@databricks/sdk-auth 0.1.0-dev.3 → 0.1.0-dev.5

package/dist/credentials/default/chain.d.ts

@@ -1,22 +1,38 @@
 import type { Profile } from '@databricks/sdk-core/profiles';
 import type { Credentials, Header } from '../../auth';
 /**
- * A strategy inspects a profile and either returns configured credentials
- * or `undefined` if it is not applicable.
+ * A named strategy that inspects a profile and either returns configured
+ * credentials or `undefined` if it is not applicable. The `name` matches the
+ * `name()` of the credentials it produces, so it can be selected by a
+ * profile's `authType`.
  */
-export type Strategy = (profile: Profile) => Credentials | undefined;
+export interface Strategy {
+    /** Short identifier, e.g. `pat`, `oauth-m2m`, or `databricks-cli`. */
+    readonly name: string;
+    readonly configure: (profile: Profile) => Credentials | undefined;
+}
 /**
- * Lazy {@link Credentials} that resolves to the first configured strategy
- * on the first `authHeaders()` call.
+ * Lazy {@link Credentials} that resolves to a configured strategy on the
+ * first `authHeaders()` call.
+ *
+ * If the profile sets `authType`, the strategy whose name matches it is
+ * selected. Otherwise the strategies are tried in order and the first
+ * configured one wins.
  */
 export declare class DefaultCredentials implements Credentials {
     private readonly strategies;
     private readonly loadProfile;
     private resolved;
     constructor(strategies: readonly Strategy[], loadProfile: () => Promise<Profile>);
+    /**
+     * Returns `default` until a strategy has been resolved, then delegates to
+     * the resolved strategy so callers (logging, telemetry) can tell which
+     * authentication method won.
+     */
     name(): string;
     authHeaders(): Promise<Header[]>;
     private resolveChain;
+    private resolveByAuthType;
 }
 /** PAT strategy: configured when `token` is set in the profile. */
 export declare const patStrategy: Strategy;

package/dist/credentials/default/chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../../src/credentials/default/chain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,+BAA+B,CAAC;AAE3D,OAAO,KAAK,EAAC,WAAW,EAAE,MAAM,EAAC,MAAM,YAAY,CAAC;AAMpD;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,WAAW,GAAG,SAAS,CAAC;AAKrE;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IAIlD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAJ9B,OAAO,CAAC,QAAQ,CAA0B;gBAGvB,UAAU,EAAE,SAAS,QAAQ,EAAE,EAC/B,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC;IAGtD,IAAI,IAAI,MAAM;IAIR,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAKxB,YAAY;CAa3B;AAED,mEAAmE;AACnE,eAAO,MAAM,WAAW,EAAE,QAIzB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,QAUzB,CAAC"}
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../../src/credentials/default/chain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,+BAA+B,CAAC;AAE3D,OAAO,KAAK,EAAC,WAAW,EAAE,MAAM,EAAC,MAAM,YAAY,CAAC;AAMpD;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,WAAW,GAAG,SAAS,CAAC;CACnE;AAKD;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IAIlD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAJ9B,OAAO,CAAC,QAAQ,CAA0B;gBAGvB,UAAU,EAAE,SAAS,QAAQ,EAAE,EAC/B,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC;IAGtD;;;;OAIG;IACH,IAAI,IAAI,MAAM;IAIR,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAKxB,YAAY;IAiB1B,OAAO,CAAC,iBAAiB;CAiB1B;AAED,mEAAmE;AACnE,eAAO,MAAM,WAAW,EAAE,QAOzB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,QAazB,CAAC"}

package/dist/credentials/default/chain.js

@@ -4,8 +4,12 @@ import { DefaultCredentialsError } from './errors';
 const AUTH_DOC_URL = 'https://docs.databricks.com/aws/en/dev-tools/auth/index';
 const NO_AUTH_CONFIGURED_MESSAGE = `cannot configure default credentials, please check ${AUTH_DOC_URL} to configure credentials for your preferred authentication method`;
 /**
- * Lazy {@link Credentials} that resolves to the first configured strategy
- * on the first `authHeaders()` call.
+ * Lazy {@link Credentials} that resolves to a configured strategy on the
+ * first `authHeaders()` call.
+ *
+ * If the profile sets `authType`, the strategy whose name matches it is
+ * selected. Otherwise the strategies are tried in order and the first
+ * configured one wins.
  */
 export class DefaultCredentials {
     strategies;
@@ -15,8 +19,13 @@ export class DefaultCredentials {
         this.strategies = strategies;
         this.loadProfile = loadProfile;
     }
+    /**
+     * Returns `default` until a strategy has been resolved, then delegates to
+     * the resolved strategy so callers (logging, telemetry) can tell which
+     * authentication method won.
+     */
     name() {
-        return 'default';
+        return this.resolved?.name() ?? 'default';
     }
     async authHeaders() {
         this.resolved ??= await this.resolveChain();
@@ -24,39 +33,59 @@ export class DefaultCredentials {
     }
     async resolveChain() {
         const profile = await this.loadProfile();
+        if (profile.authType !== undefined) {
+            return this.resolveByAuthType(profile, profile.authType);
+        }
         for (const strategy of this.strategies) {
-            const built = strategy(profile);
+            const built = strategy.configure(profile);
             if (built !== undefined) {
                 return built;
             }
         }
         throw new DefaultCredentialsError('NO_AUTH_CONFIGURED', NO_AUTH_CONFIGURED_MESSAGE);
     }
+    resolveByAuthType(profile, authType) {
+        const strategy = this.strategies.find(s => s.name === authType);
+        if (strategy === undefined) {
+            throw new DefaultCredentialsError('AUTH_TYPE_NOT_FOUND', `auth type "${authType}" not found, please check ${AUTH_DOC_URL} for a list of supported auth types`);
+        }
+        const built = strategy.configure(profile);
+        if (built === undefined) {
+            throw new DefaultCredentialsError('NO_AUTH_CONFIGURED', NO_AUTH_CONFIGURED_MESSAGE);
+        }
+        return built;
+    }
 }
 /** PAT strategy: configured when `token` is set in the profile. */
-export const patStrategy = profile => {
-    if (profile.host === undefined)
-        return undefined;
-    if (profile.token === undefined)
-        return undefined;
-    return newPatCredentials(profile.token.value);
+export const patStrategy = {
+    name: 'pat',
+    configure: profile => {
+        if (profile.host === undefined)
+            return undefined;
+        if (profile.token === undefined)
+            return undefined;
+        return newPatCredentials(profile.token.value);
+    },
 };
 /**
  * OAuth M2M strategy: configured when `clientId` and `clientSecret` are
  * both set in the profile.
  */
-export const m2mStrategy = profile => {
-    if (profile.host === undefined)
-        return undefined;
-    if (profile.clientId === undefined)
-        return undefined;
-    if (profile.clientSecret === undefined)
-        return undefined;
-    return newM2mCredentials({
-        host: profile.host,
-        clientId: profile.clientId,
-        clientSecret: profile.clientSecret.value,
-        ...(profile.accountId !== undefined && { accountId: profile.accountId }),
-    });
+export const m2mStrategy = {
+    name: 'oauth-m2m',
+    configure: profile => {
+        if (profile.host === undefined)
+            return undefined;
+        if (profile.clientId === undefined)
+            return undefined;
+        if (profile.clientSecret === undefined)
+            return undefined;
+        return newM2mCredentials({
+            host: profile.host,
+            clientId: profile.clientId,
+            clientSecret: profile.clientSecret.value,
+            ...(profile.accountId !== undefined && { accountId: profile.accountId }),
+        });
+    },
 };
 //# sourceMappingURL=chain.js.map

package/dist/credentials/default/chain.js.map

@@ -1 +1 @@
-{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../../src/credentials/default/chain.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AAEzC,OAAO,EAAC,uBAAuB,EAAC,MAAM,UAAU,CAAC;AAQjD,MAAM,YAAY,GAAG,yDAAyD,CAAC;AAC/E,MAAM,0BAA0B,GAAG,sDAAsD,YAAY,oEAAoE,CAAC;AAE1K;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAIV;IACA;IAJX,QAAQ,CAA0B;IAE1C,YACmB,UAA+B,EAC/B,WAAmC;QADnC,eAAU,GAAV,UAAU,CAAqB;QAC/B,gBAAW,GAAX,WAAW,CAAwB;IACnD,CAAC;IAEJ,IAAI;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,0BAA0B,CAC3B,CAAC;IACJ,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAa,OAAO,CAAC,EAAE;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAa,OAAO,CAAC,EAAE;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,OAAO,iBAAiB,CAAC;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;QACxC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAC,CAAC;KACvE,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../../src/credentials/default/chain.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AAEzC,OAAO,EAAC,uBAAuB,EAAC,MAAM,UAAU,CAAC;AAcjD,MAAM,YAAY,GAAG,yDAAyD,CAAC;AAC/E,MAAM,0BAA0B,GAAG,sDAAsD,YAAY,oEAAoE,CAAC;AAE1K;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IAIV;IACA;IAJX,QAAQ,CAA0B;IAE1C,YACmB,UAA+B,EAC/B,WAAmC;QADnC,eAAU,GAAV,UAAU,CAAqB;QAC/B,gBAAW,GAAX,WAAW,CAAwB;IACnD,CAAC;IAEJ;;;;OAIG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,OAAgB,EAAE,QAAgB;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,cAAc,QAAQ,6BAA6B,YAAY,qCAAqC,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,IAAI,EAAE,KAAK;IACX,SAAS,EAAE,OAAO,CAAC,EAAE;QACnB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClD,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,IAAI,EAAE,WAAW;IACjB,SAAS,EAAE,OAAO,CAAC,EAAE;QACnB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACzD,OAAO,iBAAiB,CAAC;YACvB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK;YACxC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAC,CAAC;SACvE,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/credentials/default/errors.d.ts

@@ -1,5 +1,5 @@
 /** Discriminant codes for {@link DefaultCredentialsError}. */
-export type DefaultCredentialsErrorCode = 'NO_AUTH_CONFIGURED';
+export type DefaultCredentialsErrorCode = 'NO_AUTH_CONFIGURED' | 'AUTH_TYPE_NOT_FOUND';
 /**
  * Error thrown when the default credentials chain cannot resolve a
  * strategy to authenticate with.

package/dist/credentials/default/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/credentials/default/errors.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/credentials/default/errors.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,MAAM,MAAM,2BAA2B,GACnC,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D"}

package/dist/credentials/default/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/credentials/default/errors.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAA8B;IAE3C,YAAY,IAAiC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/credentials/default/errors.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAA8B;IAE3C,YAAY,IAAiC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/credentials/default/u2m-strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"u2m-strategy.d.ts","sourceRoot":"","sources":["../../../src/credentials/default/u2m-strategy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,SAAS,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,QASzB,CAAC"}
+{"version":3,"file":"u2m-strategy.d.ts","sourceRoot":"","sources":["../../../src/credentials/default/u2m-strategy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,SAAS,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,QAYzB,CAAC"}

package/dist/credentials/default/u2m-strategy.js

@@ -5,16 +5,19 @@ import { newU2mCredentials } from '../u2m';
  * The CLI must have been logged in ahead of time via `databricks auth
  * login`.
  */
-export const u2mStrategy = profile => {
-    if (profile.host === undefined)
-        return undefined;
-    if (profile.name === undefined)
-        return undefined;
-    return newU2mCredentials({
-        profile: profile.name,
-        ...(profile.databricksCliPath !== undefined && {
-            cliPath: profile.databricksCliPath,
-        }),
-    });
+export const u2mStrategy = {
+    name: 'databricks-cli',
+    configure: profile => {
+        if (profile.host === undefined)
+            return undefined;
+        if (profile.name === undefined)
+            return undefined;
+        return newU2mCredentials({
+            profile: profile.name,
+            ...(profile.databricksCliPath !== undefined && {
+                cliPath: profile.databricksCliPath,
+            }),
+        });
+    },
 };
 //# sourceMappingURL=u2m-strategy.js.map

package/dist/credentials/default/u2m-strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"u2m-strategy.js","sourceRoot":"","sources":["../../../src/credentials/default/u2m-strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AAIzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAa,OAAO,CAAC,EAAE;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,iBAAiB,CAAC;QACvB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI;YAC7C,OAAO,EAAE,OAAO,CAAC,iBAAiB;SACnC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"u2m-strategy.js","sourceRoot":"","sources":["../../../src/credentials/default/u2m-strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,iBAAiB,EAAC,MAAM,QAAQ,CAAC;AAIzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE,OAAO,CAAC,EAAE;QACnB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,iBAAiB,CAAC;YACvB,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI;gBAC7C,OAAO,EAAE,OAAO,CAAC,iBAAiB;aACnC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/credentials/errors.d.ts

@@ -3,6 +3,17 @@
  *
  * @module
  */
+/** Discriminant codes for {@link PatCredentialsError}. */
+export type PatCredentialsErrorCode = 'TOKEN_REQUIRED' | 'TOKEN_MALFORMED';
+/**
+ * Error thrown by personal access token (PAT) credential operations.
+ *
+ * Use the `code` field to distinguish between error causes.
+ */
+export declare class PatCredentialsError extends Error {
+    readonly code: PatCredentialsErrorCode;
+    constructor(code: PatCredentialsErrorCode, message: string);
+}
 /** Discriminant codes for {@link M2mCredentialsError}. */
 export type M2mCredentialsErrorCode = 'CLIENT_ID_REQUIRED' | 'CLIENT_SECRET_REQUIRED' | 'HOST_REQUIRED' | 'DISCOVERY_FAILED' | 'TOKEN_REQUEST_FAILED';
 /**

package/dist/credentials/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/credentials/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GACpB,wBAAwB,GACxB,eAAe,GACf,kBAAkB,GAClB,sBAAsB,CAAC;AAE3B;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAK3D;AAED,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAK3D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/credentials/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAE3E;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAK3D;AAED,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GACpB,wBAAwB,GACxB,eAAe,GACf,kBAAkB,GAClB,sBAAsB,CAAC;AAE3B;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAK3D;AAED,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,eAAe,GACf,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAK3D"}

package/dist/credentials/errors.js

@@ -3,6 +3,19 @@
  *
  * @module
  */
+/**
+ * Error thrown by personal access token (PAT) credential operations.
+ *
+ * Use the `code` field to distinguish between error causes.
+ */
+export class PatCredentialsError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'PatCredentialsError';
+        this.code = code;
+    }
+}
 /**
  * Error thrown by M2M credential operations.
  *

package/dist/credentials/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/credentials/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA0B;IAEvC,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAUD;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA0B;IAEvC,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/credentials/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA0B;IAEvC,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAUD;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA0B;IAEvC,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAUD;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA0B;IAEvC,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/credentials/index.browser.d.ts

@@ -3,8 +3,8 @@
  * that depend on Node.js-only APIs (e.g. `databricks-cli` auth which spawns
  * the CLI binary).
  */
-export { M2mCredentialsError } from './errors';
-export type { M2mCredentialsErrorCode } from './errors';
+export { M2mCredentialsError, PatCredentialsError } from './errors';
+export type { M2mCredentialsErrorCode, PatCredentialsErrorCode } from './errors';
 export { newM2mCredentials } from './m2m';
 export type { M2mCredentialsOptions } from './m2m';
 export { newPatCredentials } from './pat';

package/dist/credentials/index.browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../../src/credentials/index.browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAC,uBAAuB,EAAC,MAAM,UAAU,CAAC;AACtD,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC"}
+{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../../src/credentials/index.browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAClE,YAAY,EAAC,uBAAuB,EAAE,uBAAuB,EAAC,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC"}

package/dist/credentials/index.browser.js

@@ -3,7 +3,7 @@
  * that depend on Node.js-only APIs (e.g. `databricks-cli` auth which spawns
  * the CLI binary).
  */
-export { M2mCredentialsError } from './errors';
+export { M2mCredentialsError, PatCredentialsError } from './errors';
 export { newM2mCredentials } from './m2m';
 export { newPatCredentials } from './pat';
 //# sourceMappingURL=index.browser.js.map

package/dist/credentials/index.browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../src/credentials/index.browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAE7C,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC"}
+{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../../src/credentials/index.browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAElE,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC"}

package/dist/credentials/index.d.ts

@@ -1,8 +1,8 @@
 /**
  * Credential implementations for the Databricks SDK.
  */
-export { M2mCredentialsError, U2mCredentialsError } from './errors';
-export type { M2mCredentialsErrorCode, U2mCredentialsErrorCode } from './errors';
+export { M2mCredentialsError, PatCredentialsError, U2mCredentialsError, } from './errors';
+export type { M2mCredentialsErrorCode, PatCredentialsErrorCode, U2mCredentialsErrorCode, } from './errors';
 export { newM2mCredentials } from './m2m';
 export type { M2mCredentialsOptions } from './m2m';
 export { newPatCredentials } from './pat';

package/dist/credentials/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAClE,YAAY,EAAC,uBAAuB,EAAE,uBAAuB,EAAC,MAAM,UAAU,CAAC;AAC/E,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AACzD,YAAY,EAAC,2BAA2B,EAAC,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,YAAY,EAAC,qBAAqB,EAAC,MAAM,OAAO,CAAC;AACjD,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC;AACzD,YAAY,EAAC,2BAA2B,EAAC,MAAM,kBAAkB,CAAC"}

package/dist/credentials/index.js

@@ -1,7 +1,7 @@
 /**
  * Credential implementations for the Databricks SDK.
  */
-export { M2mCredentialsError, U2mCredentialsError } from './errors';
+export { M2mCredentialsError, PatCredentialsError, U2mCredentialsError, } from './errors';
 export { newM2mCredentials } from './m2m';
 export { newPatCredentials } from './pat';
 export { newU2mCredentials } from './u2m';

package/dist/credentials/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAElE,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAMlB,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AACxC,OAAO,EAAC,iBAAiB,EAAC,MAAM,OAAO,CAAC;AAExC,OAAO,EAAC,kBAAkB,EAAC,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAC,uBAAuB,EAAC,MAAM,kBAAkB,CAAC"}

package/dist/credentials/pat.d.ts

@@ -8,7 +8,8 @@ import type { Credentials } from '../auth';
  *
  * @param token - The personal access token.
  * @returns Credentials for PAT authentication.
- * @throws TokenRequiredError if token is empty.
+ * @throws PatCredentialsError with code `TOKEN_REQUIRED` if the token is empty
+ *   after trimming, or `TOKEN_MALFORMED` if it contains internal whitespace.
  */
 export declare function newPatCredentials(token: string): Credentials;
 //# sourceMappingURL=pat.d.ts.map

package/dist/credentials/pat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pat.d.ts","sourceRoot":"","sources":["../../src/credentials/pat.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAS,MAAM,SAAS,CAAC;AAYjD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAK5D"}
+{"version":3,"file":"pat.d.ts","sourceRoot":"","sources":["../../src/credentials/pat.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAS,MAAM,SAAS,CAAC;AAIjD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAc5D"}

package/dist/credentials/pat.js

@@ -1,28 +1,27 @@
 /**
  * Personal Access Token (PAT) credentials for the Databricks SDK.
  */
-/**
- * Error thrown when a token is required but not provided.
- */
-class TokenRequiredError extends Error {
-    constructor() {
-        super('token is required');
-        this.name = 'TokenRequiredError';
-    }
-}
+import { PatCredentialsError } from './errors';
 /**
  * Creates a Credentials that can be used to authenticate with a Personal
  * Access Token.
  *
  * @param token - The personal access token.
  * @returns Credentials for PAT authentication.
- * @throws TokenRequiredError if token is empty.
+ * @throws PatCredentialsError with code `TOKEN_REQUIRED` if the token is empty
+ *   after trimming, or `TOKEN_MALFORMED` if it contains internal whitespace.
  */
 export function newPatCredentials(token) {
-    if (token === '') {
-        throw new TokenRequiredError();
+    const trimmed = token.trim();
+    if (trimmed === '') {
+        throw new PatCredentialsError('TOKEN_REQUIRED', 'token is required');
+    }
+    // Internal whitespace would corrupt the header even after trimming, so
+    // reject it rather than silently producing a malformed `Bearer` value.
+    if (/\s/.test(trimmed)) {
+        throw new PatCredentialsError('TOKEN_MALFORMED', 'token must not contain whitespace');
     }
-    return new PatCredentials(token);
+    return new PatCredentials(trimmed);
 }
 class PatCredentials {
     token;

package/dist/credentials/pat.js.map

@@ -1 +1 @@
-{"version":3,"file":"pat.js","sourceRoot":"","sources":["../../src/credentials/pat.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;GAEG;AACH,MAAM,kBAAmB,SAAQ,KAAK;IACpC;QACE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,cAAc;IACW;IAA7B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,IAAI;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW;QACT,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,EAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAC;SACtD,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"pat.js","sourceRoot":"","sources":["../../src/credentials/pat.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAC,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IACvE,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,cAAc;IACW;IAA7B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,IAAI;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW;QACT,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,EAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAC;SACtD,CAAC,CAAC;IACL,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@databricks/sdk-auth",
-  "version": "0.1.0-dev.3",
+  "version": "0.1.0-dev.5",
   "description": "Databricks authentication library for JavaScript/TypeScript",
   "type": "module",
   "main": "./dist/index.js",
@@ -8,28 +8,32 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     },
     "./credentials": {
       "types": "./dist/credentials/index.d.ts",
-      "import": "./dist/credentials/index.js"
+      "import": "./dist/credentials/index.js",
+      "default": "./dist/credentials/index.js"
     },
     "./credentials/browser": {
       "types": "./dist/credentials/index.browser.d.ts",
-      "import": "./dist/credentials/index.browser.js"
+      "import": "./dist/credentials/index.browser.js",
+      "default": "./dist/credentials/index.browser.js"
     },
     "./oidc": {
       "types": "./dist/oidc/index.d.ts",
-      "import": "./dist/oidc/index.js"
+      "import": "./dist/oidc/index.js",
+      "default": "./dist/oidc/index.js"
     },
     "./oidc/browser": {
       "types": "./dist/oidc/index.browser.d.ts",
-      "import": "./dist/oidc/index.browser.js"
+      "import": "./dist/oidc/index.browser.js",
+      "default": "./dist/oidc/index.browser.js"
     }
   },
   "files": [
     "dist",
-    "src",
     "LICENSE"
   ],
   "scripts": {
@@ -49,7 +53,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@databricks/sdk-core": ">=0.1.0-dev.4 <1.0.0",
+    "@databricks/sdk-core": ">=0.1.0-dev.6 <1.0.0",
     "zod": "^4.3.6"
   }
 }

package/src/auth.ts

@@ -1,117 +0,0 @@
-/**
- * Core authentication interfaces and types for the Databricks SDK.
- *
- * This module is not meant to be used directly by consumers of the SDK
- * and is subject to change without notice.
- *
- * @packageDocumentation
- */
-
-/**
- * Represents a header that can be used to sign requests.
- */
-export interface Header {
-  key: string;
-  value: string;
-}
-
-/**
- * Anything that can return authentication headers.
- */
-export interface Credentials {
-  /**
-   * Short identifier for the authentication strategy, e.g. `pat` or
-   * `oauth-m2m`. Used for logging and for selecting between strategies.
-   */
-  name(): string;
-
-  /**
-   * Returns headers to authenticate requests.
-   */
-  authHeaders(): Promise<Header[]>;
-}
-
-/**
- * Represents a token that can be used to sign requests.
- */
-export interface Token {
-  /**
-   * The raw value to sign requests with.
-   * It typically is an access token but can represent other types of tokens
-   * (e.g., ID tokens).
-   */
-  value: string;
-
-  /**
-   * The type of token. If empty, the token type is assumed to be "Bearer".
-   */
-  type?: string;
-
-  /**
-   * The time at which the token expires.
-   * If undefined, the token is considered to be valid indefinitely.
-   */
-  expiry?: Date;
-}
-
-/**
- * Anything that can return a token.
- */
-export interface TokenProvider {
-  /**
-   * Returns a token or throws an error.
-   * The returned Token should be considered immutable and should not be
-   * modified.
-   */
-  token(): Promise<Token>;
-}
-
-/**
- * Adapter to allow the use of ordinary functions as TokenProvider.
- *
- * @example
- * const provider = tokenProviderFn(async () => ({ value: 'my-token' }));
- */
-export function tokenProviderFn(fn: () => Promise<Token>): TokenProvider {
-  return {token: fn};
-}
-
-/**
- * Combines TokenProvider and Credentials interfaces.
- */
-export interface TokenCredentials extends TokenProvider, Credentials {}
-
-/**
- * Creates a TokenCredentials that uses the given TokenProvider to return
- * authentication headers.
- *
- * @param name - Short identifier for the auth strategy (e.g. `oauth-m2m`).
- * @param provider - Source of tokens used to build the Authorization header.
- */
-export function newTokenCredentials(
-  name: string,
-  provider: TokenProvider
-): TokenCredentials {
-  return new TokenCredentialsImpl(name, provider);
-}
-
-class TokenCredentialsImpl implements TokenCredentials {
-  constructor(
-    private readonly strategyName: string,
-    private readonly provider: TokenProvider
-  ) {}
-
-  name(): string {
-    return this.strategyName;
-  }
-
-  async token(): Promise<Token> {
-    return this.provider.token();
-  }
-
-  async authHeaders(): Promise<Header[]> {
-    const t = await this.token();
-    const scheme = t.type ?? 'Bearer';
-    return [{key: 'Authorization', value: `${scheme} ${t.value}`}];
-  }
-}