@keboola/api-client 8.0.2 → 11.0.0

package/dist/constants/index.d.ts

@@ -1,3 +1,58 @@
+export { A as AdminRole, B as Backend } from '../backends-BgUzAQul.js';
+
+declare const ComponentId: {
+    readonly WR_DB_MYSQL: "keboola.wr-db-mysql";
+    readonly WR_DB_PGSQL: "keboola.wr-db-pgsql";
+    readonly WR_DB_ORACLE: "keboola.wr-db-oracle";
+    readonly WR_DB_SNOWFLAKE: "keboola.wr-db-snowflake";
+    readonly WR_DB_SNOWFLAKE_GCS: "keboola.wr-db-snowflake-gcs";
+    readonly WR_DB_SNOWFLAKE_GCS_S3: "keboola.wr-db-snowflake-gcs-s3";
+    readonly WR_SNOWFLAKE_BLOB_STORAGE: "keboola.wr-snowflake-blob-storage";
+    readonly WR_LOOKER_V2: "keboola.wr-looker-v2";
+    readonly APP_DATA_GATEWAY: "keboola.app-data-gateway";
+    readonly WR_SYNAPSE: "keboola.wr-synapse";
+    readonly WR_REDSHIFT: "keboola.wr-redshift-v2";
+    readonly WR_DB_MSSQL: "keboola.wr-db-mssql-v2";
+    readonly WR_DB_HIVE: "keboola.wr-db-hive";
+    readonly WR_DB_IMPALA: "keboola.wr-db-impala";
+    readonly WR_PAIRITY: "kds-team.wr-pairity";
+    readonly WR_EXASOL: "kds-team.wr-exasol";
+    readonly WR_FIREBOLT: "kds-team.wr-firebolt";
+    readonly WR_HIVE_CSAS: "kds-team.wr-hive-csas";
+    readonly WR_THOUGHTSPOT: "keboola.wr-thoughtspot";
+    readonly WR_SISENSE: "keboola.wr-sisense";
+    readonly SCHEDULER: "keboola.scheduler";
+    readonly APP_SNOWFLAKE_DWH_MANAGER: "keboola.app-snowflake-dwh-manager";
+    readonly GOODDATA_WRITER: "keboola.gooddata-writer";
+    readonly EX_DB_MYSQL: "keboola.ex-db-mysql";
+    readonly EX_DB_PGSQL: "keboola.ex-db-pgsql";
+    readonly EX_DB_REDSHIFT: "keboola.ex-db-redshift";
+    readonly EX_DB_FIREBIRD: "keboola.ex-db-firebird";
+    readonly EX_DB_DB2: "keboola.ex-db-db2";
+    readonly EX_DB_DB2_BATA: "keboola.ex-db-db2-bata";
+    readonly EX_DB_MSSQL: "keboola.ex-db-mssql";
+    readonly EX_DB_MSSQL_CDATA: "keboola.ex-db-mssql-cdata";
+    readonly EX_DB_ORACLE: "keboola.ex-db-oracle";
+    readonly EX_DB_SNOWFLAKE: "keboola.ex-db-snowflake";
+    readonly EX_DB_NETSUITE: "keboola.ex-db-netsuite";
+    readonly EX_DB_INFORMIX: "keboola.ex-db-informix";
+    readonly EX_DB_IMPALA: "keboola.ex-db-impala";
+    readonly EX_DB_HIVE: "keboola.ex-db-hive";
+    readonly EX_DB_HIVE_CSAS: "keboola.ex-db-hive-csas";
+    readonly EX_DB_HIVE_CSAS_TEST: "keboola.ex-db-hive-csas-test";
+    readonly EX_TERADATA: "keboola.ex-teradata";
+    readonly KDS_EX_NETSUITE: "kds-team.ex-netsuite";
+    readonly KDS_EX_PROGRESS_DB: "kds-team.ex-progress-db";
+};
+type ComponentId = (typeof ComponentId)[keyof typeof ComponentId];
+
+declare const ProjectFeature: {
+    readonly DisableLegacyBucketPrefix: "disable-legacy-bucket-prefix";
+    readonly SoxProtectedDefaultBranch: "protected-default-branch";
+    readonly StorageBranches: "storage-branches";
+};
+type ProjectFeature = (typeof ProjectFeature)[keyof typeof ProjectFeature];
+
 type Provider = 'aws' | 'azure' | 'gcp';
 type Continent = 'us' | 'europe';
 type KeboolaStack = {
@@ -25,4 +80,4 @@ declare const URLS: {
     readonly CLAUDE_CONNECTORS: "https://claude.ai/customize/connectors";
 };
 
-export { type Continent, type KeboolaStack, type Provider, STACKS, URLS };
+export { ComponentId, type Continent, type KeboolaStack, ProjectFeature, type Provider, STACKS, URLS };

package/dist/constants/index.js

@@ -1,3 +1,13 @@
+export { AdminRole } from '../chunk-Y5QJJWDQ.js';
+export { ProjectFeature } from '../chunk-GM3AKU5T.js';
+export { ComponentId } from '../chunk-B7BBPROF.js';
+
+// src/constants/backends.ts
+var Backend = {
+  Snowflake: "snowflake",
+  Bigquery: "bigquery"
+};
+
 // src/constants/index.ts
 var STACKS = {
   NORTH_EUROPE_AZURE: {
@@ -137,6 +147,6 @@ var URLS = {
   CLAUDE_CONNECTORS: "https://claude.ai/customize/connectors"
 };
 
-export { STACKS, URLS };
+export { Backend, STACKS, URLS };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/constants/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/constants/index.ts"],"names":[],"mappings":";AAeO,IAAM,MAAA,GAAiD;AAAA,EAC5D,kBAAA,EAAoB;AAAA,IAClB,EAAA,EAAI,gCAAA;AAAA,IACJ,MAAA,EAAQ,cAAA;AAAA,IACR,IAAA,EAAM,2CAAA;AAAA,IACN,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,QAAA;AAAA,IACX,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,gBAAA,EAAkB;AAAA,IAChB,EAAA,EAAI,kBAAA;AAAA,IACJ,MAAA,EAAQ,cAAA;AAAA,IACR,IAAA,EAAM,qCAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AAAA,EACA,aAAA,EAAe;AAAA,IACb,EAAA,EAAI,eAAA;AAAA,IACJ,MAAA,EAAQ,WAAA;AAAA,IACR,IAAA,EAAM,wBAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AAAA,EACA,gBAAA,EAAkB;AAAA,IAChB,EAAA,EAAI,8BAAA;AAAA,IACJ,MAAA,EAAQ,cAAA;AAAA,IACR,IAAA,EAAM,yCAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AAAA,EACA,aAAA,EAAe;AAAA,IACb,EAAA,EAAI,0BAAA;AAAA,IACJ,MAAA,EAAQ,UAAA;AAAA,IACR,IAAA,EAAM,qCAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,SAAA,EAAW,IAAA;AAAA,IACX,MAAA,EAAQ;AAAA,GACV;AAAA;AAAA;AAAA,EAIA,GAAA,EAAK;AAAA,IACH,EAAA,EAAI,mBAAA;AAAA,IACJ,IAAA,EAAM,8BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,SAAA,EAAW;AAAA,IACT,EAAA,EAAI,kBAAA;AAAA,IACJ,IAAA,EAAM,6BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,SAAA,EAAW;AAAA,IACT,EAAA,EAAI,uBAAA;AAAA,IACJ,IAAA,EAAM,kCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,EAAA,EAAI,0BAAA;AAAA,IACJ,IAAA,EAAM,qCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,EAAS;AAAA,IACP,EAAA,EAAI,uBAAA;AAAA,IACJ,IAAA,EAAM,kCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,WAAA,EAAa;AAAA,IACX,EAAA,EAAI,0BAAA;AAAA,IACJ,IAAA,EAAM,qCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,EAAA,EAAI,sBAAA;AAAA,IACJ,IAAA,EAAM,iCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,EAAA,EAAI,oBAAA;AAAA,IACJ,IAAA,EAAM,+BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,EAAA,EAAI,oBAAA;AAAA,IACJ,IAAA,EAAM,+BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,KAAA,EAAO;AAAA,IACL,EAAA,EAAI,qBAAA;AAAA,IACJ,IAAA,EAAM,gCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,GAAA,EAAK;AAAA,IACH,EAAA,EAAI,mBAAA;AAAA,IACJ,IAAA,EAAM,8BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,GAAA,EAAK;AAAA,IACH,EAAA,EAAI,mBAAA;AAAA,IACJ,IAAA,EAAM,8BAAA;AAAA,IACN,cAAA,EAAgB,IAAA;AAAA,IAChB,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AAAA;AAAA;AAAA,EAIA,oBAAA,EAAsB;AAAA,IACpB,EAAA,EAAI,6BAAA;AAAA,IACJ,IAAA,EAAM,wCAAA;AAAA,IACN,SAAA,EAAW;AAAA,GACb;AAAA,EACA,iBAAA,EAAmB;AAAA,IACjB,EAAA,EAAI,2BAAA;AAAA,IACJ,IAAA,EAAM,sCAAA;AAAA,IACN,SAAA,EAAW;AAAA,GACb;AAAA,EACA,mBAAA,EAAqB;AAAA,IACnB,EAAA,EAAI,6BAAA;AAAA,IACJ,IAAA,EAAM,gDAAA;AAAA,IACN,SAAA,EAAW;AAAA,GACb;AAAA,EACA,wBAAA,EAA0B;AAAA,IACxB,EAAA,EAAI,0BAAA;AAAA,IACJ,IAAA,EAAM,qCAAA;AAAA,IACN,QAAA,EAAU;AAAA;AAEd;AAEO,IAAM,IAAA,GAAO;AAAA,EAClB,kBAAA,EAAoB,0BAAA;AAAA,EACpB,UAAA,EAAY,gCAAA;AAAA,EACZ,wBAAA,EAA0B,gCAAA;AAAA,EAC1B,OAAA,EAAS,6BAAA;AAAA,EACT,kBAAA,EAAoB,6BAAA;AAAA,EACpB,SAAA,EAAW,2BAAA;AAAA,EACX,cAAA,EAAgB,4BAAA;AAAA,EAChB,GAAA,EAAK,6BAAA;AAAA,EACL,OAAA,EAAS,uBAAA;AAAA,EACT,iBAAA,EAAmB;AACrB","file":"index.js","sourcesContent":["export type Provider = 'aws' | 'azure' | 'gcp';\nexport type Continent = 'us' | 'europe';\n\nexport type KeboolaStack = {\n  id: string;\n  host: string;\n  isSingleTenant?: boolean;\n  isTesting?: boolean;\n  isPayg?: boolean;\n  provider?: Provider;\n  continent?: Continent;\n  region?: string;\n  isCanary?: boolean;\n};\n\nexport const STACKS: Record<string, Readonly<KeboolaStack>> = {\n  NORTH_EUROPE_AZURE: {\n    id: 'com-keboola-azure-north-europe',\n    region: 'north-europe',\n    host: 'connection.north-europe.azure.keboola.com',\n    provider: 'azure',\n    continent: 'europe',\n    isPayg: true,\n  },\n  EU_CENTRAL_1_AWS: {\n    id: 'kbc-eu-central-1',\n    region: 'eu-central-1',\n    host: 'connection.eu-central-1.keboola.com',\n    provider: 'aws',\n    continent: 'europe',\n  },\n  US_EAST_1_AWS: {\n    id: 'kbc-us-east-1',\n    region: 'us-east-1',\n    host: 'connection.keboola.com',\n    provider: 'aws',\n    continent: 'us',\n  },\n  EUROPE_WEST3_GCP: {\n    id: 'com-keboola-gcp-europe-west3',\n    region: 'europe-west3',\n    host: 'connection.europe-west3.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'europe',\n  },\n  US_EAST_4_GCP: {\n    id: 'com-keboola-gcp-us-east4',\n    region: 'us-east4',\n    host: 'connection.us-east4.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'us',\n    isPayg: true,\n  },\n\n  /* PRIVATE SINGLE TENANT STACKS\n     ---------------------------- */\n  HCI: {\n    id: 'cloud-keboola-hci',\n    host: 'connection.hci.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_PROD: {\n    id: 'cloud-keboola-cs',\n    host: 'connection.cs.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_TEST: {\n    id: 'cloud-keboola-cs-test',\n    host: 'connection.cs-test.keboola.cloud',\n    isSingleTenant: true,\n  },\n  INNOGY: {\n    id: 'cloud-keboola-innogy-hub',\n    host: 'connection.innogy-hub.keboola.cloud',\n    isSingleTenant: true,\n  },\n  GROUPON: {\n    id: 'cloud-keboola-groupon',\n    host: 'connection.groupon.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CREDIT_INFO: {\n    id: 'cloud-keboola-creditinfo',\n    host: 'connection.creditinfo.keboola.cloud',\n    isSingleTenant: true,\n  },\n  COATES: {\n    id: 'cloud-keboola-coates',\n    host: 'connection.coates.keboola.cloud',\n    isSingleTenant: true,\n  },\n  SLSP: {\n    id: 'cloud-keboola-slsp',\n    host: 'connection.slsp.keboola.cloud',\n    isSingleTenant: true,\n  },\n  HCKZ: {\n    id: 'cloud-keboola-hckz',\n    host: 'connection.hckz.keboola.cloud',\n    isSingleTenant: true,\n  },\n  PASHA: {\n    id: 'cloud-keboola-pasha',\n    host: 'connection.pasha.keboola.cloud',\n    isSingleTenant: true,\n  },\n  RBI: {\n    id: 'cloud-keboola-rbi',\n    host: 'connection.rbi.keboola.cloud',\n    isSingleTenant: true,\n  },\n  NAH: {\n    id: 'cloud-keboola-nah',\n    host: 'connection.nah.keboola.cloud',\n    isSingleTenant: true,\n    provider: 'azure',\n    continent: 'us',\n  },\n\n  /* DEV STACKS\n     ---------------------------- */\n  DEV_US_CENTRAL_1_GCP: {\n    id: 'dev-keboola-gcp-us-central1',\n    host: 'connection.us-central1.gcp.keboola.dev',\n    isTesting: true,\n  },\n  DEV_EU_WEST_1_AWS: {\n    id: 'dev-keboola-aws-eu-west-1',\n    host: 'connection.eu-west-1.aws.keboola.dev',\n    isTesting: true,\n  },\n  DEV_US_EAST_2_AZURE: {\n    id: 'kbc-testing-azure-east-us-2',\n    host: 'connection.east-us-2.azure.keboola-testing.com',\n    isTesting: true,\n  },\n  DEV_KEBOOLA_CANARY_ORION: {\n    id: 'dev-keboola-canary-orion',\n    host: 'connection.canary-orion.keboola.dev',\n    isCanary: true,\n  },\n};\n\nexport const URLS = {\n  USER_DOCUMENTATION: 'https://help.keboola.com',\n  COMPONENTS: 'https://components.keboola.com',\n  DEVELOPERS_DOCUMENTATION: 'https://developers.keboola.com',\n  ACADEMY: 'https://academy.keboola.com',\n  SALES_CONTACT_FORM: 'https://keboola.com/contact',\n  SNOWFLAKE: 'https://www.snowflake.com',\n  SNOWFLAKE_DOCS: 'https://docs.snowflake.com',\n  MCP: 'https://www.keboola.com/mcp',\n  NODE_JS: 'https://nodejs.org/en',\n  CLAUDE_CONNECTORS: 'https://claude.ai/customize/connectors',\n} as const;\n"]}
+{"version":3,"sources":["../../src/constants/backends.ts","../../src/constants/index.ts"],"names":[],"mappings":";;;;;AAAO,IAAM,OAAA,GAAU;AAAA,EACrB,SAAA,EAAW,WAAA;AAAA,EACX,QAAA,EAAU;AACZ;;;ACiBO,IAAM,MAAA,GAAiD;AAAA,EAC5D,kBAAA,EAAoB;AAAA,IAClB,EAAA,EAAI,gCAAA;AAAA,IACJ,MAAA,EAAQ,cAAA;AAAA,IACR,IAAA,EAAM,2CAAA;AAAA,IACN,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW,QAAA;AAAA,IACX,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,gBAAA,EAAkB;AAAA,IAChB,EAAA,EAAI,kBAAA;AAAA,IACJ,MAAA,EAAQ,cAAA;AAAA,IACR,IAAA,EAAM,qCAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AAAA,EACA,aAAA,EAAe;AAAA,IACb,EAAA,EAAI,eAAA;AAAA,IACJ,MAAA,EAAQ,WAAA;AAAA,IACR,IAAA,EAAM,wBAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AAAA,EACA,gBAAA,EAAkB;AAAA,IAChB,EAAA,EAAI,8BAAA;AAAA,IACJ,MAAA,EAAQ,cAAA;AAAA,IACR,IAAA,EAAM,yCAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AAAA,EACA,aAAA,EAAe;AAAA,IACb,EAAA,EAAI,0BAAA;AAAA,IACJ,MAAA,EAAQ,UAAA;AAAA,IACR,IAAA,EAAM,qCAAA;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,SAAA,EAAW,IAAA;AAAA,IACX,MAAA,EAAQ;AAAA,GACV;AAAA;AAAA;AAAA,EAIA,GAAA,EAAK;AAAA,IACH,EAAA,EAAI,mBAAA;AAAA,IACJ,IAAA,EAAM,8BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,SAAA,EAAW;AAAA,IACT,EAAA,EAAI,kBAAA;AAAA,IACJ,IAAA,EAAM,6BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,SAAA,EAAW;AAAA,IACT,EAAA,EAAI,uBAAA;AAAA,IACJ,IAAA,EAAM,kCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,EAAA,EAAI,0BAAA;AAAA,IACJ,IAAA,EAAM,qCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,OAAA,EAAS;AAAA,IACP,EAAA,EAAI,uBAAA;AAAA,IACJ,IAAA,EAAM,kCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,WAAA,EAAa;AAAA,IACX,EAAA,EAAI,0BAAA;AAAA,IACJ,IAAA,EAAM,qCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,EAAA,EAAI,sBAAA;AAAA,IACJ,IAAA,EAAM,iCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,EAAA,EAAI,oBAAA;AAAA,IACJ,IAAA,EAAM,+BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,EAAA,EAAI,oBAAA;AAAA,IACJ,IAAA,EAAM,+BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,KAAA,EAAO;AAAA,IACL,EAAA,EAAI,qBAAA;AAAA,IACJ,IAAA,EAAM,gCAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,GAAA,EAAK;AAAA,IACH,EAAA,EAAI,mBAAA;AAAA,IACJ,IAAA,EAAM,8BAAA;AAAA,IACN,cAAA,EAAgB;AAAA,GAClB;AAAA,EACA,GAAA,EAAK;AAAA,IACH,EAAA,EAAI,mBAAA;AAAA,IACJ,IAAA,EAAM,8BAAA;AAAA,IACN,cAAA,EAAgB,IAAA;AAAA,IAChB,QAAA,EAAU,OAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb;AAAA;AAAA;AAAA,EAIA,oBAAA,EAAsB;AAAA,IACpB,EAAA,EAAI,6BAAA;AAAA,IACJ,IAAA,EAAM,wCAAA;AAAA,IACN,SAAA,EAAW;AAAA,GACb;AAAA,EACA,iBAAA,EAAmB;AAAA,IACjB,EAAA,EAAI,2BAAA;AAAA,IACJ,IAAA,EAAM,sCAAA;AAAA,IACN,SAAA,EAAW;AAAA,GACb;AAAA,EACA,mBAAA,EAAqB;AAAA,IACnB,EAAA,EAAI,6BAAA;AAAA,IACJ,IAAA,EAAM,gDAAA;AAAA,IACN,SAAA,EAAW;AAAA,GACb;AAAA,EACA,wBAAA,EAA0B;AAAA,IACxB,EAAA,EAAI,0BAAA;AAAA,IACJ,IAAA,EAAM,qCAAA;AAAA,IACN,QAAA,EAAU;AAAA;AAEd;AAEO,IAAM,IAAA,GAAO;AAAA,EAClB,kBAAA,EAAoB,0BAAA;AAAA,EACpB,UAAA,EAAY,gCAAA;AAAA,EACZ,wBAAA,EAA0B,gCAAA;AAAA,EAC1B,OAAA,EAAS,6BAAA;AAAA,EACT,kBAAA,EAAoB,6BAAA;AAAA,EACpB,SAAA,EAAW,2BAAA;AAAA,EACX,cAAA,EAAgB,4BAAA;AAAA,EAChB,GAAA,EAAK,6BAAA;AAAA,EACL,OAAA,EAAS,uBAAA;AAAA,EACT,iBAAA,EAAmB;AACrB","file":"index.js","sourcesContent":["export const Backend = {\n  Snowflake: 'snowflake',\n  Bigquery: 'bigquery',\n} as const;\n\nexport type Backend = (typeof Backend)[keyof typeof Backend];\n","export { ComponentId } from './componentId';\nexport { ProjectFeature } from './projectFeatures';\nexport { Backend } from './backends';\nexport { AdminRole } from './adminRoles';\n\nexport type Provider = 'aws' | 'azure' | 'gcp';\nexport type Continent = 'us' | 'europe';\n\nexport type KeboolaStack = {\n  id: string;\n  host: string;\n  isSingleTenant?: boolean;\n  isTesting?: boolean;\n  isPayg?: boolean;\n  provider?: Provider;\n  continent?: Continent;\n  region?: string;\n  isCanary?: boolean;\n};\n\nexport const STACKS: Record<string, Readonly<KeboolaStack>> = {\n  NORTH_EUROPE_AZURE: {\n    id: 'com-keboola-azure-north-europe',\n    region: 'north-europe',\n    host: 'connection.north-europe.azure.keboola.com',\n    provider: 'azure',\n    continent: 'europe',\n    isPayg: true,\n  },\n  EU_CENTRAL_1_AWS: {\n    id: 'kbc-eu-central-1',\n    region: 'eu-central-1',\n    host: 'connection.eu-central-1.keboola.com',\n    provider: 'aws',\n    continent: 'europe',\n  },\n  US_EAST_1_AWS: {\n    id: 'kbc-us-east-1',\n    region: 'us-east-1',\n    host: 'connection.keboola.com',\n    provider: 'aws',\n    continent: 'us',\n  },\n  EUROPE_WEST3_GCP: {\n    id: 'com-keboola-gcp-europe-west3',\n    region: 'europe-west3',\n    host: 'connection.europe-west3.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'europe',\n  },\n  US_EAST_4_GCP: {\n    id: 'com-keboola-gcp-us-east4',\n    region: 'us-east4',\n    host: 'connection.us-east4.gcp.keboola.com',\n    provider: 'gcp',\n    continent: 'us',\n    isPayg: true,\n  },\n\n  /* PRIVATE SINGLE TENANT STACKS\n     ---------------------------- */\n  HCI: {\n    id: 'cloud-keboola-hci',\n    host: 'connection.hci.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_PROD: {\n    id: 'cloud-keboola-cs',\n    host: 'connection.cs.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CSAS_TEST: {\n    id: 'cloud-keboola-cs-test',\n    host: 'connection.cs-test.keboola.cloud',\n    isSingleTenant: true,\n  },\n  INNOGY: {\n    id: 'cloud-keboola-innogy-hub',\n    host: 'connection.innogy-hub.keboola.cloud',\n    isSingleTenant: true,\n  },\n  GROUPON: {\n    id: 'cloud-keboola-groupon',\n    host: 'connection.groupon.keboola.cloud',\n    isSingleTenant: true,\n  },\n  CREDIT_INFO: {\n    id: 'cloud-keboola-creditinfo',\n    host: 'connection.creditinfo.keboola.cloud',\n    isSingleTenant: true,\n  },\n  COATES: {\n    id: 'cloud-keboola-coates',\n    host: 'connection.coates.keboola.cloud',\n    isSingleTenant: true,\n  },\n  SLSP: {\n    id: 'cloud-keboola-slsp',\n    host: 'connection.slsp.keboola.cloud',\n    isSingleTenant: true,\n  },\n  HCKZ: {\n    id: 'cloud-keboola-hckz',\n    host: 'connection.hckz.keboola.cloud',\n    isSingleTenant: true,\n  },\n  PASHA: {\n    id: 'cloud-keboola-pasha',\n    host: 'connection.pasha.keboola.cloud',\n    isSingleTenant: true,\n  },\n  RBI: {\n    id: 'cloud-keboola-rbi',\n    host: 'connection.rbi.keboola.cloud',\n    isSingleTenant: true,\n  },\n  NAH: {\n    id: 'cloud-keboola-nah',\n    host: 'connection.nah.keboola.cloud',\n    isSingleTenant: true,\n    provider: 'azure',\n    continent: 'us',\n  },\n\n  /* DEV STACKS\n     ---------------------------- */\n  DEV_US_CENTRAL_1_GCP: {\n    id: 'dev-keboola-gcp-us-central1',\n    host: 'connection.us-central1.gcp.keboola.dev',\n    isTesting: true,\n  },\n  DEV_EU_WEST_1_AWS: {\n    id: 'dev-keboola-aws-eu-west-1',\n    host: 'connection.eu-west-1.aws.keboola.dev',\n    isTesting: true,\n  },\n  DEV_US_EAST_2_AZURE: {\n    id: 'kbc-testing-azure-east-us-2',\n    host: 'connection.east-us-2.azure.keboola-testing.com',\n    isTesting: true,\n  },\n  DEV_KEBOOLA_CANARY_ORION: {\n    id: 'dev-keboola-canary-orion',\n    host: 'connection.canary-orion.keboola.dev',\n    isCanary: true,\n  },\n};\n\nexport const URLS = {\n  USER_DOCUMENTATION: 'https://help.keboola.com',\n  COMPONENTS: 'https://components.keboola.com',\n  DEVELOPERS_DOCUMENTATION: 'https://developers.keboola.com',\n  ACADEMY: 'https://academy.keboola.com',\n  SALES_CONTACT_FORM: 'https://keboola.com/contact',\n  SNOWFLAKE: 'https://www.snowflake.com',\n  SNOWFLAKE_DOCS: 'https://docs.snowflake.com',\n  MCP: 'https://www.keboola.com/mcp',\n  NODE_JS: 'https://nodejs.org/en',\n  CLAUDE_CONNECTORS: 'https://claude.ai/customize/connectors',\n} as const;\n"]}

package/dist/dataScience/index.cjs

@@ -1,19 +1,18 @@
 'use strict';
 
-var chunkOYSQWNNG_cjs = require('../chunk-OYSQWNNG.cjs');
+var chunkAU2OPVRI_cjs = require('../chunk-AU2OPVRI.cjs');
 require('../chunk-MRHQJNWF.cjs');
-require('../chunk-IDYRJ4K3.cjs');
-require('../chunk-R7MQGDLC.cjs');
+require('../chunk-OWGJ3PVA.cjs');
 
 
 
 Object.defineProperty(exports, "createDataScienceClient", {
   enumerable: true,
-  get: function () { return chunkOYSQWNNG_cjs.createDataScienceClient; }
+  get: function () { return chunkAU2OPVRI_cjs.createDataScienceClient; }
 });
 Object.defineProperty(exports, "parseLogLines", {
   enumerable: true,
-  get: function () { return chunkOYSQWNNG_cjs.parseLogLines; }
+  get: function () { return chunkAU2OPVRI_cjs.parseLogLines; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/dataScience/index.js

@@ -1,6 +1,5 @@
-export { createDataScienceClient, parseLogLines } from '../chunk-A5IFX4KC.js';
+export { createDataScienceClient, parseLogLines } from '../chunk-MUKQ6HZE.js';
 import '../chunk-MSI6FVGG.js';
-import '../chunk-D2SWTZFS.js';
-import '../chunk-SI5TFV5M.js';
+import '../chunk-FBGUBMJ7.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/domain/permissions/index.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
+var chunkNFA5ITNG_cjs = require('../../chunk-NFA5ITNG.cjs');
 var chunkGF4XZK5N_cjs = require('../../chunk-GF4XZK5N.cjs');
-var chunkR7MQGDLC_cjs = require('../../chunk-R7MQGDLC.cjs');
 
 // src/domain/permissions/errors.ts
 var PermissionDeniedError = class extends Error {
@@ -19,10 +19,10 @@ var PermissionDeniedError = class extends Error {
 
 // src/domain/permissions/admin.ts
 var role = (token) => token.admin.role;
-var isAdmin = (token) => role(token) === chunkR7MQGDLC_cjs.AdminRoles.ADMIN;
-var isAdminOrShare = (token) => role(token) === chunkR7MQGDLC_cjs.AdminRoles.ADMIN || role(token) === chunkR7MQGDLC_cjs.AdminRoles.SHARE;
-var isProductionManager = (token) => role(token) === chunkR7MQGDLC_cjs.AdminRoles.PRODUCTION_MANAGER;
-var isDeveloperOrReviewer = (token) => role(token) === chunkR7MQGDLC_cjs.AdminRoles.DEVELOPER || role(token) === chunkR7MQGDLC_cjs.AdminRoles.REVIEWER;
+var isAdmin = (token) => role(token) === chunkNFA5ITNG_cjs.AdminRole.Admin;
+var isAdminOrShare = (token) => role(token) === chunkNFA5ITNG_cjs.AdminRole.Admin || role(token) === chunkNFA5ITNG_cjs.AdminRole.Share;
+var isProductionManager = (token) => role(token) === chunkNFA5ITNG_cjs.AdminRole.ProductionManager;
+var isDeveloperOrReviewer = (token) => role(token) === chunkNFA5ITNG_cjs.AdminRole.Developer || role(token) === chunkNFA5ITNG_cjs.AdminRole.Reviewer;
 var assertCanAdmin = (token) => {
   if (!isAdmin(token)) {
     throw new PermissionDeniedError({

package/dist/domain/permissions/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRoles"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,4BAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,4BAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,4BAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRoles } from '../../constants';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":["AdminRole"],"mappings":";;;;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAMA,2BAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAMA,2BAAA,CAAU;AAE5D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.cjs","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/domain/permissions/index.d.cts

@@ -1,5 +1,6 @@
-import { S as StorageToken } from '../../types-Bu8AEdZo.cjs';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-cYJhOvzB.cjs';
+import { S as StorageToken } from '../../types-CMEwVQ78.cjs';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-NJuUPx8-.cjs';
+import '../../backends-BgUzAQul.cjs';
 import '../../types-jKnx7Tm_.cjs';
 
 /**

package/dist/domain/permissions/index.d.ts

@@ -1,5 +1,6 @@
-import { S as StorageToken } from '../../types-bjHzGr0s.js';
-export { h as hasAdminFeature, a as hasFeature } from '../../project-BKbb7xWn.js';
+import { S as StorageToken } from '../../types-GmAeMsok.js';
+export { h as hasAdminFeature, a as hasFeature } from '../../project-BxSa1Ci9.js';
+import '../../backends-BgUzAQul.js';
 import '../../types-jKnx7Tm_.js';
 
 /**

package/dist/domain/permissions/index.js

@@ -1,5 +1,5 @@
+import { AdminRole } from '../../chunk-Y5QJJWDQ.js';
 export { hasAdminFeature, hasFeature } from '../../chunk-UABYNGBZ.js';
-import { AdminRoles } from '../../chunk-SI5TFV5M.js';
 
 // src/domain/permissions/errors.ts
 var PermissionDeniedError = class extends Error {
@@ -17,10 +17,10 @@ var PermissionDeniedError = class extends Error {
 
 // src/domain/permissions/admin.ts
 var role = (token) => token.admin.role;
-var isAdmin = (token) => role(token) === AdminRoles.ADMIN;
-var isAdminOrShare = (token) => role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;
-var isProductionManager = (token) => role(token) === AdminRoles.PRODUCTION_MANAGER;
-var isDeveloperOrReviewer = (token) => role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;
+var isAdmin = (token) => role(token) === AdminRole.Admin;
+var isAdminOrShare = (token) => role(token) === AdminRole.Admin || role(token) === AdminRole.Share;
+var isProductionManager = (token) => role(token) === AdminRole.ProductionManager;
+var isDeveloperOrReviewer = (token) => role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;
 var assertCanAdmin = (token) => {
   if (!isAdmin(token)) {
     throw new PermissionDeniedError({

package/dist/domain/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAE7E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE1D,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,UAAA,CAAW;AAEtB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,UAAA,CAAW;AAE9D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRoles } from '../../constants';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRoles.ADMIN;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.ADMIN || role(token) === AdminRoles.SHARE;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.PRODUCTION_MANAGER;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRoles.DEVELOPER || role(token) === AdminRoles.REVIEWER;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}
+{"version":3,"sources":["../../../src/domain/permissions/errors.ts","../../../src/domain/permissions/admin.ts","../../../src/domain/permissions/configurations.ts"],"names":[],"mappings":";;;;AAgBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EAEhB,WAAA,CAAY,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAA0D;AAC9F,IAAA,KAAA,CAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,CAAA,GAAM,CAAA,mBAAA,EAAsB,MAAM,CAAA,CAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;;;ACfA,IAAM,IAAA,GAAO,CAAC,KAAA,KAAgC,KAAA,CAAM,KAAA,CAAM,IAAA;AAEnD,IAAM,UAAU,CAAC,KAAA,KAAiC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAE5E,IAAM,cAAA,GAAiB,CAAC,KAAA,KAC7B,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,KAAA,IAAS,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAExD,IAAM,sBAAsB,CAAC,KAAA,KAClC,IAAA,CAAK,KAAK,MAAM,SAAA,CAAU;AAErB,IAAM,qBAAA,GAAwB,CAAC,KAAA,KACpC,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU,SAAA,IAAa,IAAA,CAAK,KAAK,CAAA,KAAM,SAAA,CAAU;AAE5D,IAAM,cAAA,GAAiB,CAAC,KAAA,KAA8B;AAC3D,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,OAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,cAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,KAA8B;AAClE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,gBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,uBAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,yBAAA,GAA4B,CAAC,KAAA,KAA8B;AACtE,EAAA,IAAI,CAAC,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,0BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,wBAAA,GAA2B,CAAC,KAAA,KAA8B;AACrE,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,mBAAA;AAAA,MACR,MAAA,EAAQ,CAAA,MAAA,EAAS,IAAA,CAAK,KAAK,CAAC,CAAA,8BAAA;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;;;ACJA,IAAM,aAAA,GAAgB,CAAC,KAAA,EAAqB,GAAA,KAC1C,GAAA,CAAI,kBAAkB,qBAAA,CAAsB,KAAK,CAAA,GAAI,mBAAA,CAAoB,KAAK,CAAA;AAEhF,IAAM,gBAAA,GAAmB,CAAC,GAAA,KACxB,GAAA,CAAI,kBACA,gDAAA,GACA,4CAAA;AAEC,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,uBAAuB,CAAC,KAAA,EAAqB,GAAA,KACxD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,yBAAyB,CAAC,KAAA,EAAqB,GAAA,KAC1D,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,qBAAA,GAAiF,CAC5F,KAAA,KACG,OAAA,CAAQ,KAAK;AAEX,IAAM,kBAAkB,CAAC,KAAA,EAAqB,GAAA,KACnD,aAAA,CAAc,OAAO,GAAG;AAEnB,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,sBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,0BAAA,GAA6B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC9F,EAAA,IAAI,CAAC,oBAAA,CAAqB,KAAA,EAAO,GAAG,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,oBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,4BAAA,GAA+B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAChG,EAAA,IAAI,CAAC,sBAAA,CAAuB,KAAA,EAAO,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,uBAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF;AAEO,IAAM,2BAAA,GAA8B,CAAC,KAAA,EAAqB,GAAA,KAAgC;AAC/F,EAAA,IAAI,CAAC,qBAAA,CAAsB,KAAU,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,qBAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AACF;AAEO,IAAM,qBAAA,GAAwB,CAAC,KAAA,EAAqB,GAAA,KAAgC;AACzF,EAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,EAAO,GAAG,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,MAAA,EAAQ,eAAA;AAAA,MACR,MAAA,EAAQ,iBAAiB,GAAG;AAAA,KAC7B,CAAA;AAAA,EACH;AACF","file":"index.js","sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * Stable error contract for permission denials.\n *\n * `PermissionDeniedError` is what every `assertCan*` pair throws on denial. The\n * three public fields are part of the SDK's published contract — consumers\n * (kbc-ui, kai-agent, third-party TS callers) may pattern-match on `action`\n * and surface `reason` in UI, so renames here are breaking changes.\n *\n * PII boundary on `subject`:\n *   `subject` is optional and intended for debugging hints only — admin id,\n *   role name, configuration id, branch id, etc. It MUST NOT carry the full\n *   `StorageToken`, raw tokens, secrets, or any value that could be logged or\n *   surfaced to a user without further redaction.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Baseline admin-role predicates. Token-only — depend purely on the admin\n * role string carried in `StorageToken.admin.role`. Each predicate has an\n * `assertCan*` pair that throws `PermissionDeniedError` with a stable\n * kebab-case `action` field documented per pair.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): string => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n","/**\n * @module domain/permissions/configurations\n *\n * Predicate pairs guarding the Core SDK configuration workflow methods\n * (create / copy / migrate-from-template / purge / assign-folder). Each\n * predicate composes the baseline admin role predicates with the caller-\n * supplied dev-mode flag from `ctx`.\n *\n * Rule shape:\n *   - In a dev branch (`ctx.isDevModeActive === true`) → caller must be a\n *     developer or reviewer.\n *   - In production (`ctx.isDevModeActive === false`) → caller must be a\n *     production manager.\n *   - `canPurgeConfiguration` is **admin-only**, regardless of branch mode.\n *     Purge is destructive and the situational base rule does not apply —\n *     `token.admin.role` is a single scalar, so requiring both \"admin\" and\n *     \"developer/reviewer/productionManager\" simultaneously would be an\n *     impossible conjunction. The `ctx` parameter is accepted for signature\n *     symmetry with the other configuration predicates and ignored.\n *\n * `ctx` is the trailing object argument convention for composed predicates;\n * extra fields land here as future rules grow (see AGENTS.md).\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdmin, isDeveloperOrReviewer, isProductionManager } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Caller-supplied context for configuration predicates.\n *\n * @property isDevModeActive — `true` when the user is operating inside a\n *   development branch (any storage branch other than the protected default /\n *   production branch); `false` when operating on the default branch in\n *   production.\n *\n *   How the caller determines this:\n *   - The active branch comes from the caller's own routing / app state\n *     (e.g. `/branch/:branchId` in kbc-ui).\n *   - A branch is \"dev mode\" when it is **not** the default branch returned by\n *     `apiClient.storage.devBranches.list()` (where `isDefault === true`).\n *   - kbc-ui exposes this through its `RoutesStore.getCurrentRouteParam('branchId')`\n *     compared against the default branch id; the api-client itself stays\n *     isomorphic and never reads that state directly.\n *\n *   Why it changes the rule:\n *   - In dev branches Keboola allows broader write access — `developer` and\n *     `reviewer` roles may create / copy / migrate configurations because the\n *     branch is sandboxed from production.\n *   - On the default branch only `productionManager` (or `admin`) may perform\n *     the same writes, since changes ship live to production.\n */\nexport type ConfigurationCtx = {\n  isDevModeActive: boolean;\n};\n\nconst meetsBaseRule = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  ctx.isDevModeActive ? isDeveloperOrReviewer(token) : isProductionManager(token);\n\nconst baseDenialReason = (ctx: ConfigurationCtx): string =>\n  ctx.isDevModeActive\n    ? 'dev branch requires developer or reviewer role'\n    : 'production requires productionManager role';\n\nexport const canCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const canPurgeConfiguration: (token: StorageToken, ctx: ConfigurationCtx) => boolean = (\n  token,\n) => isAdmin(token);\n\nexport const canAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): boolean =>\n  meetsBaseRule(token, ctx);\n\nexport const assertCanCreateConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCreateConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'create-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanCopyConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canCopyConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'copy-configuration',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanMigrateFromTemplate = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canMigrateFromTemplate(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'migrate-from-template',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n\nexport const assertCanPurgeConfiguration = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canPurgeConfiguration(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'purge-configuration',\n      reason: 'purge requires admin role',\n    });\n  }\n};\n\nexport const assertCanAssignFolder = (token: StorageToken, ctx: ConfigurationCtx): void => {\n  if (!canAssignFolder(token, ctx)) {\n    throw new PermissionDeniedError({\n      action: 'assign-folder',\n      reason: baseDenialReason(ctx),\n    });\n  }\n};\n"]}

package/dist/editor/index.cjs

@@ -1,14 +1,13 @@
 'use strict';
 
-var chunkTXDMA4CT_cjs = require('../chunk-TXDMA4CT.cjs');
-require('../chunk-IDYRJ4K3.cjs');
-require('../chunk-R7MQGDLC.cjs');
+var chunkH466MBV4_cjs = require('../chunk-H466MBV4.cjs');
+require('../chunk-OWGJ3PVA.cjs');
 
 
 
 Object.defineProperty(exports, "createEditorClient", {
   enumerable: true,
-  get: function () { return chunkTXDMA4CT_cjs.createEditorClient; }
+  get: function () { return chunkH466MBV4_cjs.createEditorClient; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/editor/index.js

@@ -1,5 +1,4 @@
-export { createEditorClient } from '../chunk-YIWAUNKU.js';
-import '../chunk-D2SWTZFS.js';
-import '../chunk-SI5TFV5M.js';
+export { createEditorClient } from '../chunk-GOWOD3O4.js';
+import '../chunk-FBGUBMJ7.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/encryption/index.cjs

@@ -1,14 +1,13 @@
 'use strict';
 
-var chunk5XKPYMQL_cjs = require('../chunk-5XKPYMQL.cjs');
-require('../chunk-IDYRJ4K3.cjs');
-require('../chunk-R7MQGDLC.cjs');
+var chunkULZPXG4L_cjs = require('../chunk-ULZPXG4L.cjs');
+require('../chunk-OWGJ3PVA.cjs');
 
 
 
 Object.defineProperty(exports, "createEncryptionClient", {
   enumerable: true,
-  get: function () { return chunk5XKPYMQL_cjs.createEncryptionClient; }
+  get: function () { return chunkULZPXG4L_cjs.createEncryptionClient; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/encryption/index.d.cts

@@ -1,7 +1,8 @@
 import { C as ClientInitOptions } from '../types-BLJoO6YL.cjs';
 import { EncryptQuery, ScopedSecrets } from './types.cjs';
 import 'qs';
-import '../types-Bu8AEdZo.cjs';
+import '../types-CMEwVQ78.cjs';
+import '../backends-BgUzAQul.cjs';
 import '../types-jKnx7Tm_.cjs';
 
 declare const createEncryptionClient: ({ baseUrl, middlewares, }: Omit<ClientInitOptions, "token">) => {

package/dist/encryption/index.d.ts

@@ -1,7 +1,8 @@
 import { C as ClientInitOptions } from '../types-BLJoO6YL.js';
 import { EncryptQuery, ScopedSecrets } from './types.js';
 import 'qs';
-import '../types-bjHzGr0s.js';
+import '../types-GmAeMsok.js';
+import '../backends-BgUzAQul.js';
 import '../types-jKnx7Tm_.js';
 
 declare const createEncryptionClient: ({ baseUrl, middlewares, }: Omit<ClientInitOptions, "token">) => {

package/dist/encryption/index.js

@@ -1,5 +1,4 @@
-export { createEncryptionClient } from '../chunk-WILFTDTS.js';
-import '../chunk-D2SWTZFS.js';
-import '../chunk-SI5TFV5M.js';
+export { createEncryptionClient } from '../chunk-ATVNCGTO.js';
+import '../chunk-FBGUBMJ7.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/encryption/types.d.cts

@@ -1,4 +1,5 @@
-import { P as ProjectId } from '../types-Bu8AEdZo.cjs';
+import { P as ProjectId } from '../types-CMEwVQ78.cjs';
+import '../backends-BgUzAQul.cjs';
 import '../types-jKnx7Tm_.cjs';
 
 type BranchType = 'default' | 'dev';

package/dist/encryption/types.d.ts

@@ -1,4 +1,5 @@
-import { P as ProjectId } from '../types-bjHzGr0s.js';
+import { P as ProjectId } from '../types-GmAeMsok.js';
+import '../backends-BgUzAQul.js';
 import '../types-jKnx7Tm_.js';
 
 type BranchType = 'default' | 'dev';

package/dist/import/index.cjs

@@ -1,14 +1,13 @@
 'use strict';
 
-var chunkPWA6XFXA_cjs = require('../chunk-PWA6XFXA.cjs');
-require('../chunk-IDYRJ4K3.cjs');
-require('../chunk-R7MQGDLC.cjs');
+var chunkYTF4RQ52_cjs = require('../chunk-YTF4RQ52.cjs');
+require('../chunk-OWGJ3PVA.cjs');
 
 
 
 Object.defineProperty(exports, "createImportClient", {
   enumerable: true,
-  get: function () { return chunkPWA6XFXA_cjs.createImportClient; }
+  get: function () { return chunkYTF4RQ52_cjs.createImportClient; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/import/index.js

@@ -1,5 +1,4 @@
-export { createImportClient } from '../chunk-EEG7YZUY.js';
-import '../chunk-D2SWTZFS.js';
-import '../chunk-SI5TFV5M.js';
+export { createImportClient } from '../chunk-RHZK7AL7.js';
+import '../chunk-FBGUBMJ7.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map