@vertracloud/api-types 0.3.6 → 0.4.0

package/payloads/v1/index.mjs

@@ -38,6 +38,8 @@ var APIApiKeyScope = {
   WORKSPACES_WRITE: "workspaces:write",
   WORKSPACES_DELETE: "workspaces:delete",
   WORKSPACES_INVITES: "workspaces:invites",
+  BLOB_READ: "blob:read",
+  BLOB_WRITE: "blob:write",
   BILLING_READ: "billing:read",
   BILLING_WRITE: "billing:write",
   REDEEM_WRITE: "redeem:write"
@@ -222,6 +224,47 @@ var API_KEY_SCOPES = {
       { method: "POST", path: "/v1/workspaces/invites/:token/decline" }
     ]
   },
+  /** Blob Storage (`blob.vertracloud.app`). Upload tokens (`vcup_`) are a separate credential, not a scope. */
+  "blob:read": {
+    group: "blob",
+    routes: [
+      { method: "GET", path: "/v1/blob/objects" },
+      { method: "GET", path: "/v1/blob/objects/:object_id" },
+      { method: "GET", path: "/v1/blob/objects/:object_id/download" },
+      { method: "GET", path: "/v1/blob/shares" },
+      { method: "GET", path: "/v1/blob/rules" },
+      { method: "GET", path: "/v1/blob/stats" },
+      { method: "GET", path: "/v1/blob/s3/credentials" },
+      { method: "GET", path: "/v1/blob/domains" }
+    ]
+  },
+  "blob:write": {
+    group: "blob",
+    routes: [
+      { method: "POST", path: "/v1/blob/objects" },
+      { method: "PATCH", path: "/v1/blob/objects" },
+      { method: "PATCH", path: "/v1/blob/objects/:object_id" },
+      { method: "POST", path: "/v1/blob/objects/copy" },
+      { method: "DELETE", path: "/v1/blob/objects" },
+      { method: "DELETE", path: "/v1/blob/objects/:object_id" },
+      { method: "POST", path: "/v1/blob/uploads" },
+      { method: "GET", path: "/v1/blob/uploads" },
+      { method: "GET", path: "/v1/blob/uploads/:upload_id" },
+      { method: "POST", path: "/v1/blob/uploads/:upload_id/parts" },
+      { method: "POST", path: "/v1/blob/uploads/:upload_id/complete" },
+      { method: "DELETE", path: "/v1/blob/uploads/:upload_id" },
+      { method: "POST", path: "/v1/blob/shares" },
+      { method: "DELETE", path: "/v1/blob/shares/:share_id" },
+      { method: "PUT", path: "/v1/blob/rules" },
+      { method: "PUT", path: "/v1/blob/rules/:prefix" },
+      { method: "DELETE", path: "/v1/blob/rules/:prefix" },
+      { method: "POST", path: "/v1/blob/upload-tokens" },
+      { method: "POST", path: "/v1/blob/domains" },
+      { method: "POST", path: "/v1/blob/domains/:domain_id/verify" },
+      { method: "PATCH", path: "/v1/blob/domains/:domain_id" },
+      { method: "DELETE", path: "/v1/blob/domains/:domain_id" }
+    ]
+  },
   "billing:read": {
     group: "billing",
     routes: [
@@ -269,6 +312,8 @@ var WorkspacePermission = {
   DATABASES_DELETE: "databases:delete",
   SNAPSHOTS_READ: "snapshots:read",
   SNAPSHOTS_MANAGE: "snapshots:manage",
+  BLOB_READ: "blob:read",
+  BLOB_MANAGE: "blob:manage",
   MEMBERS_READ: "members:read",
   MEMBERS_MANAGE: "members:manage",
   ROLES_MANAGE: "roles:manage",
@@ -289,6 +334,8 @@ var WORKSPACE_PERMISSIONS = {
   "databases:delete": { group: "databases" },
   "snapshots:read": { group: "snapshots" },
   "snapshots:manage": { group: "snapshots" },
+  "blob:read": { group: "blob" },
+  "blob:manage": { group: "blob" },
   "members:read": { group: "members" },
   "members:manage": { group: "members" },
   "roles:manage": { group: "roles" },
@@ -304,7 +351,7 @@ var WorkspaceRolePreset = {
 function workspacePresetPermissions(preset) {
   switch (preset) {
     case "admin":
-      return WORKSPACE_PERMISSION_LIST.filter((p) => p !== "snapshots:manage");
+      return WORKSPACE_PERMISSION_LIST.filter((p) => p !== "snapshots:manage" && p !== "blob:read" && p !== "blob:manage");
     case "developer":
       return ["apps:read", "apps:manage", "apps:lifecycle", "apps:envs", "apps:files", "databases:read", "databases:manage", "databases:lifecycle", "databases:credentials", "databases:data", "snapshots:read", "members:read", "activities:read"];
     case "operator":
@@ -389,6 +436,52 @@ var API_ERROR_CODES = {
   APP_NOT_PUBLISHED: "APP_NOT_PUBLISHED",
   APP_ALREADY_IN_WORKSPACE: "APP_ALREADY_IN_WORKSPACE",
   APP_NOT_FOUND_IN_WORKSPACE: "APP_NOT_FOUND_IN_WORKSPACE",
+  /** 404 — the object does not exist or belongs to another account. */
+  BLOB_OBJECT_NOT_FOUND: "BLOB_OBJECT_NOT_FOUND",
+  /** 409 — the path is taken and `overwrite` is not set. */
+  BLOB_OBJECT_ALREADY_EXISTS: "BLOB_OBJECT_ALREADY_EXISTS",
+  /** 404 — the upload does not exist, is not yours, or is already completed or aborted. */
+  BLOB_UPLOAD_NOT_FOUND: "BLOB_UPLOAD_NOT_FOUND",
+  /** 410 — the upload passed its deadline. */
+  BLOB_UPLOAD_EXPIRED: "BLOB_UPLOAD_EXPIRED",
+  /** 409 — parts are missing or the stored size differs from the declared size. */
+  BLOB_UPLOAD_INCOMPLETE: "BLOB_UPLOAD_INCOMPLETE",
+  /** 409 — more uploads open than the plan allows. */
+  BLOB_UPLOAD_LIMIT: "BLOB_UPLOAD_LIMIT",
+  /** 400 — the SHA-256 sent does not match the file. */
+  BLOB_CHECKSUM_MISMATCH: "BLOB_CHECKSUM_MISMATCH",
+  /** 413 — the file exceeds the plan, single-request upload, folder rule or upload token limit. */
+  BLOB_FILE_TOO_LARGE: "BLOB_FILE_TOO_LARGE",
+  /** 403 — Blob Storage is suspended for the account (grace period, abuse or deletion). */
+  BLOB_NAMESPACE_SUSPENDED: "BLOB_NAMESPACE_SUSPENDED",
+  /** 401 — the upload token does not exist, expired or was revoked. */
+  BLOB_UPLOAD_TOKEN_INVALID: "BLOB_UPLOAD_TOKEN_INVALID",
+  /** 401 — the upload token has no uses left. */
+  BLOB_UPLOAD_TOKEN_EXHAUSTED: "BLOB_UPLOAD_TOKEN_EXHAUSTED",
+  /** 403 — upload tokens only work on the upload routes. */
+  BLOB_UPLOAD_TOKEN_NOT_ALLOWED: "BLOB_UPLOAD_TOKEN_NOT_ALLOWED",
+  /** 403 — the path, size or extension is outside what the upload token allows. */
+  BLOB_UPLOAD_TOKEN_CONSTRAINT: "BLOB_UPLOAD_TOKEN_CONSTRAINT",
+  /** 404 — the share does not exist, was revoked or expired. */
+  BLOB_SHARE_NOT_FOUND: "BLOB_SHARE_NOT_FOUND",
+  /** 410 — the share reached its download limit. */
+  BLOB_SHARE_EXHAUSTED: "BLOB_SHARE_EXHAUSTED",
+  /** 401 — wrong share password. */
+  BLOB_SHARE_PASSWORD_INVALID: "BLOB_SHARE_PASSWORD_INVALID",
+  /** 409 — the `If-Match` of the rule list is outdated; read it again. */
+  BLOB_RULES_CONFLICT: "BLOB_RULES_CONFLICT",
+  /** 409 — more folder rules than the plan allows. */
+  BLOB_RULE_LIMIT: "BLOB_RULE_LIMIT",
+  /** 409 — more custom domains than the plan allows. */
+  BLOB_CUSTOM_DOMAIN_LIMIT: "BLOB_CUSTOM_DOMAIN_LIMIT",
+  /** 409 — the hostname is already in use. */
+  BLOB_CUSTOM_DOMAIN_TAKEN: "BLOB_CUSTOM_DOMAIN_TAKEN",
+  /** 404 — the domain does not exist or belongs to another account. */
+  BLOB_CUSTOM_DOMAIN_NOT_FOUND: "BLOB_CUSTOM_DOMAIN_NOT_FOUND",
+  /** 422 — the file extension is blocked, outside the rule or token, or the content is an executable. */
+  BLOCKED_FILE_TYPE: "BLOCKED_FILE_TYPE",
+  /** 403 — the upload would exceed the storage quota. */
+  STORAGE_QUOTA_EXCEEDED: "STORAGE_QUOTA_EXCEEDED",
   BUILD_FAILED: "BUILD_FAILED",
   BUILD_TIMEOUT: "BUILD_TIMEOUT",
   /** 400 — the order needs complete billing details for the service invoice (name, address and, in Brazil, CPF/CNPJ). Fill them with `PUT /v1/users/me/billing`. */
@@ -644,6 +737,26 @@ var BillingTaxIdType = {
   CNPJ: "cnpj"
 };
 
+// payloads/v1/blob.ts
+var BlobVisibility = { PUBLIC: "public", PRIVATE: "private" };
+var BlobContentDisposition = {
+  INLINE: "inline",
+  ATTACHMENT: "attachment"
+};
+var BlobUploadMode = { SINGLE: "single", MULTIPART: "multipart" };
+var BlobUploadStatus = {
+  PENDING: "pending",
+  COMPLETED: "completed",
+  ABORTED: "aborted",
+  EXPIRED: "expired"
+};
+var BlobCustomDomainStatus = {
+  PENDING: "pending",
+  ACTIVE: "active",
+  FAILED: "failed",
+  SUSPENDED: "suspended"
+};
+
 // payloads/v1/database.ts
 var DatabaseType = {
   POSTGRESQL: 1,
@@ -782,6 +895,11 @@ export {
   ApplicationVersion,
   ApplicationZeroDowntime,
   BillingTaxIdType,
+  BlobContentDisposition,
+  BlobCustomDomainStatus,
+  BlobUploadMode,
+  BlobUploadStatus,
+  BlobVisibility,
   DatabaseCluster,
   DatabaseFilterOperator,
   DatabaseRedisKeyType,

package/payloads/v1/workspace.d.ts

@@ -10,7 +10,7 @@ import './api-error.js';
  * owner only, never through a permission.
  * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get
  */
-type WorkspacePermission = "apps:read" | "apps:manage" | "apps:lifecycle" | "apps:envs" | "apps:files" | "apps:delete" | "databases:read" | "databases:manage" | "databases:lifecycle" | "databases:credentials" | "databases:data" | "databases:delete" | "snapshots:read" | "snapshots:manage" | "members:read" | "members:manage" | "roles:manage" | "activities:read";
+type WorkspacePermission = "apps:read" | "apps:manage" | "apps:lifecycle" | "apps:envs" | "apps:files" | "apps:delete" | "databases:read" | "databases:manage" | "databases:lifecycle" | "databases:credentials" | "databases:data" | "databases:delete" | "snapshots:read" | "snapshots:manage" | "blob:read" | "blob:manage" | "members:read" | "members:manage" | "roles:manage" | "activities:read";
 declare const WorkspacePermission: {
     readonly APPS_READ: "apps:read";
     readonly APPS_MANAGE: "apps:manage";
@@ -26,13 +26,15 @@ declare const WorkspacePermission: {
     readonly DATABASES_DELETE: "databases:delete";
     readonly SNAPSHOTS_READ: "snapshots:read";
     readonly SNAPSHOTS_MANAGE: "snapshots:manage";
+    readonly BLOB_READ: "blob:read";
+    readonly BLOB_MANAGE: "blob:manage";
     readonly MEMBERS_READ: "members:read";
     readonly MEMBERS_MANAGE: "members:manage";
     readonly ROLES_MANAGE: "roles:manage";
     readonly ACTIVITIES_READ: "activities:read";
 };
 interface WorkspacePermissionEntry {
-    group: "apps" | "databases" | "snapshots" | "members" | "roles" | "activities";
+    group: "apps" | "databases" | "snapshots" | "blob" | "members" | "roles" | "activities";
 }
 /**
  * Closed catalog of workspace permissions. A member whose role lacks the permission a route
@@ -54,7 +56,8 @@ declare const WorkspaceRolePreset: {
 };
 /**
  * Permissions a seed role gets when the workspace is created. `admin` does NOT include
- * `snapshots:manage` (restoring/deleting snapshots is destructive); the owner can grant it per role.
+ * `snapshots:manage` (restoring/deleting snapshots is destructive) nor `blob:read`/`blob:manage`
+ * (Blob Storage files are the owner's data); the owner can grant them per role.
  */
 declare function workspacePresetPermissions(preset: WorkspaceRolePreset): WorkspacePermission[];
 /**

package/payloads/v1/workspace.js

@@ -50,6 +50,8 @@ var WorkspacePermission = {
   DATABASES_DELETE: "databases:delete",
   SNAPSHOTS_READ: "snapshots:read",
   SNAPSHOTS_MANAGE: "snapshots:manage",
+  BLOB_READ: "blob:read",
+  BLOB_MANAGE: "blob:manage",
   MEMBERS_READ: "members:read",
   MEMBERS_MANAGE: "members:manage",
   ROLES_MANAGE: "roles:manage",
@@ -70,6 +72,8 @@ var WORKSPACE_PERMISSIONS = {
   "databases:delete": { group: "databases" },
   "snapshots:read": { group: "snapshots" },
   "snapshots:manage": { group: "snapshots" },
+  "blob:read": { group: "blob" },
+  "blob:manage": { group: "blob" },
   "members:read": { group: "members" },
   "members:manage": { group: "members" },
   "roles:manage": { group: "roles" },
@@ -85,7 +89,7 @@ var WorkspaceRolePreset = {
 function workspacePresetPermissions(preset) {
   switch (preset) {
     case "admin":
-      return WORKSPACE_PERMISSION_LIST.filter((p) => p !== "snapshots:manage");
+      return WORKSPACE_PERMISSION_LIST.filter((p) => p !== "snapshots:manage" && p !== "blob:read" && p !== "blob:manage");
     case "developer":
       return ["apps:read", "apps:manage", "apps:lifecycle", "apps:envs", "apps:files", "databases:read", "databases:manage", "databases:lifecycle", "databases:credentials", "databases:data", "snapshots:read", "members:read", "activities:read"];
     case "operator":

package/payloads/v1/workspace.js.map

@@ -1 +1 @@
-{"version":3,"sources":["workspace.ts"],"sourcesContent":["import type { ISODateString, SnowFlake, UserPlan } from \"../../v1\";\nimport type { APIApplication, APIDatabase } from \"./index\";\n\n/**\n * Granular workspace permission. Display group in `WORKSPACE_PERMISSIONS`.\n * The owner (`owner_id`) has no entry here: owner-only actions (rename/delete the workspace,\n * link/unlink projects, deploy webhook, web publishing) are allowed for the\n * owner only, never through a permission.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport type WorkspacePermission =\n\t| \"apps:read\"\n\t| \"apps:manage\"\n\t| \"apps:lifecycle\"\n\t| \"apps:envs\"\n\t| \"apps:files\"\n\t| \"apps:delete\"\n\t| \"databases:read\"\n\t| \"databases:manage\"\n\t| \"databases:lifecycle\"\n\t| \"databases:credentials\"\n\t| \"databases:data\"\n\t| \"databases:delete\"\n\t| \"snapshots:read\"\n\t| \"snapshots:manage\"\n\t| \"members:read\"\n\t| \"members:manage\"\n\t| \"roles:manage\"\n\t| \"activities:read\";\n\nexport const WorkspacePermission = {\n\tAPPS_READ: \"apps:read\",\n\tAPPS_MANAGE: \"apps:manage\",\n\tAPPS_LIFECYCLE: \"apps:lifecycle\",\n\tAPPS_ENVS: \"apps:envs\",\n\tAPPS_FILES: \"apps:files\",\n\tAPPS_DELETE: \"apps:delete\",\n\tDATABASES_READ: \"databases:read\",\n\tDATABASES_MANAGE: \"databases:manage\",\n\tDATABASES_LIFECYCLE: \"databases:lifecycle\",\n\tDATABASES_CREDENTIALS: \"databases:credentials\",\n\tDATABASES_DATA: \"databases:data\",\n\tDATABASES_DELETE: \"databases:delete\",\n\tSNAPSHOTS_READ: \"snapshots:read\",\n\tSNAPSHOTS_MANAGE: \"snapshots:manage\",\n\tMEMBERS_READ: \"members:read\",\n\tMEMBERS_MANAGE: \"members:manage\",\n\tROLES_MANAGE: \"roles:manage\",\n\tACTIVITIES_READ: \"activities:read\",\n} as const satisfies Record<string, WorkspacePermission>;\n\nexport interface WorkspacePermissionEntry {\n\tgroup: \"apps\" | \"databases\" | \"snapshots\" | \"members\" | \"roles\" | \"activities\";\n}\n\n/**\n * Closed catalog of workspace permissions. A member whose role lacks the permission a route\n * requires gets 403 `WORKSPACE_PERMISSION_DENIED`.\n */\nexport const WORKSPACE_PERMISSIONS: Record<WorkspacePermission, WorkspacePermissionEntry> = {\n\t\"apps:read\": { group: \"apps\" },\n\t\"apps:manage\": { group: \"apps\" },\n\t\"apps:lifecycle\": { group: \"apps\" },\n\t\"apps:envs\": { group: \"apps\" },\n\t\"apps:files\": { group: \"apps\" },\n\t\"apps:delete\": { group: \"apps\" },\n\t\"databases:read\": { group: \"databases\" },\n\t\"databases:manage\": { group: \"databases\" },\n\t\"databases:lifecycle\": { group: \"databases\" },\n\t\"databases:credentials\": { group: \"databases\" },\n\t\"databases:data\": { group: \"databases\" },\n\t\"databases:delete\": { group: \"databases\" },\n\t\"snapshots:read\": { group: \"snapshots\" },\n\t\"snapshots:manage\": { group: \"snapshots\" },\n\t\"members:read\": { group: \"members\" },\n\t\"members:manage\": { group: \"members\" },\n\t\"roles:manage\": { group: \"roles\" },\n\t\"activities:read\": { group: \"activities\" },\n};\n\nexport const WORKSPACE_PERMISSION_LIST = Object.keys(WORKSPACE_PERMISSIONS) as WorkspacePermission[];\n\n/**\n * Seed role, created together with the workspace. It can be renamed and deleted like any other\n * role (it becomes a regular role; `preset` is not restored) and counts toward the plan's role limit.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport type WorkspaceRolePreset = \"admin\" | \"developer\" | \"operator\" | \"viewer\";\nexport const WorkspaceRolePreset = {\n\tAdmin: \"admin\",\n\tDeveloper: \"developer\",\n\tOperator: \"operator\",\n\tViewer: \"viewer\",\n} as const satisfies Record<string, WorkspaceRolePreset>;\n\n/**\n * Permissions a seed role gets when the workspace is created. `admin` does NOT include\n * `snapshots:manage` (restoring/deleting snapshots is destructive); the owner can grant it per role.\n */\nexport function workspacePresetPermissions(preset: WorkspaceRolePreset): WorkspacePermission[] {\n\tswitch (preset) {\n\t\tcase \"admin\":\n\t\t\treturn WORKSPACE_PERMISSION_LIST.filter((p) => p !== \"snapshots:manage\");\n\t\tcase \"developer\":\n\t\t\treturn [\"apps:read\", \"apps:manage\", \"apps:lifecycle\", \"apps:envs\", \"apps:files\", \"databases:read\", \"databases:manage\", \"databases:lifecycle\", \"databases:credentials\", \"databases:data\", \"snapshots:read\", \"members:read\", \"activities:read\"];\n\t\tcase \"operator\":\n\t\t\treturn [\"apps:read\", \"apps:lifecycle\", \"databases:read\", \"databases:lifecycle\", \"snapshots:read\", \"members:read\", \"activities:read\"];\n\t\tcase \"viewer\":\n\t\t\treturn [\"apps:read\", \"databases:read\", \"snapshots:read\", \"members:read\", \"activities:read\"];\n\t}\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/roles/list\n */\nexport interface APIWorkspaceRole {\n\tid: SnowFlake;\n\tworkspace_id: SnowFlake;\n\tname: string;\n\tpermissions: WorkspacePermission[];\n\t/** Seed role it came from; `null` for a manually created role. Informational only. */\n\tpreset: WorkspaceRolePreset | null;\n\t/** Display order. */\n\tposition: number;\n\tmembers_count: number;\n\tcreated_at: ISODateString;\n\tupdated_at: ISODateString;\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/members/list\n */\nexport interface APIWorkspaceMember {\n\tuser_id: SnowFlake;\n\trole_id: SnowFlake;\n\trole_name: string;\n\tjoined_at: ISODateString;\n\t/** When the member's access expires; `null` = never. */\n\texpires_at: ISODateString | null;\n\tuser: {\n\t\tdisplay_name: string;\n\t\temail: string;\n\t};\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport interface APIWorkspace {\n\tid: SnowFlake;\n\tname: string;\n\tdescription: string | null;\n\towner_id: SnowFlake;\n\towner: { display_name: string };\n\tmembers_count: number;\n\t/** Soft delete timestamp. `null` = active. */\n\tdeleted_at: ISODateString | null;\n\t/**\n\t * `true` when the OWNER's plan does not include workspaces (it expired or was downgraded):\n\t * reads keep working, every write returns `PLAN_RESTRICTED_FEATURE`. Nobody is removed — the\n\t * owner must upgrade to unfreeze it.\n\t */\n\tfrozen: boolean;\n\tcreated_at: ISODateString;\n\tupdated_at: ISODateString;\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport interface APIWorkspaceInfoResponse extends APIWorkspace {\n\tmembers: APIWorkspaceMember[];\n\troles: APIWorkspaceRole[];\n\tapplications: APIApplication[];\n\tdatabases: APIDatabase[];\n\t/** Resolved permissions of the caller. The owner always gets the full list, regardless of role. */\n\tpermissions: WorkspacePermission[];\n\tis_owner: boolean;\n\t/** Owner's plan — it determines which features the workspace has. */\n\towner_plan_id: UserPlan;\n\t/** The caller's saved resource organization (folders, favorites) in this workspace. */\n\tresource_organization: APIWorkspaceResourceOrganization;\n}\n\nexport type WorkspaceResourceType = \"application\" | \"database\";\nexport const WorkspaceResourceType = { Application: \"application\", Database: \"database\" } as const satisfies Record<string, WorkspaceResourceType>;\n\nexport type WorkspaceResourceOrganizationScope = \"personal\" | \"workspace\";\nexport const WorkspaceResourceOrganizationScope = { Personal: \"personal\", Workspace: \"workspace\" } as const satisfies Record<string, WorkspaceResourceOrganizationScope>;\n\nexport type WorkspaceFolderColor = \"neutral\" | \"red\" | \"orange\" | \"yellow\" | \"green\" | \"blue\" | \"purple\";\nexport const WorkspaceFolderColor = { Neutral: \"neutral\", Red: \"red\", Orange: \"orange\", Yellow: \"yellow\", Green: \"green\", Blue: \"blue\", Purple: \"purple\" } as const satisfies Record<string, WorkspaceFolderColor>;\nexport const WORKSPACE_FOLDER_COLORS = Object.values(WorkspaceFolderColor) as WorkspaceFolderColor[];\n\nexport interface APIWorkspaceResourceRef {\n\tresource_type: WorkspaceResourceType;\n\tresource_id: SnowFlake;\n}\n\nexport interface APIWorkspaceFolderItem extends APIWorkspaceResourceRef {\n\tposition: number;\n}\n\nexport interface APIWorkspaceResourceFolder {\n\tid: SnowFlake;\n\tname: string;\n\tcolor: WorkspaceFolderColor;\n\tposition: number;\n\tresources: APIWorkspaceFolderItem[];\n\tcreated_at: ISODateString;\n\tupdated_at: ISODateString;\n}\n\nexport interface APIWorkspaceFavorite extends APIWorkspaceResourceRef {\n\tposition: number;\n\tcreated_at: ISODateString;\n}\n\nexport interface APIWorkspaceResourceOrganization {\n\tscope: WorkspaceResourceOrganizationScope;\n\tuser_id: SnowFlake;\n\tworkspace_id: SnowFlake | null;\n\tfolders: APIWorkspaceResourceFolder[];\n\tfavorites: APIWorkspaceFavorite[];\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/invites/list\n */\nexport type WorkspaceInviteKind = \"email\" | \"link\";\nexport const WorkspaceInviteKind = { Email: \"email\", Link: \"link\" } as const satisfies Record<string, WorkspaceInviteKind>;\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/invites/list\n */\nexport interface APIWorkspaceInvite {\n\tid: SnowFlake;\n\tworkspace_id: SnowFlake;\n\tkind: WorkspaceInviteKind;\n\t/** Bound e-mail; only for `kind: \"email\"`. */\n\temail: string | null;\n\trole_id: SnowFlake;\n\trole_name: string;\n\tinvited_by: { id: SnowFlake; display_name: string };\n\texpires_at: ISODateString;\n\taccepted_at: ISODateString | null;\n\trevoked_at: ISODateString | null;\n\tuses: number;\n\t/** Only for `kind: \"link\"`; `null` = unlimited uses. */\n\tmax_uses: number | null;\n\t/** Access expiration applied to members who join through this invite; `null` = never. */\n\texpires_in_days: number | null;\n\tcreated_at: ISODateString;\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/invites/create\n */\nexport interface APIWorkspaceInviteCreated extends APIWorkspaceInvite {\n\t/** Invite URL; only for `kind: \"link\"`, shown once. */\n\turl: string | null;\n}\n\n/**\n * What the invitee sees before accepting (`GET /v1/workspaces/invites/:token`).\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/invites/preview\n */\nexport interface APIWorkspaceInvitePreview {\n\tworkspace: { id: SnowFlake; name: string };\n\tinviter: { display_name: string };\n\trole_name: string;\n\tkind: WorkspaceInviteKind;\n\texpires_at: ISODateString;\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/action-requests/list\n */\nexport type WorkspaceActionRequestAction = \"app_delete\" | \"database_delete\" | \"snapshot_create\" | \"snapshot_restore\";\nexport const WorkspaceActionRequestAction = {\n\tAppDelete: \"app_delete\",\n\tDatabaseDelete: \"database_delete\",\n\tSnapshotCreate: \"snapshot_create\",\n\tSnapshotRestore: \"snapshot_restore\",\n} as const satisfies Record<string, WorkspaceActionRequestAction>;\n\nexport type WorkspaceActionRequestStatus = \"pending\" | \"approved\" | \"rejected\" | \"expired\";\nexport const WorkspaceActionRequestStatus = {\n\tPending: \"pending\",\n\tApproved: \"approved\",\n\tRejected: \"rejected\",\n\tExpired: \"expired\",\n} as const satisfies Record<string, WorkspaceActionRequestStatus>;\n\n/**\n * `params` of an action request, per `action`. Actions without parameters take an empty object;\n * unknown keys are rejected with `WORKSPACE_ACTION_INVALID_PARAMS`.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/action-requests/create\n */\nexport interface WorkspaceActionRequestParams {\n\tapp_delete: Record<string, never>;\n\tdatabase_delete: Record<string, never>;\n\tsnapshot_create: Record<string, never>;\n\t/** The snapshot must belong to the request's resource. */\n\tsnapshot_restore: { snapshot_id: SnowFlake };\n}\n\ninterface APIWorkspaceActionRequestBase {\n\tid: SnowFlake;\n\tworkspace_id: SnowFlake;\n\tresource_type: WorkspaceResourceType;\n\tresource_id: SnowFlake;\n\tresource_name: string | null;\n\tstatus: WorkspaceActionRequestStatus;\n\trequested_by: { id: SnowFlake; display_name: string };\n\tdecided_by: { id: SnowFlake; display_name: string } | null;\n\tdecided_at: ISODateString | null;\n\texpires_at: ISODateString;\n\tcreated_at: ISODateString;\n}\n\n/**\n * A request for a destructive/sensitive action made by a member who lacks its permission, to be\n * approved by someone who has it. Expires after 24 h without a decision. Discriminated by `action`,\n * which decides the shape of `params`.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/action-requests/list\n */\nexport type APIWorkspaceActionRequest = {\n\t[A in WorkspaceActionRequestAction]: APIWorkspaceActionRequestBase & { action: A; params: WorkspaceActionRequestParams[A] };\n}[WorkspaceActionRequestAction];\n\n/**\n * Workspace error codes. Stable English sentinels returned in `code`; clients are expected to\n * translate them.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport const WORKSPACE_ERROR_CODES = {\n\tWORKSPACE_NOT_FOUND: \"WORKSPACE_NOT_FOUND\",\n\tWORKSPACE_NAME_ALREADY_EXISTS: \"WORKSPACE_NAME_ALREADY_EXISTS\",\n\tWORKSPACE_MEMBER_LIMIT_REACHED: \"WORKSPACE_MEMBER_LIMIT_REACHED\",\n\tWORKSPACE_ROLE_LIMIT_REACHED: \"WORKSPACE_ROLE_LIMIT_REACHED\",\n\tWORKSPACE_ROLE_IN_USE: \"WORKSPACE_ROLE_IN_USE\",\n\tWORKSPACE_ROLE_NOT_FOUND: \"WORKSPACE_ROLE_NOT_FOUND\",\n\tWORKSPACE_ROLE_NAME_ALREADY_EXISTS: \"WORKSPACE_ROLE_NAME_ALREADY_EXISTS\",\n\tWORKSPACE_PERMISSION_DENIED: \"WORKSPACE_PERMISSION_DENIED\",\n\tWORKSPACE_PERMISSION_ESCALATION: \"WORKSPACE_PERMISSION_ESCALATION\",\n\tWORKSPACE_INVITE_NOT_FOUND: \"WORKSPACE_INVITE_NOT_FOUND\",\n\tWORKSPACE_INVITE_EXPIRED: \"WORKSPACE_INVITE_EXPIRED\",\n\tWORKSPACE_INVITE_EMAIL_MISMATCH: \"WORKSPACE_INVITE_EMAIL_MISMATCH\",\n\t/** 400 — the invited account turned off workspace invites by email. */\n\tWORKSPACE_INVITES_DISABLED: \"WORKSPACE_INVITES_DISABLED\",\n\t/** 409 — the account is already the owner or a member of the workspace. */\n\tWORKSPACE_ALREADY_MEMBER: \"WORKSPACE_ALREADY_MEMBER\",\n\tWORKSPACE_OWNER_ONLY: \"WORKSPACE_OWNER_ONLY\",\n\tWORKSPACE_ACTION_REQUEST_NOT_FOUND: \"WORKSPACE_ACTION_REQUEST_NOT_FOUND\",\n\t/** 410 — the request expired before anyone decided on it. */\n\tWORKSPACE_ACTION_REQUEST_EXPIRED: \"WORKSPACE_ACTION_REQUEST_EXPIRED\",\n\t/** 409 — the request was already approved or rejected. */\n\tWORKSPACE_ACTION_REQUEST_ALREADY_DECIDED: \"WORKSPACE_ACTION_REQUEST_ALREADY_DECIDED\",\n\t/** 400 — the requester already has the permission; perform the action directly. */\n\tWORKSPACE_ACTION_NOT_NEEDED: \"WORKSPACE_ACTION_NOT_NEEDED\",\n\t/** 400 — the request `params` failed the action's validation (e.g. a snapshot of another resource). */\n\tWORKSPACE_ACTION_INVALID_PARAMS: \"WORKSPACE_ACTION_INVALID_PARAMS\",\n\t/** 409 — a pending request already exists for the same action on the same resource. */\n\tWORKSPACE_ACTION_REQUEST_PENDING: \"WORKSPACE_ACTION_REQUEST_PENDING\",\n\tWORKSPACE_RESOURCE_FOLDER_NOT_FOUND: \"WORKSPACE_RESOURCE_FOLDER_NOT_FOUND\",\n\tWORKSPACE_RESOURCE_FOLDER_NAME_CONFLICT: \"WORKSPACE_RESOURCE_FOLDER_NAME_CONFLICT\",\n\tWORKSPACE_RESOURCE_NOT_FOUND: \"WORKSPACE_RESOURCE_NOT_FOUND\",\n\tPLAN_RESTRICTED_FEATURE: \"PLAN_RESTRICTED_FEATURE\",\n} as const;\nexport type WorkspaceErrorCode = (typeof WORKSPACE_ERROR_CODES)[keyof typeof WORKSPACE_ERROR_CODES];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BO,IAAM,sBAAsB;AAAA,EAClC,WAAW;AAAA,EACX,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,iBAAiB;AAClB;AAUO,IAAM,wBAA+E;AAAA,EAC3F,aAAa,EAAE,OAAO,OAAO;AAAA,EAC7B,eAAe,EAAE,OAAO,OAAO;AAAA,EAC/B,kBAAkB,EAAE,OAAO,OAAO;AAAA,EAClC,aAAa,EAAE,OAAO,OAAO;AAAA,EAC7B,cAAc,EAAE,OAAO,OAAO;AAAA,EAC9B,eAAe,EAAE,OAAO,OAAO;AAAA,EAC/B,kBAAkB,EAAE,OAAO,YAAY;AAAA,EACvC,oBAAoB,EAAE,OAAO,YAAY;AAAA,EACzC,uBAAuB,EAAE,OAAO,YAAY;AAAA,EAC5C,yBAAyB,EAAE,OAAO,YAAY;AAAA,EAC9C,kBAAkB,EAAE,OAAO,YAAY;AAAA,EACvC,oBAAoB,EAAE,OAAO,YAAY;AAAA,EACzC,kBAAkB,EAAE,OAAO,YAAY;AAAA,EACvC,oBAAoB,EAAE,OAAO,YAAY;AAAA,EACzC,gBAAgB,EAAE,OAAO,UAAU;AAAA,EACnC,kBAAkB,EAAE,OAAO,UAAU;AAAA,EACrC,gBAAgB,EAAE,OAAO,QAAQ;AAAA,EACjC,mBAAmB,EAAE,OAAO,aAAa;AAC1C;AAEO,IAAM,4BAA4B,OAAO,KAAK,qBAAqB;AAQnE,IAAM,sBAAsB;AAAA,EAClC,OAAO;AAAA,EACP,WAAW;AAAA,EACX,UAAU;AAAA,EACV,QAAQ;AACT;AAMO,SAAS,2BAA2B,QAAoD;AAC9F,UAAQ,QAAQ;AAAA,IACf,KAAK;AACJ,aAAO,0BAA0B,OAAO,CAAC,MAAM,MAAM,kBAAkB;AAAA,IACxE,KAAK;AACJ,aAAO,CAAC,aAAa,eAAe,kBAAkB,aAAa,cAAc,kBAAkB,oBAAoB,uBAAuB,yBAAyB,kBAAkB,kBAAkB,gBAAgB,iBAAiB;AAAA,IAC7O,KAAK;AACJ,aAAO,CAAC,aAAa,kBAAkB,kBAAkB,uBAAuB,kBAAkB,gBAAgB,iBAAiB;AAAA,IACpI,KAAK;AACJ,aAAO,CAAC,aAAa,kBAAkB,kBAAkB,gBAAgB,iBAAiB;AAAA,EAC5F;AACD;AA2EO,IAAM,wBAAwB,EAAE,aAAa,eAAe,UAAU,WAAW;AAGjF,IAAM,qCAAqC,EAAE,UAAU,YAAY,WAAW,YAAY;AAG1F,IAAM,uBAAuB,EAAE,SAAS,WAAW,KAAK,OAAO,QAAQ,UAAU,QAAQ,UAAU,OAAO,SAAS,MAAM,QAAQ,QAAQ,SAAS;AAClJ,IAAM,0BAA0B,OAAO,OAAO,oBAAoB;AAsClE,IAAM,sBAAsB,EAAE,OAAO,SAAS,MAAM,OAAO;AAiD3D,IAAM,+BAA+B;AAAA,EAC3C,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,iBAAiB;AAClB;AAGO,IAAM,+BAA+B;AAAA,EAC3C,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACV;AA4CO,IAAM,wBAAwB;AAAA,EACpC,qBAAqB;AAAA,EACrB,+BAA+B;AAAA,EAC/B,gCAAgC;AAAA,EAChC,8BAA8B;AAAA,EAC9B,uBAAuB;AAAA,EACvB,0BAA0B;AAAA,EAC1B,oCAAoC;AAAA,EACpC,6BAA6B;AAAA,EAC7B,iCAAiC;AAAA,EACjC,4BAA4B;AAAA,EAC5B,0BAA0B;AAAA,EAC1B,iCAAiC;AAAA;AAAA,EAEjC,4BAA4B;AAAA;AAAA,EAE5B,0BAA0B;AAAA,EAC1B,sBAAsB;AAAA,EACtB,oCAAoC;AAAA;AAAA,EAEpC,kCAAkC;AAAA;AAAA,EAElC,0CAA0C;AAAA;AAAA,EAE1C,6BAA6B;AAAA;AAAA,EAE7B,iCAAiC;AAAA;AAAA,EAEjC,kCAAkC;AAAA,EAClC,qCAAqC;AAAA,EACrC,yCAAyC;AAAA,EACzC,8BAA8B;AAAA,EAC9B,yBAAyB;AAC1B;","names":[]}
+{"version":3,"sources":["workspace.ts"],"sourcesContent":["import type { ISODateString, SnowFlake, UserPlan } from \"../../v1\";\nimport type { APIApplication, APIDatabase } from \"./index\";\n\n/**\n * Granular workspace permission. Display group in `WORKSPACE_PERMISSIONS`.\n * The owner (`owner_id`) has no entry here: owner-only actions (rename/delete the workspace,\n * link/unlink projects, deploy webhook, web publishing) are allowed for the\n * owner only, never through a permission.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport type WorkspacePermission =\n\t| \"apps:read\"\n\t| \"apps:manage\"\n\t| \"apps:lifecycle\"\n\t| \"apps:envs\"\n\t| \"apps:files\"\n\t| \"apps:delete\"\n\t| \"databases:read\"\n\t| \"databases:manage\"\n\t| \"databases:lifecycle\"\n\t| \"databases:credentials\"\n\t| \"databases:data\"\n\t| \"databases:delete\"\n\t| \"snapshots:read\"\n\t| \"snapshots:manage\"\n\t| \"blob:read\"\n\t| \"blob:manage\"\n\t| \"members:read\"\n\t| \"members:manage\"\n\t| \"roles:manage\"\n\t| \"activities:read\";\n\nexport const WorkspacePermission = {\n\tAPPS_READ: \"apps:read\",\n\tAPPS_MANAGE: \"apps:manage\",\n\tAPPS_LIFECYCLE: \"apps:lifecycle\",\n\tAPPS_ENVS: \"apps:envs\",\n\tAPPS_FILES: \"apps:files\",\n\tAPPS_DELETE: \"apps:delete\",\n\tDATABASES_READ: \"databases:read\",\n\tDATABASES_MANAGE: \"databases:manage\",\n\tDATABASES_LIFECYCLE: \"databases:lifecycle\",\n\tDATABASES_CREDENTIALS: \"databases:credentials\",\n\tDATABASES_DATA: \"databases:data\",\n\tDATABASES_DELETE: \"databases:delete\",\n\tSNAPSHOTS_READ: \"snapshots:read\",\n\tSNAPSHOTS_MANAGE: \"snapshots:manage\",\n\tBLOB_READ: \"blob:read\",\n\tBLOB_MANAGE: \"blob:manage\",\n\tMEMBERS_READ: \"members:read\",\n\tMEMBERS_MANAGE: \"members:manage\",\n\tROLES_MANAGE: \"roles:manage\",\n\tACTIVITIES_READ: \"activities:read\",\n} as const satisfies Record<string, WorkspacePermission>;\n\nexport interface WorkspacePermissionEntry {\n\tgroup: \"apps\" | \"databases\" | \"snapshots\" | \"blob\" | \"members\" | \"roles\" | \"activities\";\n}\n\n/**\n * Closed catalog of workspace permissions. A member whose role lacks the permission a route\n * requires gets 403 `WORKSPACE_PERMISSION_DENIED`.\n */\nexport const WORKSPACE_PERMISSIONS: Record<WorkspacePermission, WorkspacePermissionEntry> = {\n\t\"apps:read\": { group: \"apps\" },\n\t\"apps:manage\": { group: \"apps\" },\n\t\"apps:lifecycle\": { group: \"apps\" },\n\t\"apps:envs\": { group: \"apps\" },\n\t\"apps:files\": { group: \"apps\" },\n\t\"apps:delete\": { group: \"apps\" },\n\t\"databases:read\": { group: \"databases\" },\n\t\"databases:manage\": { group: \"databases\" },\n\t\"databases:lifecycle\": { group: \"databases\" },\n\t\"databases:credentials\": { group: \"databases\" },\n\t\"databases:data\": { group: \"databases\" },\n\t\"databases:delete\": { group: \"databases\" },\n\t\"snapshots:read\": { group: \"snapshots\" },\n\t\"snapshots:manage\": { group: \"snapshots\" },\n\t\"blob:read\": { group: \"blob\" },\n\t\"blob:manage\": { group: \"blob\" },\n\t\"members:read\": { group: \"members\" },\n\t\"members:manage\": { group: \"members\" },\n\t\"roles:manage\": { group: \"roles\" },\n\t\"activities:read\": { group: \"activities\" },\n};\n\nexport const WORKSPACE_PERMISSION_LIST = Object.keys(WORKSPACE_PERMISSIONS) as WorkspacePermission[];\n\n/**\n * Seed role, created together with the workspace. It can be renamed and deleted like any other\n * role (it becomes a regular role; `preset` is not restored) and counts toward the plan's role limit.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport type WorkspaceRolePreset = \"admin\" | \"developer\" | \"operator\" | \"viewer\";\nexport const WorkspaceRolePreset = {\n\tAdmin: \"admin\",\n\tDeveloper: \"developer\",\n\tOperator: \"operator\",\n\tViewer: \"viewer\",\n} as const satisfies Record<string, WorkspaceRolePreset>;\n\n/**\n * Permissions a seed role gets when the workspace is created. `admin` does NOT include\n * `snapshots:manage` (restoring/deleting snapshots is destructive) nor `blob:read`/`blob:manage`\n * (Blob Storage files are the owner's data); the owner can grant them per role.\n */\nexport function workspacePresetPermissions(preset: WorkspaceRolePreset): WorkspacePermission[] {\n\tswitch (preset) {\n\t\tcase \"admin\":\n\t\t\treturn WORKSPACE_PERMISSION_LIST.filter((p) => p !== \"snapshots:manage\" && p !== \"blob:read\" && p !== \"blob:manage\");\n\t\tcase \"developer\":\n\t\t\treturn [\"apps:read\", \"apps:manage\", \"apps:lifecycle\", \"apps:envs\", \"apps:files\", \"databases:read\", \"databases:manage\", \"databases:lifecycle\", \"databases:credentials\", \"databases:data\", \"snapshots:read\", \"members:read\", \"activities:read\"];\n\t\tcase \"operator\":\n\t\t\treturn [\"apps:read\", \"apps:lifecycle\", \"databases:read\", \"databases:lifecycle\", \"snapshots:read\", \"members:read\", \"activities:read\"];\n\t\tcase \"viewer\":\n\t\t\treturn [\"apps:read\", \"databases:read\", \"snapshots:read\", \"members:read\", \"activities:read\"];\n\t}\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/roles/list\n */\nexport interface APIWorkspaceRole {\n\tid: SnowFlake;\n\tworkspace_id: SnowFlake;\n\tname: string;\n\tpermissions: WorkspacePermission[];\n\t/** Seed role it came from; `null` for a manually created role. Informational only. */\n\tpreset: WorkspaceRolePreset | null;\n\t/** Display order. */\n\tposition: number;\n\tmembers_count: number;\n\tcreated_at: ISODateString;\n\tupdated_at: ISODateString;\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/members/list\n */\nexport interface APIWorkspaceMember {\n\tuser_id: SnowFlake;\n\trole_id: SnowFlake;\n\trole_name: string;\n\tjoined_at: ISODateString;\n\t/** When the member's access expires; `null` = never. */\n\texpires_at: ISODateString | null;\n\tuser: {\n\t\tdisplay_name: string;\n\t\temail: string;\n\t};\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport interface APIWorkspace {\n\tid: SnowFlake;\n\tname: string;\n\tdescription: string | null;\n\towner_id: SnowFlake;\n\towner: { display_name: string };\n\tmembers_count: number;\n\t/** Soft delete timestamp. `null` = active. */\n\tdeleted_at: ISODateString | null;\n\t/**\n\t * `true` when the OWNER's plan does not include workspaces (it expired or was downgraded):\n\t * reads keep working, every write returns `PLAN_RESTRICTED_FEATURE`. Nobody is removed — the\n\t * owner must upgrade to unfreeze it.\n\t */\n\tfrozen: boolean;\n\tcreated_at: ISODateString;\n\tupdated_at: ISODateString;\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport interface APIWorkspaceInfoResponse extends APIWorkspace {\n\tmembers: APIWorkspaceMember[];\n\troles: APIWorkspaceRole[];\n\tapplications: APIApplication[];\n\tdatabases: APIDatabase[];\n\t/** Resolved permissions of the caller. The owner always gets the full list, regardless of role. */\n\tpermissions: WorkspacePermission[];\n\tis_owner: boolean;\n\t/** Owner's plan — it determines which features the workspace has. */\n\towner_plan_id: UserPlan;\n\t/** The caller's saved resource organization (folders, favorites) in this workspace. */\n\tresource_organization: APIWorkspaceResourceOrganization;\n}\n\nexport type WorkspaceResourceType = \"application\" | \"database\";\nexport const WorkspaceResourceType = { Application: \"application\", Database: \"database\" } as const satisfies Record<string, WorkspaceResourceType>;\n\nexport type WorkspaceResourceOrganizationScope = \"personal\" | \"workspace\";\nexport const WorkspaceResourceOrganizationScope = { Personal: \"personal\", Workspace: \"workspace\" } as const satisfies Record<string, WorkspaceResourceOrganizationScope>;\n\nexport type WorkspaceFolderColor = \"neutral\" | \"red\" | \"orange\" | \"yellow\" | \"green\" | \"blue\" | \"purple\";\nexport const WorkspaceFolderColor = { Neutral: \"neutral\", Red: \"red\", Orange: \"orange\", Yellow: \"yellow\", Green: \"green\", Blue: \"blue\", Purple: \"purple\" } as const satisfies Record<string, WorkspaceFolderColor>;\nexport const WORKSPACE_FOLDER_COLORS = Object.values(WorkspaceFolderColor) as WorkspaceFolderColor[];\n\nexport interface APIWorkspaceResourceRef {\n\tresource_type: WorkspaceResourceType;\n\tresource_id: SnowFlake;\n}\n\nexport interface APIWorkspaceFolderItem extends APIWorkspaceResourceRef {\n\tposition: number;\n}\n\nexport interface APIWorkspaceResourceFolder {\n\tid: SnowFlake;\n\tname: string;\n\tcolor: WorkspaceFolderColor;\n\tposition: number;\n\tresources: APIWorkspaceFolderItem[];\n\tcreated_at: ISODateString;\n\tupdated_at: ISODateString;\n}\n\nexport interface APIWorkspaceFavorite extends APIWorkspaceResourceRef {\n\tposition: number;\n\tcreated_at: ISODateString;\n}\n\nexport interface APIWorkspaceResourceOrganization {\n\tscope: WorkspaceResourceOrganizationScope;\n\tuser_id: SnowFlake;\n\tworkspace_id: SnowFlake | null;\n\tfolders: APIWorkspaceResourceFolder[];\n\tfavorites: APIWorkspaceFavorite[];\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/invites/list\n */\nexport type WorkspaceInviteKind = \"email\" | \"link\";\nexport const WorkspaceInviteKind = { Email: \"email\", Link: \"link\" } as const satisfies Record<string, WorkspaceInviteKind>;\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/invites/list\n */\nexport interface APIWorkspaceInvite {\n\tid: SnowFlake;\n\tworkspace_id: SnowFlake;\n\tkind: WorkspaceInviteKind;\n\t/** Bound e-mail; only for `kind: \"email\"`. */\n\temail: string | null;\n\trole_id: SnowFlake;\n\trole_name: string;\n\tinvited_by: { id: SnowFlake; display_name: string };\n\texpires_at: ISODateString;\n\taccepted_at: ISODateString | null;\n\trevoked_at: ISODateString | null;\n\tuses: number;\n\t/** Only for `kind: \"link\"`; `null` = unlimited uses. */\n\tmax_uses: number | null;\n\t/** Access expiration applied to members who join through this invite; `null` = never. */\n\texpires_in_days: number | null;\n\tcreated_at: ISODateString;\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/invites/create\n */\nexport interface APIWorkspaceInviteCreated extends APIWorkspaceInvite {\n\t/** Invite URL; only for `kind: \"link\"`, shown once. */\n\turl: string | null;\n}\n\n/**\n * What the invitee sees before accepting (`GET /v1/workspaces/invites/:token`).\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/invites/preview\n */\nexport interface APIWorkspaceInvitePreview {\n\tworkspace: { id: SnowFlake; name: string };\n\tinviter: { display_name: string };\n\trole_name: string;\n\tkind: WorkspaceInviteKind;\n\texpires_at: ISODateString;\n}\n\n/**\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/action-requests/list\n */\nexport type WorkspaceActionRequestAction = \"app_delete\" | \"database_delete\" | \"snapshot_create\" | \"snapshot_restore\";\nexport const WorkspaceActionRequestAction = {\n\tAppDelete: \"app_delete\",\n\tDatabaseDelete: \"database_delete\",\n\tSnapshotCreate: \"snapshot_create\",\n\tSnapshotRestore: \"snapshot_restore\",\n} as const satisfies Record<string, WorkspaceActionRequestAction>;\n\nexport type WorkspaceActionRequestStatus = \"pending\" | \"approved\" | \"rejected\" | \"expired\";\nexport const WorkspaceActionRequestStatus = {\n\tPending: \"pending\",\n\tApproved: \"approved\",\n\tRejected: \"rejected\",\n\tExpired: \"expired\",\n} as const satisfies Record<string, WorkspaceActionRequestStatus>;\n\n/**\n * `params` of an action request, per `action`. Actions without parameters take an empty object;\n * unknown keys are rejected with `WORKSPACE_ACTION_INVALID_PARAMS`.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/action-requests/create\n */\nexport interface WorkspaceActionRequestParams {\n\tapp_delete: Record<string, never>;\n\tdatabase_delete: Record<string, never>;\n\tsnapshot_create: Record<string, never>;\n\t/** The snapshot must belong to the request's resource. */\n\tsnapshot_restore: { snapshot_id: SnowFlake };\n}\n\ninterface APIWorkspaceActionRequestBase {\n\tid: SnowFlake;\n\tworkspace_id: SnowFlake;\n\tresource_type: WorkspaceResourceType;\n\tresource_id: SnowFlake;\n\tresource_name: string | null;\n\tstatus: WorkspaceActionRequestStatus;\n\trequested_by: { id: SnowFlake; display_name: string };\n\tdecided_by: { id: SnowFlake; display_name: string } | null;\n\tdecided_at: ISODateString | null;\n\texpires_at: ISODateString;\n\tcreated_at: ISODateString;\n}\n\n/**\n * A request for a destructive/sensitive action made by a member who lacks its permission, to be\n * approved by someone who has it. Expires after 24 h without a decision. Discriminated by `action`,\n * which decides the shape of `params`.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/action-requests/list\n */\nexport type APIWorkspaceActionRequest = {\n\t[A in WorkspaceActionRequestAction]: APIWorkspaceActionRequestBase & { action: A; params: WorkspaceActionRequestParams[A] };\n}[WorkspaceActionRequestAction];\n\n/**\n * Workspace error codes. Stable English sentinels returned in `code`; clients are expected to\n * translate them.\n * @see https://docs.vertracloud.app/api-reference/endpoint/workspaces/get\n */\nexport const WORKSPACE_ERROR_CODES = {\n\tWORKSPACE_NOT_FOUND: \"WORKSPACE_NOT_FOUND\",\n\tWORKSPACE_NAME_ALREADY_EXISTS: \"WORKSPACE_NAME_ALREADY_EXISTS\",\n\tWORKSPACE_MEMBER_LIMIT_REACHED: \"WORKSPACE_MEMBER_LIMIT_REACHED\",\n\tWORKSPACE_ROLE_LIMIT_REACHED: \"WORKSPACE_ROLE_LIMIT_REACHED\",\n\tWORKSPACE_ROLE_IN_USE: \"WORKSPACE_ROLE_IN_USE\",\n\tWORKSPACE_ROLE_NOT_FOUND: \"WORKSPACE_ROLE_NOT_FOUND\",\n\tWORKSPACE_ROLE_NAME_ALREADY_EXISTS: \"WORKSPACE_ROLE_NAME_ALREADY_EXISTS\",\n\tWORKSPACE_PERMISSION_DENIED: \"WORKSPACE_PERMISSION_DENIED\",\n\tWORKSPACE_PERMISSION_ESCALATION: \"WORKSPACE_PERMISSION_ESCALATION\",\n\tWORKSPACE_INVITE_NOT_FOUND: \"WORKSPACE_INVITE_NOT_FOUND\",\n\tWORKSPACE_INVITE_EXPIRED: \"WORKSPACE_INVITE_EXPIRED\",\n\tWORKSPACE_INVITE_EMAIL_MISMATCH: \"WORKSPACE_INVITE_EMAIL_MISMATCH\",\n\t/** 400 — the invited account turned off workspace invites by email. */\n\tWORKSPACE_INVITES_DISABLED: \"WORKSPACE_INVITES_DISABLED\",\n\t/** 409 — the account is already the owner or a member of the workspace. */\n\tWORKSPACE_ALREADY_MEMBER: \"WORKSPACE_ALREADY_MEMBER\",\n\tWORKSPACE_OWNER_ONLY: \"WORKSPACE_OWNER_ONLY\",\n\tWORKSPACE_ACTION_REQUEST_NOT_FOUND: \"WORKSPACE_ACTION_REQUEST_NOT_FOUND\",\n\t/** 410 — the request expired before anyone decided on it. */\n\tWORKSPACE_ACTION_REQUEST_EXPIRED: \"WORKSPACE_ACTION_REQUEST_EXPIRED\",\n\t/** 409 — the request was already approved or rejected. */\n\tWORKSPACE_ACTION_REQUEST_ALREADY_DECIDED: \"WORKSPACE_ACTION_REQUEST_ALREADY_DECIDED\",\n\t/** 400 — the requester already has the permission; perform the action directly. */\n\tWORKSPACE_ACTION_NOT_NEEDED: \"WORKSPACE_ACTION_NOT_NEEDED\",\n\t/** 400 — the request `params` failed the action's validation (e.g. a snapshot of another resource). */\n\tWORKSPACE_ACTION_INVALID_PARAMS: \"WORKSPACE_ACTION_INVALID_PARAMS\",\n\t/** 409 — a pending request already exists for the same action on the same resource. */\n\tWORKSPACE_ACTION_REQUEST_PENDING: \"WORKSPACE_ACTION_REQUEST_PENDING\",\n\tWORKSPACE_RESOURCE_FOLDER_NOT_FOUND: \"WORKSPACE_RESOURCE_FOLDER_NOT_FOUND\",\n\tWORKSPACE_RESOURCE_FOLDER_NAME_CONFLICT: \"WORKSPACE_RESOURCE_FOLDER_NAME_CONFLICT\",\n\tWORKSPACE_RESOURCE_NOT_FOUND: \"WORKSPACE_RESOURCE_NOT_FOUND\",\n\tPLAN_RESTRICTED_FEATURE: \"PLAN_RESTRICTED_FEATURE\",\n} as const;\nexport type WorkspaceErrorCode = (typeof WORKSPACE_ERROR_CODES)[keyof typeof WORKSPACE_ERROR_CODES];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCO,IAAM,sBAAsB;AAAA,EAClC,WAAW;AAAA,EACX,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,iBAAiB;AAClB;AAUO,IAAM,wBAA+E;AAAA,EAC3F,aAAa,EAAE,OAAO,OAAO;AAAA,EAC7B,eAAe,EAAE,OAAO,OAAO;AAAA,EAC/B,kBAAkB,EAAE,OAAO,OAAO;AAAA,EAClC,aAAa,EAAE,OAAO,OAAO;AAAA,EAC7B,cAAc,EAAE,OAAO,OAAO;AAAA,EAC9B,eAAe,EAAE,OAAO,OAAO;AAAA,EAC/B,kBAAkB,EAAE,OAAO,YAAY;AAAA,EACvC,oBAAoB,EAAE,OAAO,YAAY;AAAA,EACzC,uBAAuB,EAAE,OAAO,YAAY;AAAA,EAC5C,yBAAyB,EAAE,OAAO,YAAY;AAAA,EAC9C,kBAAkB,EAAE,OAAO,YAAY;AAAA,EACvC,oBAAoB,EAAE,OAAO,YAAY;AAAA,EACzC,kBAAkB,EAAE,OAAO,YAAY;AAAA,EACvC,oBAAoB,EAAE,OAAO,YAAY;AAAA,EACzC,aAAa,EAAE,OAAO,OAAO;AAAA,EAC7B,eAAe,EAAE,OAAO,OAAO;AAAA,EAC/B,gBAAgB,EAAE,OAAO,UAAU;AAAA,EACnC,kBAAkB,EAAE,OAAO,UAAU;AAAA,EACrC,gBAAgB,EAAE,OAAO,QAAQ;AAAA,EACjC,mBAAmB,EAAE,OAAO,aAAa;AAC1C;AAEO,IAAM,4BAA4B,OAAO,KAAK,qBAAqB;AAQnE,IAAM,sBAAsB;AAAA,EAClC,OAAO;AAAA,EACP,WAAW;AAAA,EACX,UAAU;AAAA,EACV,QAAQ;AACT;AAOO,SAAS,2BAA2B,QAAoD;AAC9F,UAAQ,QAAQ;AAAA,IACf,KAAK;AACJ,aAAO,0BAA0B,OAAO,CAAC,MAAM,MAAM,sBAAsB,MAAM,eAAe,MAAM,aAAa;AAAA,IACpH,KAAK;AACJ,aAAO,CAAC,aAAa,eAAe,kBAAkB,aAAa,cAAc,kBAAkB,oBAAoB,uBAAuB,yBAAyB,kBAAkB,kBAAkB,gBAAgB,iBAAiB;AAAA,IAC7O,KAAK;AACJ,aAAO,CAAC,aAAa,kBAAkB,kBAAkB,uBAAuB,kBAAkB,gBAAgB,iBAAiB;AAAA,IACpI,KAAK;AACJ,aAAO,CAAC,aAAa,kBAAkB,kBAAkB,gBAAgB,iBAAiB;AAAA,EAC5F;AACD;AA2EO,IAAM,wBAAwB,EAAE,aAAa,eAAe,UAAU,WAAW;AAGjF,IAAM,qCAAqC,EAAE,UAAU,YAAY,WAAW,YAAY;AAG1F,IAAM,uBAAuB,EAAE,SAAS,WAAW,KAAK,OAAO,QAAQ,UAAU,QAAQ,UAAU,OAAO,SAAS,MAAM,QAAQ,QAAQ,SAAS;AAClJ,IAAM,0BAA0B,OAAO,OAAO,oBAAoB;AAsClE,IAAM,sBAAsB,EAAE,OAAO,SAAS,MAAM,OAAO;AAiD3D,IAAM,+BAA+B;AAAA,EAC3C,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,iBAAiB;AAClB;AAGO,IAAM,+BAA+B;AAAA,EAC3C,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AACV;AA4CO,IAAM,wBAAwB;AAAA,EACpC,qBAAqB;AAAA,EACrB,+BAA+B;AAAA,EAC/B,gCAAgC;AAAA,EAChC,8BAA8B;AAAA,EAC9B,uBAAuB;AAAA,EACvB,0BAA0B;AAAA,EAC1B,oCAAoC;AAAA,EACpC,6BAA6B;AAAA,EAC7B,iCAAiC;AAAA,EACjC,4BAA4B;AAAA,EAC5B,0BAA0B;AAAA,EAC1B,iCAAiC;AAAA;AAAA,EAEjC,4BAA4B;AAAA;AAAA,EAE5B,0BAA0B;AAAA,EAC1B,sBAAsB;AAAA,EACtB,oCAAoC;AAAA;AAAA,EAEpC,kCAAkC;AAAA;AAAA,EAElC,0CAA0C;AAAA;AAAA,EAE1C,6BAA6B;AAAA;AAAA,EAE7B,iCAAiC;AAAA;AAAA,EAEjC,kCAAkC;AAAA,EAClC,qCAAqC;AAAA,EACrC,yCAAyC;AAAA,EACzC,8BAA8B;AAAA,EAC9B,yBAAyB;AAC1B;","names":[]}

package/payloads/v1/workspace.mjs

@@ -14,6 +14,8 @@ var WorkspacePermission = {
   DATABASES_DELETE: "databases:delete",
   SNAPSHOTS_READ: "snapshots:read",
   SNAPSHOTS_MANAGE: "snapshots:manage",
+  BLOB_READ: "blob:read",
+  BLOB_MANAGE: "blob:manage",
   MEMBERS_READ: "members:read",
   MEMBERS_MANAGE: "members:manage",
   ROLES_MANAGE: "roles:manage",
@@ -34,6 +36,8 @@ var WORKSPACE_PERMISSIONS = {
   "databases:delete": { group: "databases" },
   "snapshots:read": { group: "snapshots" },
   "snapshots:manage": { group: "snapshots" },
+  "blob:read": { group: "blob" },
+  "blob:manage": { group: "blob" },
   "members:read": { group: "members" },
   "members:manage": { group: "members" },
   "roles:manage": { group: "roles" },
@@ -49,7 +53,7 @@ var WorkspaceRolePreset = {
 function workspacePresetPermissions(preset) {
   switch (preset) {
     case "admin":
-      return WORKSPACE_PERMISSION_LIST.filter((p) => p !== "snapshots:manage");
+      return WORKSPACE_PERMISSION_LIST.filter((p) => p !== "snapshots:manage" && p !== "blob:read" && p !== "blob:manage");
     case "developer":
       return ["apps:read", "apps:manage", "apps:lifecycle", "apps:envs", "apps:files", "databases:read", "databases:manage", "databases:lifecycle", "databases:credentials", "databases:data", "snapshots:read", "members:read", "activities:read"];
     case "operator":