@cube-dev/platform-client 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -9,13 +9,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- Curate public-facing entries here before the next release. -->
 
+## [0.15.0] - 2026-09-25
+
+### Added
+
+- `GET /api/v1/app-config` returns `aiPaywalled` (CUB-4684): `true` when the tenant uses the new UI without having enabled AI. An embed then offers no AI, whatever the session's `allowAi` says, because the server refuses its AI credentials.
+- New public REST endpoints for agent scheduled tasks: `GET` / `POST /api/v1/deployments/{deploymentId}/scheduled-tasks`, `GET` / `PUT` / `DELETE …/scheduled-tasks/{taskId}`, `POST …/scheduled-tasks/{taskId}/run` and `GET …/scheduled-tasks/{taskId}/runs` (`ScheduledTasksPublicController.listScheduledTasks` / `createScheduledTask` / `getScheduledTask` / `updateScheduledTask` / `deleteScheduledTask` / `runScheduledTask` / `listScheduledTaskRuns`). A scheduled task is a saved prompt the deployment's agent runs on a cron in an IANA time zone, or only on demand, and each run writes a new chat thread. The endpoints answer `403` unless scheduled tasks are enabled for the account, the caller holds read access to the deployment, and the request is not an embed session. Anyone with that access can list and read the deployment's tasks; only a task's creator, whom every run acts as, or an admin can update, delete or run it. A cron must fire at most once an hour (its minute field is a single number), and a user can have at most 20 active (scheduled and enabled) tasks across the account's deployments. A bad cron or time zone answers `400`, and a create or resume past the limit answers `409`; Manual and paused tasks don't count toward the limit. Each task carries `userId` (the creator) and `nextRunAt`. Both lists support cursor pagination; the tasks list has no cap (omitting `first` returns every task), but the runs list only ever holds the 50 most recent runs, so `first`/`after` page within that window rather than a longer history. New schemas: `ScheduledTaskResponse`, `ScheduledTaskListResponse`, `CreateScheduledTaskInput`, `UpdateScheduledTaskInput`, `RunScheduledTaskResponse`, `ScheduledTaskRunResponse`, `ScheduledTaskRunsListResponse`.
+- `ReportPlacementResultChecksum` / `ReportPlacementResultChecksumInput` — used by `PUT /api/v1/deployments/{deploymentId}/reports/{reportId}/refresh` and `.../connect-workbook` — gained an optional `payload` field (1–128 chars, CUB-4966): a hash of the grid the add-in just wrote, opaque to the server, so a later refresh can skip rewriting an unchanged block.
+
+## [0.14.0] - 2026-09-23
+
+### Added
+
+- Public REST parity for API key management (CORE-730): `GET` / `POST /api/v1/api-keys` and `GET` / `DELETE /api/v1/api-keys/{id}` (`ApiKeysPublicController.listApiKeys` / `createApiKey` / `getApiKey` / `deleteApiKey`), matching the `cube api-keys list/create/get/delete` CLI commands, which previously had no REST route to target. Admin-only. List and get responses omit the real secret — only a SHA-256 hash is persisted — so only the create response carries the one-time-revealed `token`. New schemas: `ApiKeyResponse`, `ApiKeyCreatedResponse`, `ApiKeysListResponse`, `CreateApiKeyInput`.
+
+### Changed
+
+- `POST /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` now signs only an allowlisted `scopes` entry, and authorizes each one separately (CUB-4801). The allowlist is `meta` and `sql-runner`; anything else, including `ai-engineer` and `agents-config` (gated elsewhere on schema access and privileged settings), is dropped rather than signed. `sql-runner` additionally requires SQL Runner read access on that deployment, and a caller-supplied `sql-runner-permissions:*` entry is never honoured — the server appends the non-DDL qualifier itself when DDL is disabled, matching the GraphQL mint. Before, deployment edit access granted every requested scope.
+- `GET /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` now lists only the tokens the calling user minted (CUB-4801). Before, any caller with read access to the deployment received every live token in the environment, credential included. The response shape is unchanged. Ownership is derived from a claim the mint stamps into each token, so a token minted before this release belongs to nobody and stops appearing; tokens expire within the hour regardless. One listing covers the most recent 1000 live tokens of the environment, which is far above what an hour of minting produces.
+- The token routes (`GET`/`POST …/tokens`, `POST …/tokens-for-meta-sync`) no longer accept an embed session. Minting a Cube API credential is not an embed capability. `GET …/environments` is unchanged.
+- `POST …/tokens` applies the same security-context gate as the console's token mutations: a caller without deployment edit access (admin or developer role) has every key of `security_context` dropped before signing, and a caller-supplied `scope` claim is never signed on any tier. The response's `security_context` now echoes what was actually signed.
+- `scopes` on `POST …/tokens` also requires deployment edit access — it is a runtime grant (`sql-runner`, `agents-config`), gated the same way the console's equivalent mint is. It is ignored for a caller without that access, and a `dev-token` entry is never honoured from any caller. `tokens-for-meta-sync` still forces `meta` regardless.
+
 ## [0.13.0] - 2026-09-22
 
 ### Added
 
 - New public REST endpoints for promoting a workbook across deployments (CUB-2563): `POST /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/promotion-previews` (`WorkbookPromotionsPublicController.previewWorkbookPromotion`) validates the promotion and returns content hashes for optimistic concurrency, without storing anything; `POST .../promotions` (`.promoteWorkbook`) applies it atomically if the source hash still matches the preview, preserving the workbook's deployment-scoped slug across repeat promotions, and takes an idempotency key to make retries safe; `GET .../promotion` (`.getWorkbookPromotion`) returns the workbook's promotion provenance; `GET .../promotions` (`.getWorkbookPromotions`) lists its promotion history with cursor pagination; `GET .../promotion-links` (`.getWorkbookPromotionLinks`) lists its promotion destinations. Requires access to both deployments, and a workspace session or API key — not an embed session. New schemas: `WorkbookPromotionDto`, `WorkbookPromotionDtoOutcome`, `WorkbookPromotionPreviewDto`, `WorkbookPromotionSummaryResponse`, `WorkbookPromotionSummaryDto`, `WorkbookPromotionsListResponse`, `WorkbookPromotionLinkDto`, `WorkbookPromotionLinksListResponse`, `PromotionActorDto`, `PromotionActorDtoAuthenticationMethod`, `PromotionReferenceDto`, `PromotionReferenceDtoAvailability`, `PreviewWorkbookPromotionInput`, `ApplyWorkbookPromotionInput`.
 - `Workbook` gained `promotion` (CUB-2563) — the workbook's promotion summary (`WorkbookPromotionSummaryDto`), `null` on a workbook that has never been promoted or received a promotion.
-- New public REST endpoint `GET /api/v1/external-documents/{externalWorkbookId}/placements` (`ExternalDocumentsPublicController.listExternalDocumentPlacements`) (CUB-4418) lists every block of Cube-written cells in an external spreadsheet — a Google Drive file id, or the custom property the Excel add-in writes — across the whole tenant, including placements the caller cannot read: each entry carries `access: GRANTED | DENIED`, with `reportName` withheld (`null`) on a denied entry. Tenant-scoped, unlike `GET /api/v1/deployments/{deploymentId}/reports?externalWorkbookId=`, which lists only readable reports for one deployment. Supports cursor pagination (`first`/`after`); omitting `first` returns every placement in the document. Answers `422` rather than a truncated page if the document holds more than 500 placed explorations or 2000 total placements. New schema: `ExternalDocumentPlacementsListResponse` (`ExternalDocumentPlacementResponse`, `ExternalDocumentPlacementResponseAccess`, `ExternalDocumentPlacementResponseHost`).
+- New public REST endpoint `GET /api/v1/external-documents/{externalWorkbookId}/placements` (`ExternalDocumentsPublicController.listExternalDocumentPlacements`) (CUB-4418) lists every block of Cube-written cells in an external spreadsheet — a Google Drive file id, or the custom property the Excel add-in writes — across the whole tenant, including placements the caller cannot read: each entry carries `access: GRANTED | DENIED` — a denied entry still carries the placement's address, the owning `deploymentId`, and the exploration owner's name and email address (when Cube can resolve one), so the recipient can request access; only `reportName` is withheld (`null`). Tenant-scoped, unlike `GET /api/v1/deployments/{deploymentId}/reports?externalWorkbookId=`, which lists only readable reports for one deployment. Supports cursor pagination (`first`/`after`); omitting `first` returns every placement in the document. Answers `422` rather than a truncated page if the document holds more than 500 placed explorations or 2000 total placements. New schema: `ExternalDocumentPlacementsListResponse` (`ExternalDocumentPlacementResponse`, `ExternalDocumentPlacementResponseAccess`, `ExternalDocumentPlacementResponseHost`).
 
 ### Removed