@cube-dev/platform-client 0.19.0 → 0.19.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -9,15 +9,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
9
9
|
|
|
10
10
|
<!-- Curate public-facing entries here before the next release. -->
|
|
11
11
|
|
|
12
|
+
## [0.19.1] - 2026-10-12
|
|
13
|
+
|
|
14
|
+
### Added
|
|
15
|
+
|
|
16
|
+
- New public REST API for managing custom roles, so a deployment and the access to it can be provisioned in one automated pipeline instead of finishing in the console. `GET /api/v1/roles` (`RolesPublicController.getRoles`) lists the account's custom roles with cursor pagination, `POST /api/v1/roles` (`createRole`) creates one and returns its `id`, `GET`/`PUT`/`DELETE /api/v1/roles/{roleId}` (`getRole`, `updateRole`, `deleteRole`) read, partially update and remove it, and `PUT`/`DELETE /api/v1/roles/{roleId}/users/{userId}` (`assignRoleToUser`, `removeRoleFromUser`) grant and revoke it for a user. Scope a role to a deployment by sending a policy with `resourceType: 'Deployment'` and the deployment's id — as returned by `POST /build/api/v1/deployments` — as a string in `resources`, or `['All']` for every deployment; `PUT /api/v1/roles/{roleId}` replaces `policies` outright rather than merging — omit the field to leave them unchanged, or send `[]` to remove them all. An explicit `null` for `policies` or `name` is rejected with `400` rather than written, so a partly-filled client object cannot strip a role's grants by accident; `null` for `description` still clears it. Use `'All'` as the single action for full access to the deployments in scope. A role usually also needs a `Global` policy naming the holder's license tier (`AIBIView`, `AIBIExplore` or `AIBIDevelop`) — what the console calls the Base Role — and the tier should cover the deployment actions granted, since the console forces Developer for every deployment action outside a short list available at every tier (see [Auto-bump to Developer](https://docs.cube.dev/admin/users-and-permissions/custom-roles#auto-bump-to-developer)). The tier is not required and is not derived from the deployment actions: a role sent without one is accepted and confers no tier, so a user holding only that role gets the deployment grants and still cannot use the product. Omit it only when another of the user's roles supplies the tier. Policies are shape-checked: a policy granting no action, a policy naming no resource, and a `Deployment` resource that is not a deployment id (a slug or a name) are rejected with `400` listing every problem at once. Ids are checked for shape, not existence, so an id whose deployment was since deleted is kept and simply grants nothing. Role names are unique: creating a role whose name is taken, or renaming one onto a taken name, is rejected with `409`. All endpoints require administrator privileges. Cube's built-in roles are not listed, updated or deleted here — they are not account data — but `assignRoleToUser` does accept a built-in role's id, with the exception of Cube's Admin role, which it cannot grant (`404`). New schemas: `Role`, `RoleCreateBody`, `RoleUpdateBody`, `RolesListResponse`.
|
|
17
|
+
- Apache Ossie conversions under `/api/v1/deployments/{deploymentId}/ossie-conversions`: start a conversion of the deployment's YAML data model or uploaded YAML files to an Ossie model, or of an uploaded Ossie model to Cube data model files, then poll its status and read its result and files, or cancel it. Currently in preview.
|
|
18
|
+
|
|
12
19
|
## [0.19.0] - 2026-10-08
|
|
13
20
|
|
|
14
21
|
### Added
|
|
15
22
|
|
|
16
|
-
- `layout` on the body of `POST /api/v1/deployments/{deploymentId}/dashboard-exports`: `print` returns the paginated A4 PDF the dashboard's Print version menu item produces (one column, every table row, the filter state as a summary line instead of filter controls); `screenshot`, the default, keeps today's board image. `print` requires `format: 'pdf'` — with `png` the request answers `400
|
|
23
|
+
- `layout` on the body of `POST /api/v1/deployments/{deploymentId}/dashboard-exports`: `print` returns the paginated A4 PDF the dashboard's Print version menu item produces (one column, every table row, the filter state as a summary line instead of filter controls); `screenshot`, the default, keeps today's board image. `print` requires `format: 'pdf'` — with `png` the request answers `400`.
|
|
17
24
|
|
|
18
25
|
### Fixed
|
|
19
26
|
|
|
20
|
-
- A field's description, default and deprecation now reach the types and the API reference for every field. Before, a field taking one of a fixed set of values showed only those values (`format` on dashboard exports read only `"png" | "pdf"`), and an optional field's description sat where the generated types never read it
|
|
27
|
+
- A field's description, default and deprecation now reach the types and the API reference for every field. Before, a field taking one of a fixed set of values showed only those values (`format` on dashboard exports read only `"png" | "pdf"`), and an optional field's description sat where the generated types never read it.
|
|
21
28
|
|
|
22
29
|
## [0.18.0] - 2026-10-05
|
|
23
30
|
|
|
@@ -31,15 +38,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
31
38
|
|
|
32
39
|
- `notificationEnabled` on the create and update bodies and the response of `POST`/`PUT …/scheduled-tasks`: when `true`, the creator gets a notification in Cube's inbox when a run finishes, whether it succeeds or fails. Defaults to `false`.
|
|
33
40
|
- `expectedVersion` on the report update body (`PUT …/reports/{reportId}`): when it does not match the stored version of the report, the update answers `409` instead of overwriting a newer save.
|
|
34
|
-
- `GET /api/v1/deployments/{deploymentId}/agent-suggestions` returns the starter prompts an agent offers in chat, for the agents the caller can use
|
|
35
|
-
- `GET /api/v1/deployments/{deploymentId}/reports/{reportId}/file` returns a report's definition as canonical JSON text (`content`) with its SHA-256 (`hash`), and `PATCH` on the same path changes part of it by exact-text replacement
|
|
36
|
-
- `GET /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/dashboard/file` returns the classic dashboard draft as canonical JSON text (`content`) with its SHA-256 (`hash`), and `PATCH` on the same path changes part of it by exact-text replacement
|
|
37
|
-
- `POST /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` and `POST …/tokens-for-meta-sync` now return `data.scopes`, the runtime scopes signed into the token
|
|
41
|
+
- `GET /api/v1/deployments/{deploymentId}/agent-suggestions` returns the starter prompts an agent offers in chat, for the agents the caller can use.
|
|
42
|
+
- `GET /api/v1/deployments/{deploymentId}/reports/{reportId}/file` returns a report's definition as canonical JSON text (`content`) with its SHA-256 (`hash`), and `PATCH` on the same path changes part of it by exact-text replacement.
|
|
43
|
+
- `GET /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/dashboard/file` returns the classic dashboard draft as canonical JSON text (`content`) with its SHA-256 (`hash`), and `PATCH` on the same path changes part of it by exact-text replacement.
|
|
44
|
+
- `POST /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` and `POST …/tokens-for-meta-sync` now return `data.scopes`, the runtime scopes signed into the token. A requested scope the caller may not hold is dropped rather than refused, so this is how a caller tells which ones it got — for example, whether a meta-sync token carries `meta-private`. The token listing (`GET …/tokens`) is unchanged. The `data` type of the `POST …/tokens` response is now the schema `CreatedDeploymentEnvironmentToken` (was `DeploymentEnvironmentToken`), so code that names the old type for that response needs updating.
|
|
38
45
|
|
|
39
46
|
### Changed
|
|
40
47
|
|
|
41
|
-
- `POST /api/v1/deployments/{deploymentId}/scheduled-tasks` now requires the new deployment-scoped `ScheduledTasksCreate` permission and answers `403` without it
|
|
42
|
-
- `POST /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens-for-meta-sync` can now sign the `meta-private` scope
|
|
48
|
+
- `POST /api/v1/deployments/{deploymentId}/scheduled-tasks` now requires the new deployment-scoped `ScheduledTasksCreate` permission and answers `403` without it. Every built-in role grants it, so only a custom role can withhold it. A custom role saved before this release keeps creating tasks on every deployment where it can use the agent, until an admin saves it without the permission; a custom role saved since holds it only where an admin grants it. Reading, updating, pausing, running and deleting a task are unchanged, including for a creator who no longer holds the permission. The RBAC action enums (`Policy.actions`, the resource user/group policy schemas and their inherited variants) gained `ScheduledTasksCreate`.
|
|
49
|
+
- `POST /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens-for-meta-sync` can now sign the `meta-private` scope. It still always signs `meta`, and adds `meta-private` when it is listed in `scopes` and the caller holds data model read access (`SchemaRead`) on the deployment, or is an admin on a tenant with RBAC off; otherwise it is dropped rather than signed, and any other requested scope is still ignored. A token carrying it may pass `include_private=true` to the Metadata API (`/v1/entities`, `/v1/entities/{name}`, `/v1/entities/all`) to read private cubes, views and members with their full definitions; data access policies still apply. `POST …/tokens` does not sign `meta-private`.
|
|
43
50
|
|
|
44
51
|
## [0.16.0] - 2026-09-29
|
|
45
52
|
|
|
@@ -51,9 +58,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
51
58
|
|
|
52
59
|
### Added
|
|
53
60
|
|
|
54
|
-
- `GET /api/v1/app-config` returns `aiPaywalled
|
|
61
|
+
- `GET /api/v1/app-config` returns `aiPaywalled`: `true` when the tenant uses the new UI without having enabled AI. An embed then offers no AI, whatever the session's `allowAi` says, because the server refuses its AI credentials.
|
|
55
62
|
- New public REST endpoints for agent scheduled tasks: `GET` / `POST /api/v1/deployments/{deploymentId}/scheduled-tasks`, `GET` / `PUT` / `DELETE …/scheduled-tasks/{taskId}`, `POST …/scheduled-tasks/{taskId}/run` and `GET …/scheduled-tasks/{taskId}/runs` (`ScheduledTasksPublicController.listScheduledTasks` / `createScheduledTask` / `getScheduledTask` / `updateScheduledTask` / `deleteScheduledTask` / `runScheduledTask` / `listScheduledTaskRuns`). A scheduled task is a saved prompt the deployment's agent runs on a cron in an IANA time zone, or only on demand, and each run writes a new chat thread. The endpoints answer `403` unless scheduled tasks are enabled for the account, the caller holds read access to the deployment, and the request is not an embed session. Anyone with that access can list and read the deployment's tasks; only a task's creator, whom every run acts as, or an admin can update, delete or run it. A cron must fire at most once an hour (its minute field is a single number), and a user can have at most 20 active (scheduled and enabled) tasks across the account's deployments. A bad cron or time zone answers `400`, and a create or resume past the limit answers `409`; Manual and paused tasks don't count toward the limit. Each task carries `userId` (the creator) and `nextRunAt`. Both lists support cursor pagination; the tasks list has no cap (omitting `first` returns every task), but the runs list only ever holds the 50 most recent runs, so `first`/`after` page within that window rather than a longer history. New schemas: `ScheduledTaskResponse`, `ScheduledTaskListResponse`, `CreateScheduledTaskInput`, `UpdateScheduledTaskInput`, `RunScheduledTaskResponse`, `ScheduledTaskRunResponse`, `ScheduledTaskRunsListResponse`.
|
|
56
|
-
- `ReportPlacementResultChecksum` / `ReportPlacementResultChecksumInput` — used by `PUT /api/v1/deployments/{deploymentId}/reports/{reportId}/refresh` and `.../connect-workbook` — gained an optional `payload` field (1–128 chars
|
|
63
|
+
- `ReportPlacementResultChecksum` / `ReportPlacementResultChecksumInput` — used by `PUT /api/v1/deployments/{deploymentId}/reports/{reportId}/refresh` and `.../connect-workbook` — gained an optional `payload` field (1–128 chars): a hash of the grid the add-in just wrote, opaque to the server, so a later refresh can skip rewriting an unchanged block.
|
|
57
64
|
|
|
58
65
|
## [0.14.0] - 2026-09-23
|
|
59
66
|
|
|
@@ -63,8 +70,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
63
70
|
|
|
64
71
|
### Changed
|
|
65
72
|
|
|
66
|
-
- `POST /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` now signs only an allowlisted `scopes` entry, and authorizes each one separately
|
|
67
|
-
- `GET /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` now lists only the tokens the calling user minted
|
|
73
|
+
- `POST /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` now signs only an allowlisted `scopes` entry, and authorizes each one separately. The allowlist is `meta` and `sql-runner`; anything else, including `ai-engineer` and `agents-config` (gated elsewhere on schema access and privileged settings), is dropped rather than signed. `sql-runner` additionally requires SQL Runner read access on that deployment, and a caller-supplied `sql-runner-permissions:*` entry is never honoured — the server appends the non-DDL qualifier itself when DDL is disabled, matching the GraphQL mint. Before, deployment edit access granted every requested scope.
|
|
74
|
+
- `GET /api/v1/deployments/{deploymentId}/environments/{environmentId}/tokens` now lists only the tokens the calling user minted. Before, any caller with read access to the deployment received every live token in the environment, credential included. The response shape is unchanged. Ownership is derived from a claim the mint stamps into each token, so a token minted before this release belongs to nobody and stops appearing; tokens expire within the hour regardless. One listing covers the most recent 1000 live tokens of the environment, which is far above what an hour of minting produces.
|
|
68
75
|
- The token routes (`GET`/`POST …/tokens`, `POST …/tokens-for-meta-sync`) no longer accept an embed session. Minting a Cube API credential is not an embed capability. `GET …/environments` is unchanged.
|
|
69
76
|
- `POST …/tokens` applies the same security-context gate as the console's token mutations: a caller without deployment edit access (admin or developer role) has every key of `security_context` dropped before signing, and a caller-supplied `scope` claim is never signed on any tier. The response's `security_context` now echoes what was actually signed.
|
|
70
77
|
- `scopes` on `POST …/tokens` also requires deployment edit access — it is a runtime grant (`sql-runner`, `agents-config`), gated the same way the console's equivalent mint is. It is ignored for a caller without that access, and a `dev-token` entry is never honoured from any caller. `tokens-for-meta-sync` still forces `meta` regardless.
|
|
@@ -73,13 +80,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
73
80
|
|
|
74
81
|
### Added
|
|
75
82
|
|
|
76
|
-
- New public REST endpoints for promoting a workbook across deployments
|
|
77
|
-
- `Workbook` gained `promotion`
|
|
78
|
-
- New public REST endpoint `GET /api/v1/external-documents/{externalWorkbookId}/placements` (`ExternalDocumentsPublicController.listExternalDocumentPlacements`)
|
|
83
|
+
- New public REST endpoints for promoting a workbook across deployments: `POST /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/promotion-previews` (`WorkbookPromotionsPublicController.previewWorkbookPromotion`) validates the promotion and returns content hashes for optimistic concurrency, without storing anything; `POST .../promotions` (`.promoteWorkbook`) applies it atomically if the source hash still matches the preview, preserving the workbook's deployment-scoped slug across repeat promotions, and takes an idempotency key to make retries safe; `GET .../promotion` (`.getWorkbookPromotion`) returns the workbook's promotion provenance; `GET .../promotions` (`.getWorkbookPromotions`) lists its promotion history with cursor pagination; `GET .../promotion-links` (`.getWorkbookPromotionLinks`) lists its promotion destinations. Requires access to both deployments, and a workspace session or API key — not an embed session. New schemas: `WorkbookPromotionDto`, `WorkbookPromotionDtoOutcome`, `WorkbookPromotionPreviewDto`, `WorkbookPromotionSummaryResponse`, `WorkbookPromotionSummaryDto`, `WorkbookPromotionsListResponse`, `WorkbookPromotionLinkDto`, `WorkbookPromotionLinksListResponse`, `PromotionActorDto`, `PromotionActorDtoAuthenticationMethod`, `PromotionReferenceDto`, `PromotionReferenceDtoAvailability`, `PreviewWorkbookPromotionInput`, `ApplyWorkbookPromotionInput`.
|
|
84
|
+
- `Workbook` gained `promotion` — the workbook's promotion summary (`WorkbookPromotionSummaryDto`), `null` on a workbook that has never been promoted or received a promotion.
|
|
85
|
+
- New public REST endpoint `GET /api/v1/external-documents/{externalWorkbookId}/placements` (`ExternalDocumentsPublicController.listExternalDocumentPlacements`) lists every block of Cube-written cells in an external spreadsheet — a Google Drive file id, or the custom property the Excel add-in writes — across the whole tenant, including placements the caller cannot read: each entry carries `access: GRANTED | DENIED` — a denied entry still carries the placement's address, the owning `deploymentId`, and the exploration owner's name and email address (when Cube can resolve one), so the recipient can request access; only `reportName` is withheld (`null`). Tenant-scoped, unlike `GET /api/v1/deployments/{deploymentId}/reports?externalWorkbookId=`, which lists only readable reports for one deployment. Supports cursor pagination (`first`/`after`); omitting `first` returns every placement in the document. Answers `422` rather than a truncated page if the document holds more than 500 placed explorations or 2000 total placements. New schema: `ExternalDocumentPlacementsListResponse` (`ExternalDocumentPlacementResponse`, `ExternalDocumentPlacementResponseAccess`, `ExternalDocumentPlacementResponseHost`).
|
|
79
86
|
|
|
80
87
|
### Removed
|
|
81
88
|
|
|
82
|
-
- **BREAKING:** the deprecated agent Jira/Atlassian schema surface is deleted
|
|
89
|
+
- **BREAKING:** the deprecated agent Jira/Atlassian schema surface is deleted, one release after `0.12.0` shipped it deprecated-but-present. Gone: `Agent.integrations` and `UpdateAgentInput.integrations` (with `AgentIntegrationsDto`, `AgentIntegrationsJiraDto`, `JiraSite`, `JiraProject`, `JiraIssueType` and their `*Input` counterparts), the `atlassianConfig` / `jiraProjects` / `jiraIssueTypes` queries, and the `useD3AiJiraIntegration` tenant flag. All of them answered null, empty or false for their whole deprecated life — nothing read or wrote them, because the OAuth callback, credential storage and token refresh behind them were removed in `0.12.0`. A client that still **selects** one of these fields will now fail the whole GraphQL query rather than receive null, so remove them from your operations if you have not already. The same removal reaches this package's generated REST types: `AgentIntegrationsDto`, `AgentIntegrationsJiraDto`, `JiraSite`, `JiraProject` and `JiraIssueType` are gone from `schema.ts`, and `Agent.integrations` no longer exists on the `Agent` component — a TypeScript consumer that still references any of them fails to compile on upgrade, not just at runtime. Notably, none of this was ever marked `deprecated: true` in the public OpenAPI spec during `0.12.0`'s deprecation window, so a REST/SDK consumer had no machine-readable warning before this release removed it outright.
|
|
83
90
|
- `AgentsWithIntegrations` keeps its name despite no longer selecting any integrations. Renaming a published operation would break every caller on top of the field removal, for cosmetic gain; it is a plain agents query now.
|
|
84
91
|
|
|
85
92
|
## [0.12.0] - 2026-09-20
|
|
@@ -88,8 +95,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
88
95
|
|
|
89
96
|
- `AppConfigResponse` gained `dashboardAppsEnabled` — whether this tenant has Dashboard Apps, for a client with no other read path to tenant flags (the creator-mode embed, the Sheets add-in) to tell whether to render an `APP`-kind workbook as the app rather than the classic builder — and `restrictDataDownload` — the tenant-wide data-download lock, exposed here for the same reason: an embed has no other read path to it, and previously only the published-dashboard embed carried a copy on its own payload.
|
|
90
97
|
- `ReportSnapshot` gained `publicId` — the snapshotted report's public id, which is what a published Dashboard App resolves a report by (`useReportData('<publicId>')`); `null` on versions written before it was recorded.
|
|
91
|
-
- `TenantSettings` gained `aiTokensAutoPurchaseEnabled`, `aiTokensAutoPurchaseThreshold` and `aiTokensAutoPurchaseAmount`
|
|
92
|
-
- `PivotItems` / `PivotItemsInput` gained `showRowTotals`
|
|
98
|
+
- `TenantSettings` gained `aiTokensAutoPurchaseEnabled`, `aiTokensAutoPurchaseThreshold` and `aiTokensAutoPurchaseAmount` — automatic AI-token top-up; `TenantSettingsInput` gained only `aiTokensAutoPurchaseEnabled` and `aiTokensAutoPurchaseAmount`, since `Threshold` is staff-set per tenant and not customer-configurable through this endpoint. `Threshold`/`Amount` are dollar amounts and are only meaningful while `Enabled`; `Amount` is retained when it is switched off so re-enabling restores what the customer had.
|
|
99
|
+
- `PivotItems` / `PivotItemsInput` gained `showRowTotals` — whether a trailing "Total" column is appended, totaling each row across the pivot columns; the row-axis counterpart of the existing `showColumnTotals`. Ignored without a Columns zone, same as its sibling.
|
|
93
100
|
|
|
94
101
|
### Changed
|
|
95
102
|
|
|
@@ -97,34 +104,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
97
104
|
|
|
98
105
|
### Deprecated
|
|
99
106
|
|
|
100
|
-
- The agent Jira/Atlassian integration no longer does anything
|
|
107
|
+
- The agent Jira/Atlassian integration no longer does anything. `Agent.integrations` (`AgentIntegrationsDto`, `AgentIntegrationsJiraDto`), `UpdateAgentInput.integrations`, the `atlassianConfig` / `jiraProjects` / `jiraIssueTypes` queries and `useD3AiJiraIntegration` are **deprecated, not removed** — they remain in the schema returning null/false so existing clients keep working, and are deleted in a later release. Nothing reads or writes them: the OAuth callback, credential storage and token refresh behind them are gone.
|
|
101
108
|
|
|
102
109
|
## [0.11.0] - 2026-09-15
|
|
103
110
|
|
|
104
111
|
### Added
|
|
105
112
|
|
|
106
|
-
- `FolderDto` gained `user`
|
|
107
|
-
- `GenerateSession` gained `branchName`
|
|
108
|
-
- New public REST endpoint `POST /api/v1/embed/session/revoke` (`EmbedPublicController.revokeSession`)
|
|
113
|
+
- `FolderDto` gained `user` — the folder's owner, resolved the same way workbook owners are; `null` on a folder shared from the main workspace, which stays masked. Fixes the embed workspace's Owner column always rendering a dash, including for a folder the caller just created.
|
|
114
|
+
- `GenerateSession` gained `branchName` — the deployment branch an embed session queries. Omit it (or pass the deployment's production branch) for the production environment, which stays the default; any other branch of the deployment — one with a staging environment enabled, a shared branch, or a personal dev branch — points every Cube query the embedded dashboards, Creator Mode workspace and chat make at that branch's runtime (`<deploymentUrl>/dev-mode/{branchName}/cubejs-api/v1`) instead. The branch must be served when the session is generated: a name that is not a branch of the deployment returns `404`, and a branch nothing is running returns `400` — a branch without a staging environment is only running while someone has it open in Cube, so enable its staging environment for a branch an embedded app should reach at any time. Content is not branch-scoped: the same dashboards and workbooks are rendered against the chosen branch's data model. The embedded chat and AI widgets follow the session onto the branch as well, so an agent answers from the same data model the dashboards show.
|
|
115
|
+
- New public REST endpoint `POST /api/v1/embed/session/revoke` (`EmbedPublicController.revokeSession`) ends a signed embed session from the server side — call it from your application's logout handler with the `sessionId` that `POST /api/v1/embed/generate-session` returned. Works on either state a session can be in: an unexchanged id can no longer be redeemed via `POST /api/v1/embed/session/token`, and a token an already-exchanged id produced is rejected with `401` from that point on. Idempotent — revoking an unknown, expired, or already-revoked id also responds `204`, so the response alone never tells you whether a token was still revocable. That depends on Cube, not on the client library you call from: only tokens Cube issued after this endpoint shipped carry the revocation claim, and an older token keeps working until it expires on its own, within 24 hours. Requires admin access and that embedding be enabled for the account. New schema: `RevokeEmbedSessionInput`.
|
|
109
116
|
|
|
110
117
|
## [0.10.0] - 2026-09-14
|
|
111
118
|
|
|
112
119
|
### Added
|
|
113
120
|
|
|
114
|
-
- `GET /api/v1/deployments/{deploymentId}/dbt-sync/{syncJobId}/generated-files` (`DbtSyncPublicController.getDbtSyncGeneratedFiles`) returns the cube files a dbt sync generated when it did not commit them, with cursor pagination
|
|
115
|
-
- `StartDbtSyncInput` gained `output
|
|
116
|
-
- New RBAC action `ChatHistoryRead`
|
|
117
|
-
- `PivotItems` / `PivotItemsInput` gained `showAppliedFilters
|
|
121
|
+
- `GET /api/v1/deployments/{deploymentId}/dbt-sync/{syncJobId}/generated-files` (`DbtSyncPublicController.getDbtSyncGeneratedFiles`) returns the cube files a dbt sync generated when it did not commit them, with cursor pagination. The files are held for one hour after the sync completes and then dropped, so collect them promptly; a sync that committed to a branch instead, or a stale/unknown job, gets a 404. Requires deployment read access. New schemas: `DbtSyncGeneratedFilesListResponse`, `DbtGeneratedFileContent`.
|
|
122
|
+
- `StartDbtSyncInput` gained `output`: `'branch'` (the default, unchanged) commits the generated cubes to a new Cube branch for review; `'files'` commits nothing and creates no branch, so the files can be read back from the new `generated-files` endpoint and committed through your own CI's review instead.
|
|
123
|
+
- New RBAC action `ChatHistoryRead` for scoping read access to chat history independently of `ChatThreadRead`. Assignable wherever a policy action is: `Policy.actions`, `RoleWithAccess.actions`, and the resource/group/user policy DTOs.
|
|
124
|
+
- `PivotItems` / `PivotItemsInput` gained `showAppliedFilters`: a per-exploration override for whether a report written to a worksheet carries the applied-filter summary, above the existing account- and user-level settings of the same name. Omitting it means the exploration has no opinion — the user's (or account's) setting stands — rather than turning the annotation off.
|
|
118
125
|
|
|
119
126
|
## [0.9.0] - 2026-09-12
|
|
120
127
|
|
|
121
128
|
### Added
|
|
122
129
|
|
|
123
|
-
- New public REST API for managing Databricks Metric View publication settings
|
|
124
|
-
- New public REST API for listing the workbooks an embed tenant can access
|
|
125
|
-
- New public REST API for commenting on embeddable dashboards
|
|
126
|
-
- `EmbedSessionSettings` gained `locale` and `timezone`
|
|
127
|
-
- `AppConfigResponse` gained `sheetsAgentChatEnabled`
|
|
130
|
+
- New public REST API for managing Databricks Metric View publication settings: `GET /api/v1/deployments/{deploymentId}/databricks-metric-view-integrations/{dataSourceName}` (`DatabricksMetricViewIntegrationPublicController.getIntegration`) reads the current configuration and requires `SchemaRead` or `SchemaUpdate` access; `PUT` (`saveIntegration`) creates or updates it using optimistic `configurationVersion`-based concurrency (pass `expectedConfigurationVersion: 0` to create) and requires `SchemaUpdate` access. Both require a Databricks datasource; this is currently in preview — reach out to the Cube support team to activate it for your account. New schemas: `DatabricksMetricViewIntegrationResponse`, `DatabricksMetricViewIntegrationConfigurationResponse`, `SaveDatabricksMetricViewIntegrationInput`.
|
|
131
|
+
- New public REST API for listing the workbooks an embed tenant can access: `GET /api/v1/deployments/{deploymentId}/embed-tenants/{embedTenantName}/workbooks` (`DashboardEmbedAccessPublicController.listEmbedTenantWorkbooks`) returns the tenant's effective access — direct tenant shares, all-embed-user shares, and access inherited from shared folders — with optional `accessSource` (`tenant` | `allEmbedUsers` | `folder`) filtering and cursor pagination. Requires administrator privileges. New schema: `EmbedTenantWorkbooksListResponse`.
|
|
132
|
+
- New public REST API for commenting on embeddable dashboards: `GET /api/v1/embed/dashboard/{publicId}/comments` (`EmbedPublicController.listDashboardComments`) lists comment threads; `POST` (`createDashboardComment`) starts a thread or replies to one; `PATCH .../comments/{commentId}` (`updateDashboardComment`) and `DELETE .../comments/{commentId}` (`removeDashboardComment`) edit or soft-delete a comment (author only); `POST .../comments/{commentId}/resolve` (`setDashboardCommentResolved`) resolves or re-opens a thread (author only); `GET .../comments/mentionable-users` (`listMentionableEmbedUsers`) lists the caller's fellow embed users for a mention autocomplete. Requires a signed embed session scoped to an embed tenant. New schemas: `EmbedDashboardCommentDto`, `EmbedDashboardCommentThreadDto`, `EmbedDashboardCommentThreadsListResponse`, `CreateEmbedDashboardCommentBody`, `UpdateEmbedDashboardCommentBody`, `SetEmbedDashboardCommentResolvedBody`, `EmbedMentionableUserDto`, `EmbedMentionableUsersListResponse`.
|
|
133
|
+
- `EmbedSessionSettings` gained `locale` and `timezone` — a session's own language and time zone, resolved host message → launch param → session → account → built-in default; and four per-session Creator Mode opt-outs: `showWorkbookShare`, `showDashboardSettings`, `showMemberNames`, `showGroupByCube`.
|
|
134
|
+
- `AppConfigResponse` gained `sheetsAgentChatEnabled` — whether the Sheets add-in's chat can act on the spreadsheet (run a query into cells, read a range) rather than only describe changes it cannot make.
|
|
128
135
|
|
|
129
136
|
### Fixed
|
|
130
137
|
|
|
@@ -134,15 +141,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
134
141
|
|
|
135
142
|
### Added
|
|
136
143
|
|
|
137
|
-
- New public REST API for previewing a Databricks Metric View publication
|
|
138
|
-
- `StartDbtSyncInput` gained `source` (`"git"` | `"manifest"`) and `manifest` — pass an uploaded `manifest.json` directly instead of having Cube clone the dbt repository and run dbt itself
|
|
139
|
-
- `EmbedSessionSettings` / `EmbedSettings` gained `allowAi`, `showAiWidgets`, and `showWorkbookChat`
|
|
144
|
+
- New public REST API for previewing a Databricks Metric View publication: `POST /api/v1/deployments/{deploymentId}/databricks-metric-view-previews` (`DatabricksMetricViewPublicationPublicController.startPreview`) queues an offline conversion of the deployment's latest successful build and returns `202` with polling URLs; `GET .../databricks-metric-view-previews/{previewId}` (`previewStatus`) polls progress; `GET .../databricks-metric-view-previews/{previewId}/result` (`previewResult`) returns the completed result (`409` while still running or if it ended without one); `DELETE .../databricks-metric-view-previews/{previewId}` (`cancelPreview`) requests cancellation. Requires `SchemaRead` or `SchemaUpdate` access; this is currently in preview — reach out to the Cube support team to activate it for your account. Preview payloads and results are retained for at most seven days. New schemas: `DatabricksMetricViewPublicationPreviewInput`, `DatabricksMetricViewPublicationPreviewStartResponse`, `DatabricksMetricViewPublicationPreviewStatusResponse`, `DatabricksMetricViewPublicationPreviewResultResponse`, `DatabricksMetricViewPublicationViewResult`, `DatabricksMetricViewPublicationIssue`, `DatabricksMetricViewPublicationCounts`, `DatabricksMetricViewPublicationDatasetSource`, `DatabricksMetricViewPublicationRuntime`, `DatabricksMetricViewPublicationProgress`.
|
|
145
|
+
- `StartDbtSyncInput` gained `source` (`"git"` | `"manifest"`) and `manifest` — pass an uploaded `manifest.json` directly instead of having Cube clone the dbt repository and run dbt itself. The corresponding `DbtSyncRun` response gained `source` (which pull path a run used), and `DbtSyncRunStats` gained `dbtVersion` and `manifestGeneratedAt`, populated for manifest-sourced runs.
|
|
146
|
+
- `EmbedSessionSettings` / `EmbedSettings` gained `allowAi`, `showAiWidgets`, and `showWorkbookChat` — per-session AI opt-outs for embeds. `allowAi` disables every AI surface, including the standalone embed chat, and is enforced server-side so a client holding the token can't work around it; the `show*` keys (alongside the existing `showDashboardChat`) only hide specific entry points — the dashboard agent, workspace chat, and AI-summary widget generation, respectively.
|
|
140
147
|
|
|
141
148
|
## [0.7.0] - 2026-09-09
|
|
142
149
|
|
|
143
150
|
### Added
|
|
144
151
|
|
|
145
|
-
- New public REST API for rendering a published dashboard to PNG or PDF
|
|
152
|
+
- New public REST API for rendering a published dashboard to PNG or PDF: `POST /api/v1/deployments/{deploymentId}/dashboard-exports` (`DashboardExportsPublicController.startExport`) submits a render, `GET .../dashboard-exports/{jobId}` (`getExportStatus`) polls its status, and `GET .../dashboard-exports/{jobId}/download` (`downloadExport`) streams the finished file. Asynchronous because a render waits for every widget to finish querying — the job and its file are dropped 5 minutes after submission. By default the render runs under the caller's own security context (requires manage access to the dashboard's workbook); a tenant admin can instead pass `renderAs` to render as another console or embed user, the same subject vocabulary a scheduled notification's recipients use. New schemas: `StartDashboardExportInput`, `DashboardExportJobResponse`, `DashboardExportStatusResponse`, `ExportSubjectInput`.
|
|
146
153
|
- `CreateNotificationInput` / `UpdateNotificationInput` gained `memberSwitchers` — Field-switcher selections applied when the notification's dashboard is rendered — read back on the notification response too. New schema: `DashboardMemberSwitcherInput` / `DashboardMemberSwitcher`.
|
|
147
154
|
- `ConnectReportToWorkbookInput`, `CreateReportInput`, `UpdateReportInput` and `RefreshReportInput` gained `resultChecksum` — a client-computed fingerprint of the cells a write just placed on the sheet, echoed back on `ReportPlacement.resultChecksum` so a client can tell whether a placement has been hand-edited since. New schemas: `ReportPlacementResultChecksumInput` / `ReportPlacementResultChecksum`, `ReportPlacementResultChunkInput` / `ReportPlacementResultChunk`. `ConnectReportToWorkbookInput` also gained `addressOnly`, for an address-only correction (e.g. a renamed sheet tab) that should not erase the stored fingerprint.
|
|
148
155
|
- `PivotItems` / `PivotItemsInput` gained `displayScale` (`"model"` | `"absolute"` | `"thousands"` | `"millions"` | `"billions"`) and `showColumnTotals`.
|
|
@@ -150,14 +157,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
150
157
|
|
|
151
158
|
### Changed
|
|
152
159
|
|
|
153
|
-
- `CreateReportInput.name` / `.title`, `UpdateReportInput.name` / `.title`, and the `Report.name` response field now enforce `maxLength: 255`
|
|
160
|
+
- `CreateReportInput.name` / `.title`, `UpdateReportInput.name` / `.title`, and the `Report.name` response field now enforce `maxLength: 255` — matching the column's real storage limit, so a name or title over that limit now returns `400` instead of failing less predictably downstream.
|
|
154
161
|
|
|
155
162
|
## [0.6.0] - 2026-09-02
|
|
156
163
|
|
|
157
164
|
### Added
|
|
158
165
|
|
|
159
166
|
- `User` (`GET /api/v1/users/me`, `UsersPublicController.getMe`) gained `userPolicies` — the caller's effective resource policies: direct grants, organization-wide grants and grants inherited from their groups. This is the set the console has always read over GraphQL; on REST it lets an embedded Creator Mode session resolve a workbook another embed user shared with it, which previously granted nothing beyond viewing. New schemas: `Policy`, `PolicyResourceType`.
|
|
160
|
-
- Re-added `POST /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/dashboard/ai-widget-thread` (`WorkbooksPublicController.updatePublishedDashboardAiWidgetThread`) and its `UpdatePublishedAiWidgetThreadInput` schema (`widgetId`, `threadId`, optional `checksum`) — reverting the `0.4.0` removal. Regenerating an AI-analysis widget on a **published** dashboard persists the new thread id (+ checksum) back to the published config so an immediate reload shows the fresh result instead of the stale one. It stores **only** the thread id and checksum — never summary text
|
|
167
|
+
- Re-added `POST /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/dashboard/ai-widget-thread` (`WorkbooksPublicController.updatePublishedDashboardAiWidgetThread`) and its `UpdatePublishedAiWidgetThreadInput` schema (`widgetId`, `threadId`, optional `checksum`) — reverting the `0.4.0` removal. Regenerating an AI-analysis widget on a **published** dashboard persists the new thread id (+ checksum) back to the published config so an immediate reload shows the fresh result instead of the stale one. It stores **only** the thread id and checksum — never summary text.
|
|
161
168
|
- `PATCH /api/v1/users/me/settings` (`UsersPublicController.updateMySettings`) — merge a partial patch into your own settings; omitted fields are left as they are, and `sheets` merges field-by-field (an explicit `null` clears it). `UserSettingsInput` gained `sheets`. New schema: `SheetsUserSettingsInput` (`autoRunQueryOnChange`, `openExplorationFromSheet`, `revealSheetOnOpen`, `showAppliedFilters`, `suppressDuplicateValues`).
|
|
162
169
|
- `POST /api/v1/deployments/{id}/token` (`DeploymentsPublicController.deploymentToken`) now accepts an optional body to request a shorter token lifetime than the 24-hour default. New schema: `CreateDeploymentTokenInput` (`expiresIn`, 60–86400 seconds) — recommended for tokens held outside a browser session (scripts, BI tools, scheduled jobs).
|
|
163
170
|
- `AppTheme` / `AppThemeResponse` (`GET /api/v1/app-theme`, `GET /api/v1/app-config`) gained `palette` and `logoUrl` — the new theme model: base/accent color seeds, contrast level, a pastel toggle, surface mode, and per-semantic color overrides (danger/warning/success/note/code). New schemas: `AppThemePalette`, `AppThemePaletteSeed`, `AppThemePaletteThemes`, `AppThemeCodePalette`, `AppThemeSurfaceMode`.
|
|
@@ -234,12 +241,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
234
241
|
|
|
235
242
|
- **BREAKING (TypeScript):** `DeploymentEnvironmentsListResponse.pagination` and `DeploymentEnvironmentTokensListResponse.pagination` moved from required to `pagination?: DeploymentsPagination | null` now that both responses also carry `items`/`pageInfo`. Code under `strictNullChecks` reading `res.pagination.currentPage` without a null check no longer compiles.
|
|
236
243
|
- **BREAKING (TypeScript):** `NotificationsPublicController.getRecipients`'s cursor params were narrowed — `first?: number | string | null` → `first?: number | null` and `after?: string | number | null` → `after?: string | null` — cleaning up a hand-declared `@OpenAPI({ parameters })` that had merged positionally with the real cursor-param types. A caller passing a numeric `after` or a stringified `first` (both accepted, if oddly typed, before) no longer compiles.
|
|
237
|
-
- `DashboardWidgetDtoType` / `DashboardWidgetInputType` no longer advertise `TABS_CONTAINER` in the type — replaced by `PARENT`, `SPACER`, `DIVIDER`, `CONTAINER` (a `CONTAINER` with `config.layout: 'tabs'` is the current shape for a tabbed container). Existing stored or sent `TABS_CONTAINER` values are still healed server-side for backward compatibility
|
|
244
|
+
- `DashboardWidgetDtoType` / `DashboardWidgetInputType` no longer advertise `TABS_CONTAINER` in the type — replaced by `PARENT`, `SPACER`, `DIVIDER`, `CONTAINER` (a `CONTAINER` with `config.layout: 'tabs'` is the current shape for a tabbed container). Existing stored or sent `TABS_CONTAINER` values are still healed server-side for backward compatibility, so this narrows the advertised type rather than breaking existing integrations at runtime — new code should target `CONTAINER` + `layout`.
|
|
238
245
|
- `PUT /api/v1/deployments/{deploymentId}` (`updateDeployment`) description clarified: writes are a partial merge (omitted fields are left alone, `templateVariables` is merged key-by-key), and `releaseChannelVersion` is validated against `GET .../versions`.
|
|
239
246
|
|
|
240
247
|
### Removed
|
|
241
248
|
|
|
242
|
-
- **BREAKING:** `POST /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/dashboard/ai-widget-thread` (`WorkbooksPublicController.updatePublishedDashboardAiWidgetThread`) and its `UpdatePublishedAiWidgetThreadInput` schema (added in `0.2.0`). It persisted an AI-analysis thread id + checksum into the published dashboard config — the mechanism that caused read-only/anonymous viewers to hit `WorkbookEdit`/403s and let one viewer's filter state clobber the shared config
|
|
249
|
+
- **BREAKING:** `POST /api/v1/deployments/{deploymentId}/workbooks/{workbookId}/dashboard/ai-widget-thread` (`WorkbooksPublicController.updatePublishedDashboardAiWidgetThread`) and its `UpdatePublishedAiWidgetThreadInput` schema (added in `0.2.0`). It persisted an AI-analysis thread id + checksum into the published dashboard config — the mechanism that caused read-only/anonymous viewers to hit `WorkbookEdit`/403s and let one viewer's filter state clobber the shared config. AI-analysis results are recovered by replaying the chat thread whose id the dashboard config stores, so no client-facing endpoint replaces it. This is a deliberate breaking removal; SDK consumers referencing the operation or schema should drop those references.
|
|
243
250
|
|
|
244
251
|
## [0.3.0] - 2026-07-30
|
|
245
252
|
|
|
@@ -10,5 +10,5 @@ export interface CubePlatformApiProviderProps {
|
|
|
10
10
|
client: CubePlatformClient;
|
|
11
11
|
children: ReactNode;
|
|
12
12
|
}
|
|
13
|
-
export declare function CubePlatformApiProvider({ client, children }: CubePlatformApiProviderProps): import("react
|
|
13
|
+
export declare function CubePlatformApiProvider({ client, children }: CubePlatformApiProviderProps): import("react").JSX.Element;
|
|
14
14
|
//# sourceMappingURL=CubePlatformApiProvider.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"CubePlatformApiProvider.d.ts","sourceRoot":"","sources":["../../src/react-query/CubePlatformApiProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAW,MAAM,OAAO,CAAC;AAC/D,OAAiC,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAExF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,6DAA0D,CAAC;AAE9F,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,uBAAuB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,4BAA4B
|
|
1
|
+
{"version":3,"file":"CubePlatformApiProvider.d.ts","sourceRoot":"","sources":["../../src/react-query/CubePlatformApiProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAW,MAAM,OAAO,CAAC;AAC/D,OAAiC,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAExF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,6DAA0D,CAAC;AAE9F,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,uBAAuB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,4BAA4B,+BAUzF"}
|