@cube-dev/platform-client 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -9,13 +9,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- Curate public-facing entries here before the next release. -->
 
+## [0.14.0] - 2026-09-23
+### Added
+
+- Public REST parity for API key management (CORE-730): `GET` / `POST /api/v1/api-keys` and `GET` / `DELETE /api/v1/api-keys/{id}` (`ApiKeysPublicController.listApiKeys` / `createApiKey` / `getApiKey` / `deleteApiKey`), matching the `cube api-keys list/create/get/delete` CLI commands, which previously had no REST route to target. Admin-only. List and get responses omit the real secret — only a SHA-256 hash is persisted — so only the create response carries the one-time-revealed `token`. New schemas: `ApiKeyResponse`, `ApiKeyCreatedResponse`, `ApiKeysListResponse`, `CreateApiKeyInput`.
+
+### Changed
+
+- `POST /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` now signs only an allowlisted `scopes` entry, and authorizes each one separately (CUB-4801). The allowlist is `meta` and `sql-runner`; anything else, including `ai-engineer` and `agents-config` (gated elsewhere on schema access and privileged settings), is dropped rather than signed. `sql-runner` additionally requires SQL Runner read access on that deployment, and a caller-supplied `sql-runner-permissions:*` entry is never honoured — the server appends the non-DDL qualifier itself when DDL is disabled, matching the GraphQL mint. Before, deployment edit access granted every requested scope.
+- `GET /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` now lists only the tokens the calling user minted (CUB-4801). Before, any caller with read access to the deployment received every live token in the environment, credential included. The response shape is unchanged. Ownership is derived from a claim the mint stamps into each token, so a token minted before this release belongs to nobody and stops appearing; tokens expire within the hour regardless. One listing covers the most recent 1000 live tokens of the environment, which is far above what an hour of minting produces.
+- The token routes (`GET`/`POST …/tokens`, `POST …/tokens-for-meta-sync`) no longer accept an embed session. Minting a Cube API credential is not an embed capability. `GET …/environments` is unchanged.
+- `POST …/tokens` applies the same security-context gate as the console's token mutations: a caller without deployment edit access (admin or developer role) has every key of `security_context` dropped before signing, and a caller-supplied `scope` claim is never signed on any tier. The response's `security_context` now echoes what was actually signed.
+- `scopes` on `POST …/tokens` also requires deployment edit access — it is a runtime grant (`sql-runner`, `agents-config`), gated the same way the console's equivalent mint is. It is ignored for a caller without that access, and a `dev-token` entry is never honoured from any caller. `tokens-for-meta-sync` still forces `meta` regardless.
+
 ## [0.13.0] - 2026-09-22
 
 ### Added
 
 - New public REST endpoints for promoting a workbook across deployments (CUB-2563): `POST /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/promotion-previews` (`WorkbookPromotionsPublicController.previewWorkbookPromotion`) validates the promotion and returns content hashes for optimistic concurrency, without storing anything; `POST .../promotions` (`.promoteWorkbook`) applies it atomically if the source hash still matches the preview, preserving the workbook's deployment-scoped slug across repeat promotions, and takes an idempotency key to make retries safe; `GET .../promotion` (`.getWorkbookPromotion`) returns the workbook's promotion provenance; `GET .../promotions` (`.getWorkbookPromotions`) lists its promotion history with cursor pagination; `GET .../promotion-links` (`.getWorkbookPromotionLinks`) lists its promotion destinations. Requires access to both deployments, and a workspace session or API key — not an embed session. New schemas: `WorkbookPromotionDto`, `WorkbookPromotionDtoOutcome`, `WorkbookPromotionPreviewDto`, `WorkbookPromotionSummaryResponse`, `WorkbookPromotionSummaryDto`, `WorkbookPromotionsListResponse`, `WorkbookPromotionLinkDto`, `WorkbookPromotionLinksListResponse`, `PromotionActorDto`, `PromotionActorDtoAuthenticationMethod`, `PromotionReferenceDto`, `PromotionReferenceDtoAvailability`, `PreviewWorkbookPromotionInput`, `ApplyWorkbookPromotionInput`.
 - `Workbook` gained `promotion` (CUB-2563) — the workbook's promotion summary (`WorkbookPromotionSummaryDto`), `null` on a workbook that has never been promoted or received a promotion.
-- New public REST endpoint `GET /api/v1/external-documents/{externalWorkbookId}/placements` (`ExternalDocumentsPublicController.listExternalDocumentPlacements`) (CUB-4418) lists every block of Cube-written cells in an external spreadsheet — a Google Drive file id, or the custom property the Excel add-in writes — across the whole tenant, including placements the caller cannot read: each entry carries `access: GRANTED | DENIED`, with `reportName` withheld (`null`) on a denied entry. Tenant-scoped, unlike `GET /api/v1/deployments/{deploymentId}/reports?externalWorkbookId=`, which lists only readable reports for one deployment. Supports cursor pagination (`first`/`after`); omitting `first` returns every placement in the document. Answers `422` rather than a truncated page if the document holds more than 500 placed explorations or 2000 total placements. New schema: `ExternalDocumentPlacementsListResponse` (`ExternalDocumentPlacementResponse`, `ExternalDocumentPlacementResponseAccess`, `ExternalDocumentPlacementResponseHost`).
+- New public REST endpoint `GET /api/v1/external-documents/{externalWorkbookId}/placements` (`ExternalDocumentsPublicController.listExternalDocumentPlacements`) (CUB-4418) lists every block of Cube-written cells in an external spreadsheet — a Google Drive file id, or the custom property the Excel add-in writes — across the whole tenant, including placements the caller cannot read: each entry carries `access: GRANTED | DENIED` — a denied entry still carries the placement's address, the owning `deploymentId`, and the exploration owner's name and email address (when Cube can resolve one), so the recipient can request access; only `reportName` is withheld (`null`). Tenant-scoped, unlike `GET /api/v1/deployments/{deploymentId}/reports?externalWorkbookId=`, which lists only readable reports for one deployment. Supports cursor pagination (`first`/`after`); omitting `first` returns every placement in the document. Answers `422` rather than a truncated page if the document holds more than 500 placed explorations or 2000 total placements. New schema: `ExternalDocumentPlacementsListResponse` (`ExternalDocumentPlacementResponse`, `ExternalDocumentPlacementResponseAccess`, `ExternalDocumentPlacementResponseHost`).
 
 ### Removed
 

package/dist/schema.d.ts

@@ -147,6 +147,42 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/api-keys/": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List api keys */
+        get: operations["ApiKeysPublicController.listApiKeys"];
+        put?: never;
+        /** Create api key */
+        post: operations["ApiKeysPublicController.createApiKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/api-keys/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get api key */
+        get: operations["ApiKeysPublicController.getApiKey"];
+        put?: never;
+        post?: never;
+        /** Delete api key */
+        delete: operations["ApiKeysPublicController.deleteApiKey"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/app-config": {
         parameters: {
             query?: never;
@@ -724,6 +760,66 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/deployments/{deploymentId}/evaluations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start an evaluation run
+         * @description Queues an eval run for a deployment branch. Poll the returned run with GET /evaluations/{evaluationId}; after it reaches completed, fetch /results for the per-question verdicts. This capability is currently in preview — reach out to the Cube support team to activate it for your account.
+         */
+        post: operations["EvaluationsPublicController.startEvaluation"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/deployments/{deploymentId}/evaluations/{evaluationId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an evaluation run
+         * @description This capability is currently in preview — reach out to the Cube support team to activate it for your account.
+         */
+        get: operations["EvaluationsPublicController.getEvaluation"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/deployments/{deploymentId}/evaluations/{evaluationId}/results": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List results for an evaluation run
+         * @description This capability is currently in preview — reach out to the Cube support team to activate it for your account.
+         */
+        get: operations["EvaluationsPublicController.getEvaluationResults"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/deployments/{deploymentId}/folders": {
         parameters: {
             query?: never;
@@ -2065,7 +2161,7 @@ export interface paths {
          *
          *     Unlike `GET /api/v1/deployments/{deploymentId}/reports?externalWorkbookId=`, which lists only the reports the caller can read, this endpoint also reports the placements they **cannot**: each entry carries `access`, which is `GRANTED` when the caller may open the exploration and `DENIED` when they may not. It is how a recipient of a shared workbook learns that a block they are looking at is backed by an exploration nobody has shared with them, and who to ask.
          *
-         *     A `DENIED` entry carries only the placement's address, its opaque `reportId`/`placementId` and the exploration's `owner`. `reportName` is `null` on a denied entry — the name is withheld along with the exploration — and reading the report itself still answers `403`.
+         *     A `DENIED` entry carries only the placement's address (`resultLocation`/`sheetId`/`sheetName`/`anchorCell`/`endResultCell`/`host`), its opaque `reportId`/`placementId`, the owning `deploymentId`, the placement's `placedAt`/`refreshedAt` timestamps, and the exploration's `owner` — including their email address, so the recipient can ask for access. `owner` is `null` for an embed-partition exploration whose owning user record no longer exists — embed report ownership carries no foreign key, so the row can outlive its owner; a main-workspace exploration's owner always exists, since deleting the owner cascades to delete the report. `reportName` is `null` on a denied entry — the name is withheld along with the exploration — and reading the report itself still answers `403`.
          *
          *     Results are returned in pages using cursor-based pagination: pass `first` to set the page size and `after` (the previous response's `pageInfo.endCursor`) to fetch the next page. Omitting `first` returns every placement in the document.
          *
@@ -3241,6 +3337,35 @@ export interface components {
             scopeDeploymentId?: number | null;
             spaceConfigName?: string | null;
         };
+        ApiKeyCreatedResponse: {
+            allowedEndpoints?: string[] | null;
+            createdAt: string;
+            deploymentIds?: number[] | null;
+            expiresAt?: (string) | null;
+            id: number;
+            lastUsedAt?: (string) | null;
+            name: string;
+            suffix?: string | null;
+            token: string;
+            updatedAt: string;
+            userId: number;
+        };
+        ApiKeyResponse: {
+            allowedEndpoints?: string[] | null;
+            createdAt: string;
+            deploymentIds?: number[] | null;
+            expiresAt?: (string) | null;
+            id: number;
+            lastUsedAt?: (string) | null;
+            name: string;
+            suffix?: string | null;
+            updatedAt: string;
+            userId: number;
+        };
+        ApiKeysListResponse: {
+            items: components["schemas"]["ApiKeyResponse"][];
+            pageInfo: components["schemas"]["PageInfo"];
+        };
         AppConfigResponse: {
             appTheme?: components["schemas"]["AppTheme"] | null;
             applyThemeGlobally: boolean;
@@ -3459,6 +3584,12 @@ export interface components {
             fontSize?: string | null;
             fontWeight?: string | null;
         };
+        CreateApiKeyInput: {
+            allowedEndpoints?: string[] | null;
+            deploymentIds?: number[] | null;
+            name: string;
+            ttlHours?: number | null;
+        };
         CreateBranchRequest: {
             activate?: boolean | null;
             from?: string | null;
@@ -4132,6 +4263,8 @@ export interface components {
             deletionPolicy?: string | null;
             deploymentId: number;
             durationMs?: number | null;
+            /** @description How many published views are missing measures the conversion could not represent. A run reports COMPLETED with this above zero, because every view published — so automation that treats COMPLETED as "fully published" should assert this is 0. Read views[].withheldMembers for which measures, and why. */
+            incompleteViewCount: number;
             integrationPublicId: string;
             progress?: components["schemas"]["DatabricksMetricViewSyncProgressResponse"] | null;
             runId: string;
@@ -4635,6 +4768,34 @@ export interface components {
             items: components["schemas"]["EnvVariableItem"][];
             pageInfo?: components["schemas"]["PageInfo"] | null;
         };
+        EvaluationResultResponse: {
+            createdAt: string;
+            evaluationId: number;
+            id: number;
+            questionTextSnapshot: string;
+            score?: number | null;
+            updatedAt: string;
+            verdict?: string | null;
+        };
+        EvaluationResultsListResponse: {
+            items: components["schemas"]["EvaluationResultResponse"][];
+            pageInfo: components["schemas"]["PageInfo"];
+        };
+        EvaluationRunResponse: {
+            agentName: string;
+            branchName: string;
+            commitHash?: string | null;
+            createdAt: string;
+            deploymentId: number;
+            finishedAt?: string | null;
+            id: number;
+            isDefaultBranch?: boolean | null;
+            questionFile?: string | null;
+            startedAt?: string | null;
+            /** @description Run state: pending, running, completed, or failed. Treat unrecognized values as non-terminal. */
+            status: string;
+            updatedAt: string;
+        };
         ExportSubjectInput: {
             email?: string | null;
             embedTenantName?: string | null;
@@ -5482,6 +5643,11 @@ export interface components {
         StartDevModeRequest: {
             branchName?: string | null;
         };
+        StartEvaluationInput: {
+            agentName?: string | null;
+            branchName: string;
+            questionFile?: string | null;
+        };
         StartUploadResponse: {
             deploymentName: string;
             transaction: components["schemas"]["UploadTransaction"];
@@ -6401,6 +6567,95 @@ export interface operations {
             };
         };
     };
+    "ApiKeysPublicController.listApiKeys": {
+        parameters: {
+            query?: {
+                after?: string | null;
+                first?: number | null;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiKeysListResponse"];
+                };
+            };
+        };
+    };
+    "ApiKeysPublicController.createApiKey": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** @description CreateApiKeyInput */
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["CreateApiKeyInput"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiKeyCreatedResponse"];
+                };
+            };
+        };
+    };
+    "ApiKeysPublicController.getApiKey": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiKeyResponse"];
+                };
+            };
+        };
+    };
+    "ApiKeysPublicController.deleteApiKey": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful response */
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": any;
+                };
+            };
+        };
+    };
     "AppThemePublicController.getAppConfig": {
         parameters: {
             query?: never;
@@ -7346,6 +7601,79 @@ export interface operations {
             };
         };
     };
+    "EvaluationsPublicController.startEvaluation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                deploymentId: number;
+            };
+            cookie?: never;
+        };
+        /** @description StartEvaluationInput */
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StartEvaluationInput"];
+            };
+        };
+        responses: {
+            202: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["EvaluationRunResponse"];
+                };
+            };
+        };
+    };
+    "EvaluationsPublicController.getEvaluation": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                deploymentId: number;
+                evaluationId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["EvaluationRunResponse"];
+                };
+            };
+        };
+    };
+    "EvaluationsPublicController.getEvaluationResults": {
+        parameters: {
+            query?: {
+                after?: string | null;
+                first?: number | null;
+            };
+            header?: never;
+            path: {
+                deploymentId: number;
+                evaluationId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["EvaluationResultsListResponse"];
+                };
+            };
+        };
+    };
     "FoldersPublicController.getFolders": {
         parameters: {
             query?: {