAAS,SAAS;EAClB,MAAM,YAA6C;GACjD,MAAM,eAAe,MAAM,SAAS,aAAa;GACjD,MAAM,eAAe,eAAe,QAAQ,CAAC,EAAE;GAC/C,OAAO,eACH;IAAE,MAAM;IAAkB,OAAO;IAAc;GAAa,IAC5D;IAAE,MAAM;IAAc,OAAO;GAAa;EAChD;CACF,CAAC,EACH,CAAC;CAED,OAAO,OAAO,KAAa,UAA2B,CAAC,MAA0C;EAC/F,MAAM,QAAQ,eAAe,QAAQ;EACrC,MAAM,CAAC,UAAU,MAAM,aACpB,aACC,SAAS,SAAS,GAClB,MAAM,SAAS,YAAY,GAC3B;GAAE,YAAY,CAAC,GAAG;GAAG,eAAe;EAAM,GAC1C;GAAE,GAAG;GAAS,UAAU;GAAW,SAAS,QAAQ,WAAW;EAAQ,CACzE,CAAC,CACA,OAAO,UAAmB;GACzB,IAAI,wBAAwB,KAAK,GAAG,QAAQ,KAAK,eAAe,KAAK,CAAC;GACtE,MAAM;EACR,CAAC;EACH,OAAO,SAAS,UAAU,QAAQ,QAAQ,YAAY,KAAA,CAAS,IAAI,CAAC;CACtE;AACF;;;ACzEA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAIA,MAAM,sBAAsB;AAE5B,MAAM,YAAY,KAAU,SAAiB;CAC3C,MAAM,QAAQ,IAAI;CAClB,IAAI,CAAC,OAAO,MAAM,IAAI,eAAe,gCAAgC,MAAM;CAC3E,OAAO;AACT;AAEA,MAAM,mBAAmB,OAAO,QAAa;CAC3C,MAAM,OAAO,IAAI;CACjB,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,WAAW,OAAO,IAAI;EAC9B,MAAM,IAAI,eAAe,gEAAgE;CAC3F;CAMA,MAAM,SAAQ,MALQ,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACrE,MAAM,IAAI,eAAe,mDAAmD,QAAQ,EAClF,OAAO,MACT,CAAC;CACH,CAAC,EAAA,CACqB,KAAK;CAC3B,IAAI,CAAC,OACH,MAAM,IAAI,eAAe,sDAAsD,MAAM;CACvF,OAAO;AACT;AAEA,MAAM,sBAAsB,OAAO,SAAiB;CAClD,IAAI;CACJ,IAAI;EACF,WAAW,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;CACpD,SAAS,OAAO;EACd,MAAM,IAAI,eAAe,wDAAwD,QAAQ,EACvF,OAAO,MACT,CAAC;CACH;CACA,MAAM,KAAK,cAAc,QAAQ,IAAI,SAAS,cAAc,KAAA;CAC5D,IAAK,OAAO,OAAO,YAAY,MAAO,OAAO,OAAO,UAAU,OAAO,OAAO,EAAE;CAC9E,MAAM,IAAI,eACR,mEAAmE,MACrE;AACF;AAEA,MAAM,2BAA2B,OAAO,QAAgB,UAAkB;CACxE,MAAM,EAAE,aAAa,MAAM,oBAAoB;EAC7C,SAAS;EACT,MAAM;GAAE,MAAM;GAAc;EAAM;CACpC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,aAAa,GAAG,YAAY,QAAQ,mBAAmB,CAAC;CACnF,MAAM,MAAM,SAAS,MAAM,EAAE,SAAS,OAAO,UAAU,KAAK,CAAC,EAAE;CAC/D,IAAI,CAAC,KAAK,MAAM,IAAI,eAAe,mDAAmD;CACtF,OAAO;AACT;;;;;;;;AASA,MAAa,kBAAkB,QAAa;CAC1C,MAAM,qBAAqB,iBAAiB,GAAG;CAC/C,MAAM,WAAW,IAAI;CAErB,OAAO;EACL,gBAAgB,SAAS,KAAK,WAAW;EACzC;EACA,aAAa,WACX,WAAW,oBAAoB,QAAQ,IAAI,SAAS,KAAK,cAAc,CACzE;EACA,iBAAiB,KACf,YACE,IAAI,qBACJ,yBAAyB,SAAS,KAAK,SAAS,GAAG,MAAM,aAAa,CAAC,CAC3E;EACA,cAAc,QAAQ,YAAY,IAAI,YAAY;CACpD;AACF;;;;;;;;;AC/EA,MAAa,iBAAiB,EAAE,MAAM,QAAQ,QAA8B,CAAC,MAAM;CACjF,MAAM,WAAW,eAAe,GAAG;CACnC,MAAM,iBAAiB,qBAAqB;CAE5C,OAAO;EACL,QAAQ;GACN,gBAAgB,eAAe;GAC/B,aAAa,eAAe;GAC5B,gBAAgB,eAAe;GAC/B,0BAA0B,KAAiB,MAAe,SACxD,eAAe,eAAe,KAAK,IAAI;GACzC,qBAAqB;EACvB;EACA,WAAW,SAAS,eAChB,EAAE,UAAU,eAAe,UAAU,cAAc,EAAE,IACrD,KAAA;CACN;AACF"}

package/dist/sdk/developerPortal/index.d.cts

@@ -1,6 +1,6 @@
-import { di as MiddlewareFn } from "../../index-FrsEkDvX.cjs";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-Cf0WE6qK.cjs";
-import { t as DeveloperPortalTokens } from "../../index-BXgjPlZN.cjs";
+import { fi as MiddlewareFn } from "../../index-DcKc3_Y1.cjs";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-DtS7qAdz.cjs";
+import { t as DeveloperPortalTokens } from "../../index-DxbqDi_0.cjs";
 import { n as Listener } from "../../emitter-raKkIqRp.cjs";
 type DeveloperPortalSdkOptions = {
   baseUrl: string;

package/dist/sdk/developerPortal/index.d.ts

@@ -1,6 +1,6 @@
-import { di as MiddlewareFn } from "../../index-FrsEkDvX.js";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-dU3EA8gk.js";
-import { t as DeveloperPortalTokens } from "../../index-DLWMm1-T.js";
+import { fi as MiddlewareFn } from "../../index-DcKc3_Y1.js";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-BnkHyxdp.js";
+import { t as DeveloperPortalTokens } from "../../index-A8udJCGv.js";
 import { n as Listener } from "../../emitter-raKkIqRp.js";
 type DeveloperPortalSdkOptions = {
   baseUrl: string;

package/dist/sdk/kaiMemory/index.d.cts

@@ -1,4 +1,4 @@
-import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-CSE8bHiq.cjs";
+import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-Cm1iOHE5.cjs";
 /** The metastore object type this SDK addresses — see `SEMANTIC_OBJECT_TYPE` for the convention. */
 declare const KAI_MEMORY_OBJECT_TYPE = "kai-memory";
 /**

package/dist/sdk/kaiMemory/index.d.ts

@@ -1,4 +1,4 @@
-import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-zlYUn0oi.js";
+import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-B5FgsIiY.js";
 /** The metastore object type this SDK addresses — see `SEMANTIC_OBJECT_TYPE` for the convention. */
 declare const KAI_MEMORY_OBJECT_TYPE = "kai-memory";
 /**

package/dist/sdk/kaiMemory/types.d.cts

@@ -1,2 +1,2 @@
-import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-CSE8bHiq.cjs";
+import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-Cm1iOHE5.cjs";
 export { CreateKaiMemoryMeta, KaiMemoryData, KaiMemoryItem, KaiMemoryMeta, KaiMemoryStatus, MetastoreClient, UpdateKaiMemoryMeta };

package/dist/sdk/kaiMemory/types.d.ts

@@ -1,2 +1,2 @@
-import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-zlYUn0oi.js";
+import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-B5FgsIiY.js";
 export { CreateKaiMemoryMeta, KaiMemoryData, KaiMemoryItem, KaiMemoryMeta, KaiMemoryStatus, MetastoreClient, UpdateKaiMemoryMeta };

package/dist/sdk/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { S as createQueryServiceSdk, b as cellParser, x as ExecuteQueryOptions } from "../../index-BtvWJBYh.cjs";
+import { S as createQueryServiceSdk, b as cellParser, x as ExecuteQueryOptions } from "../../index-DPhGNQC5.cjs";
 export { ExecuteQueryOptions, cellParser, createQueryServiceSdk };

package/dist/sdk/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { S as createQueryServiceSdk, b as cellParser, x as ExecuteQueryOptions } from "../../index-Df30jjpZ.js";
+import { S as createQueryServiceSdk, b as cellParser, x as ExecuteQueryOptions } from "../../index-GlHJ4j3a.js";
 export { ExecuteQueryOptions, cellParser, createQueryServiceSdk };