@databricks/sdk-auth 0.33.0 → 0.35.0

package/dist/credentials/index.browser.js

@@ -1,9 +1,5 @@
-/**
- * Browser entry point for credential implementations. Excludes credentials
- * that depend on Node.js-only APIs (e.g. `databricks-cli` auth which spawns
- * the CLI binary).
- */
-export { M2mCredentialsError, PatCredentialsError } from './errors';
-export { newM2mCredentials } from './m2m';
-export { newPatCredentials } from './pat';
-//# sourceMappingURL=index.browser.js.map
+import { M2mCredentialsError, PatCredentialsError } from "./errors.js";
+import { newM2mCredentials } from "./m2m.js";
+import { newPatCredentials } from "./pat.js";
+
+export { M2mCredentialsError, PatCredentialsError, newM2mCredentials, newPatCredentials };

package/dist/credentials/index.d.ts

@@ -1,14 +1,7 @@
-/**
- * Credential implementations for the Databricks SDK.
- */
-export { M2mCredentialsError, PatCredentialsError, U2mCredentialsError, } from './errors';
-export type { M2mCredentialsErrorCode, PatCredentialsErrorCode, U2mCredentialsErrorCode, } from './errors';
-export { newM2mCredentials } from './m2m';
-export type { M2mCredentialsOptions } from './m2m';
-export { newPatCredentials } from './pat';
-export { newU2mCredentials } from './u2m';
-export type { U2mCredentialsOptions } from './u2m';
-export { defaultCredentials } from './default/default-credentials';
-export { DefaultCredentialsError } from './default/errors';
-export type { DefaultCredentialsErrorCode } from './default/errors';
-//# sourceMappingURL=index.d.ts.map
+import { defaultCredentials } from "./default/default-credentials.js";
+import { DefaultCredentialsError, DefaultCredentialsErrorCode } from "./default/errors.js";
+import { M2mCredentialsError, M2mCredentialsErrorCode, PatCredentialsError, PatCredentialsErrorCode, U2mCredentialsError, U2mCredentialsErrorCode } from "./errors.js";
+import { M2mCredentialsOptions, newM2mCredentials } from "./m2m.js";
+import { newPatCredentials } from "./pat.js";
+import { U2mCredentialsOptions, newU2mCredentials } from "./u2m.js";
+export { DefaultCredentialsError, type DefaultCredentialsErrorCode, M2mCredentialsError, type M2mCredentialsErrorCode, type M2mCredentialsOptions, PatCredentialsError, type PatCredentialsErrorCode, U2mCredentialsError, type U2mCredentialsErrorCode, type U2mCredentialsOptions, defaultCredentials, newM2mCredentials, newPatCredentials, newU2mCredentials };

package/dist/credentials/index.js

@@ -1,10 +1,8 @@
-/**
- * Credential implementations for the Databricks SDK.
- */
-export { M2mCredentialsError, PatCredentialsError, U2mCredentialsError, } from './errors';
-export { newM2mCredentials } from './m2m';
-export { newPatCredentials } from './pat';
-export { newU2mCredentials } from './u2m';
-export { defaultCredentials } from './default/default-credentials';
-export { DefaultCredentialsError } from './default/errors';
-//# sourceMappingURL=index.js.map
+import { M2mCredentialsError, PatCredentialsError, U2mCredentialsError } from "./errors.js";
+import { newM2mCredentials } from "./m2m.js";
+import { newPatCredentials } from "./pat.js";
+import { newU2mCredentials } from "./u2m.js";
+import { DefaultCredentialsError } from "./default/errors.js";
+import { defaultCredentials } from "./default/default-credentials.js";
+
+export { DefaultCredentialsError, M2mCredentialsError, PatCredentialsError, U2mCredentialsError, defaultCredentials, newM2mCredentials, newPatCredentials, newU2mCredentials };

package/dist/credentials/m2m.d.ts

@@ -1,31 +1,30 @@
-/**
- * Machine-to-machine (M2M) OAuth credentials for the Databricks SDK.
- */
-import type { TokenCredentials } from '../auth';
+import { TokenCredentials } from "../auth.js";
+
+//#region src/credentials/m2m.d.ts
 /** Options for {@link newM2mCredentials}. */
-export interface M2mCredentialsOptions {
-    /**
-     * Databricks host (workspace or account) used to discover the OAuth token
-     * endpoint.
-     */
-    host: string;
-    /**
-     * OAuth client ID issued to the service principal.
-     */
-    clientId: string;
-    /**
-     * OAuth client secret issued to the service principal.
-     */
-    clientSecret: string;
-    /**
-     * Databricks account ID. Required for account hosts.
-     */
-    accountId?: string;
-    /**
-     * OAuth scopes to request. When omitted or empty, defaults to
-     * `['all-apis']`.
-     */
-    scopes?: string[];
+interface M2mCredentialsOptions {
+  /**
+   * Databricks host (workspace or account) used to discover the OAuth token
+   * endpoint.
+   */
+  host: string;
+  /**
+   * OAuth client ID issued to the service principal.
+   */
+  clientId: string;
+  /**
+   * OAuth client secret issued to the service principal.
+   */
+  clientSecret: string;
+  /**
+   * Databricks account ID. Required for account hosts.
+   */
+  accountId?: string;
+  /**
+   * OAuth scopes to request. When omitted or empty, defaults to
+   * `['all-apis']`.
+   */
+  scopes?: string[];
 }
 /**
  * Creates a TokenCredentials that authenticates as a Databricks service
@@ -36,5 +35,7 @@ export interface M2mCredentialsOptions {
  * when token-endpoint discovery fails, or when the token endpoint returns
  * an error.
  */
-export declare function newM2mCredentials(options: M2mCredentialsOptions): TokenCredentials;
+declare function newM2mCredentials(options: M2mCredentialsOptions): TokenCredentials;
+//#endregion
+export { M2mCredentialsOptions, newM2mCredentials };
 //# sourceMappingURL=m2m.d.ts.map

package/dist/credentials/m2m.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"m2m.d.ts","sourceRoot":"","sources":["../../src/credentials/m2m.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAQ,gBAAgB,EAAC,MAAM,SAAS,CAAC;AAMrD,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAID;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,qBAAqB,GAC7B,gBAAgB,CAuDlB"}
+{"version":3,"file":"m2m.d.ts","names":[],"sources":["../../src/credentials/m2m.ts"],"mappings":";;;;UAaiB,qBAAA;EAAqB;;;;EAKpC,IAAA;EAqBA;;;EAhBA,QAAA;EA8B+B;;;EAzB/B,YAAA;EA0BA;;;EArBA,SAAA;;;;;EAMA,MAAA;AAAA;;;;;;;;;;iBAcc,iBAAA,CACd,OAAA,EAAS,qBAAA,GACR,gBAAA"}

package/dist/credentials/m2m.js

@@ -1,91 +1,76 @@
+import { newTokenCredentials, tokenProviderFn } from "../auth.js";
+import { M2mCredentialsError } from "./errors.js";
+import { resolveTokenEndpoint } from "./host-metadata.js";
+import { z } from "zod";
+
+//#region src/credentials/m2m.ts
 /**
- * Machine-to-machine (M2M) OAuth credentials for the Databricks SDK.
- */
-import { z } from 'zod';
-import { newTokenCredentials, tokenProviderFn } from '../auth';
-import { M2mCredentialsError } from './errors';
-import { resolveTokenEndpoint } from './host-metadata';
-const DEFAULT_SCOPES = ['all-apis'];
+* Machine-to-machine (M2M) OAuth credentials for the Databricks SDK.
+*/
+const DEFAULT_SCOPES = ["all-apis"];
 /**
- * Creates a TokenCredentials that authenticates as a Databricks service
- * principal using the OAuth client credentials grant.
- *
- * @param options - Host plus client credentials.
- * @throws M2mCredentialsError when host, clientId, or clientSecret is empty,
- * when token-endpoint discovery fails, or when the token endpoint returns
- * an error.
- */
-export function newM2mCredentials(options) {
-    if (options.clientId === '') {
-        throw new M2mCredentialsError('CLIENT_ID_REQUIRED', 'clientId is required');
-    }
-    if (options.clientSecret === '') {
-        throw new M2mCredentialsError('CLIENT_SECRET_REQUIRED', 'clientSecret is required');
-    }
-    if (options.host === '') {
-        throw new M2mCredentialsError('HOST_REQUIRED', 'host is required');
-    }
-    const scopes = options.scopes !== undefined && options.scopes.length > 0
-        ? options.scopes
-        : DEFAULT_SCOPES;
-    const body = new URLSearchParams({
-        grant_type: 'client_credentials',
-        scope: scopes.join(' '),
-    }).toString();
-    // Client ID and secret are URL-encoded before Basic auth encoding to
-    // avoid ambiguity with special characters in either value, matching the
-    // behavior of golang.org/x/oauth2.
-    const basicAuth = btoa(`${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`);
-    let cachedTokenEndpoint;
-    const getTokenEndpoint = async () => {
-        if (cachedTokenEndpoint === undefined) {
-            try {
-                cachedTokenEndpoint = await resolveTokenEndpoint(options.host, options.accountId);
-            }
-            catch (e) {
-                throw new M2mCredentialsError('DISCOVERY_FAILED', `discovering token endpoint failed: ${stringifyError(e)}`);
-            }
-        }
-        return cachedTokenEndpoint;
-    };
-    const provider = tokenProviderFn(async () => {
-        const tokenEndpoint = await getTokenEndpoint();
-        return fetchAccessToken(tokenEndpoint, basicAuth, body);
-    });
-    return newTokenCredentials('oauth-m2m', provider);
+* Creates a TokenCredentials that authenticates as a Databricks service
+* principal using the OAuth client credentials grant.
+*
+* @param options - Host plus client credentials.
+* @throws M2mCredentialsError when host, clientId, or clientSecret is empty,
+* when token-endpoint discovery fails, or when the token endpoint returns
+* an error.
+*/
+function newM2mCredentials(options) {
+	if (options.clientId === "") throw new M2mCredentialsError("CLIENT_ID_REQUIRED", "clientId is required");
+	if (options.clientSecret === "") throw new M2mCredentialsError("CLIENT_SECRET_REQUIRED", "clientSecret is required");
+	if (options.host === "") throw new M2mCredentialsError("HOST_REQUIRED", "host is required");
+	const scopes = options.scopes !== void 0 && options.scopes.length > 0 ? options.scopes : DEFAULT_SCOPES;
+	const body = new URLSearchParams({
+		grant_type: "client_credentials",
+		scope: scopes.join(" ")
+	}).toString();
+	const basicAuth = btoa(`${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`);
+	let cachedTokenEndpoint;
+	const getTokenEndpoint = async () => {
+		if (cachedTokenEndpoint === void 0) try {
+			cachedTokenEndpoint = await resolveTokenEndpoint(options.host, options.accountId);
+		} catch (e) {
+			throw new M2mCredentialsError("DISCOVERY_FAILED", `discovering token endpoint failed: ${stringifyError(e)}`);
+		}
+		return cachedTokenEndpoint;
+	};
+	return newTokenCredentials("oauth-m2m", tokenProviderFn(async () => {
+		return fetchAccessToken(await getTokenEndpoint(), basicAuth, body);
+	}));
 }
 async function fetchAccessToken(tokenEndpoint, basicAuth, body) {
-    const response = await fetch(tokenEndpoint, {
-        method: 'POST',
-        headers: {
-            Authorization: `Basic ${basicAuth}`,
-            'Content-Type': 'application/x-www-form-urlencoded',
-        },
-        body,
-    });
-    if (!response.ok) {
-        const text = await response.text();
-        throw new M2mCredentialsError('TOKEN_REQUEST_FAILED', `token request failed with status ${response.status.toString()}: ${text}`);
-    }
-    const parsed = tokenResponseSchema.parse(await response.json());
-    const expiry = parsed.expires_in !== undefined
-        ? new Date(Date.now() + parsed.expires_in * 1000)
-        : undefined;
-    return {
-        value: parsed.access_token,
-        ...(parsed.token_type !== undefined && { type: parsed.token_type }),
-        ...(expiry !== undefined && { expiry }),
-    };
+	const response = await fetch(tokenEndpoint, {
+		method: "POST",
+		headers: {
+			Authorization: `Basic ${basicAuth}`,
+			"Content-Type": "application/x-www-form-urlencoded"
+		},
+		body
+	});
+	if (!response.ok) {
+		const text = await response.text();
+		throw new M2mCredentialsError("TOKEN_REQUEST_FAILED", `token request failed with status ${response.status.toString()}: ${text}`);
+	}
+	const parsed = tokenResponseSchema.parse(await response.json());
+	const expiry = parsed.expires_in !== void 0 ? new Date(Date.now() + parsed.expires_in * 1e3) : void 0;
+	return {
+		value: parsed.access_token,
+		...parsed.token_type !== void 0 && { type: parsed.token_type },
+		...expiry !== void 0 && { expiry }
+	};
 }
 const tokenResponseSchema = z.object({
-    access_token: z.string(),
-    token_type: z.string().optional(),
-    expires_in: z.number().optional(),
+	access_token: z.string(),
+	token_type: z.string().optional(),
+	expires_in: z.number().optional()
 });
 function stringifyError(e) {
-    if (e instanceof Error) {
-        return e.message;
-    }
-    return String(e);
+	if (e instanceof Error) return e.message;
+	return String(e);
 }
+
+//#endregion
+export { newM2mCredentials };
 //# sourceMappingURL=m2m.js.map

package/dist/credentials/m2m.js.map

@@ -1 +1 @@
-{"version":3,"file":"m2m.js","sourceRoot":"","sources":["../../src/credentials/m2m.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,EAAC,mBAAmB,EAAE,eAAe,EAAC,MAAM,SAAS,CAAC;AAE7D,OAAO,EAAC,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAC,oBAAoB,EAAC,MAAM,iBAAiB,CAAC;AAgCrD,MAAM,cAAc,GAAsB,CAAC,UAAU,CAAC,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA8B;IAE9B,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,EACxB,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,cAAc,CAAC;IAErB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,qEAAqE;IACrE,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,SAAS,GAAG,IAAI,CACpB,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CACtF,CAAC;IAEF,IAAI,mBAAuC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,KAAK,IAAqB,EAAE;QACnD,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,mBAAmB,GAAG,MAAM,oBAAoB,CAC9C,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,SAAS,CAClB,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,sCAAsC,cAAc,CAAC,CAAC,CAAC,EAAE,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,mBAAmB,CAAC;IAC7B,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,aAAa,GAAG,MAAM,gBAAgB,EAAE,CAAC;QAC/C,OAAO,gBAAgB,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,aAAqB,EACrB,SAAiB,EACjB,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,SAAS,EAAE;YACnC,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,EACtB,oCAAoC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,GACV,MAAM,CAAC,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QACjD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,EAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAC,CAAC;QACjE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAC,MAAM,EAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}
+{"version":3,"file":"m2m.js","names":[],"sources":["../../src/credentials/m2m.ts"],"sourcesContent":["/**\n * Machine-to-machine (M2M) OAuth credentials for the Databricks SDK.\n */\n\nimport {z} from 'zod';\n\nimport type {Token, TokenCredentials} from '../auth';\nimport {newTokenCredentials, tokenProviderFn} from '../auth';\n\nimport {M2mCredentialsError} from './errors';\nimport {resolveTokenEndpoint} from './host-metadata';\n\n/** Options for {@link newM2mCredentials}. */\nexport interface M2mCredentialsOptions {\n  /**\n   * Databricks host (workspace or account) used to discover the OAuth token\n   * endpoint.\n   */\n  host: string;\n\n  /**\n   * OAuth client ID issued to the service principal.\n   */\n  clientId: string;\n\n  /**\n   * OAuth client secret issued to the service principal.\n   */\n  clientSecret: string;\n\n  /**\n   * Databricks account ID. Required for account hosts.\n   */\n  accountId?: string;\n\n  /**\n   * OAuth scopes to request. When omitted or empty, defaults to\n   * `['all-apis']`.\n   */\n  scopes?: string[];\n}\n\nconst DEFAULT_SCOPES: readonly string[] = ['all-apis'];\n\n/**\n * Creates a TokenCredentials that authenticates as a Databricks service\n * principal using the OAuth client credentials grant.\n *\n * @param options - Host plus client credentials.\n * @throws M2mCredentialsError when host, clientId, or clientSecret is empty,\n * when token-endpoint discovery fails, or when the token endpoint returns\n * an error.\n */\nexport function newM2mCredentials(\n  options: M2mCredentialsOptions\n): TokenCredentials {\n  if (options.clientId === '') {\n    throw new M2mCredentialsError('CLIENT_ID_REQUIRED', 'clientId is required');\n  }\n  if (options.clientSecret === '') {\n    throw new M2mCredentialsError(\n      'CLIENT_SECRET_REQUIRED',\n      'clientSecret is required'\n    );\n  }\n  if (options.host === '') {\n    throw new M2mCredentialsError('HOST_REQUIRED', 'host is required');\n  }\n\n  const scopes =\n    options.scopes !== undefined && options.scopes.length > 0\n      ? options.scopes\n      : DEFAULT_SCOPES;\n\n  const body = new URLSearchParams({\n    grant_type: 'client_credentials',\n    scope: scopes.join(' '),\n  }).toString();\n\n  // Client ID and secret are URL-encoded before Basic auth encoding to\n  // avoid ambiguity with special characters in either value, matching the\n  // behavior of golang.org/x/oauth2.\n  const basicAuth = btoa(\n    `${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`\n  );\n\n  let cachedTokenEndpoint: string | undefined;\n  const getTokenEndpoint = async (): Promise<string> => {\n    if (cachedTokenEndpoint === undefined) {\n      try {\n        cachedTokenEndpoint = await resolveTokenEndpoint(\n          options.host,\n          options.accountId\n        );\n      } catch (e) {\n        throw new M2mCredentialsError(\n          'DISCOVERY_FAILED',\n          `discovering token endpoint failed: ${stringifyError(e)}`\n        );\n      }\n    }\n    return cachedTokenEndpoint;\n  };\n\n  const provider = tokenProviderFn(async () => {\n    const tokenEndpoint = await getTokenEndpoint();\n    return fetchAccessToken(tokenEndpoint, basicAuth, body);\n  });\n\n  return newTokenCredentials('oauth-m2m', provider);\n}\n\nasync function fetchAccessToken(\n  tokenEndpoint: string,\n  basicAuth: string,\n  body: string\n): Promise<Token> {\n  const response = await fetch(tokenEndpoint, {\n    method: 'POST',\n    headers: {\n      Authorization: `Basic ${basicAuth}`,\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body,\n  });\n  if (!response.ok) {\n    const text = await response.text();\n    throw new M2mCredentialsError(\n      'TOKEN_REQUEST_FAILED',\n      `token request failed with status ${response.status.toString()}: ${text}`\n    );\n  }\n  const parsed = tokenResponseSchema.parse(await response.json());\n  const expiry =\n    parsed.expires_in !== undefined\n      ? new Date(Date.now() + parsed.expires_in * 1000)\n      : undefined;\n  return {\n    value: parsed.access_token,\n    ...(parsed.token_type !== undefined && {type: parsed.token_type}),\n    ...(expiry !== undefined && {expiry}),\n  };\n}\n\nconst tokenResponseSchema = z.object({\n  access_token: z.string(),\n  token_type: z.string().optional(),\n  expires_in: z.number().optional(),\n});\n\nfunction stringifyError(e: unknown): string {\n  if (e instanceof Error) {\n    return e.message;\n  }\n  return String(e);\n}\n"],"mappings":";;;;;;;;;AA0CA,MAAM,iBAAoC,CAAC,WAAW;;;;;;;;;;AAWtD,SAAgB,kBACd,SACkB;AAClB,KAAI,QAAQ,aAAa,GACvB,OAAM,IAAI,oBAAoB,sBAAsB,uBAAuB;AAE7E,KAAI,QAAQ,iBAAiB,GAC3B,OAAM,IAAI,oBACR,0BACA,2BACD;AAEH,KAAI,QAAQ,SAAS,GACnB,OAAM,IAAI,oBAAoB,iBAAiB,mBAAmB;CAGpE,MAAM,SACJ,QAAQ,WAAW,UAAa,QAAQ,OAAO,SAAS,IACpD,QAAQ,SACR;CAEN,MAAM,OAAO,IAAI,gBAAgB;EAC/B,YAAY;EACZ,OAAO,OAAO,KAAK,IAAI;EACxB,CAAC,CAAC,UAAU;CAKb,MAAM,YAAY,KAChB,GAAG,mBAAmB,QAAQ,SAAS,CAAC,GAAG,mBAAmB,QAAQ,aAAa,GACpF;CAED,IAAI;CACJ,MAAM,mBAAmB,YAA6B;AACpD,MAAI,wBAAwB,OAC1B,KAAI;AACF,yBAAsB,MAAM,qBAC1B,QAAQ,MACR,QAAQ,UACT;WACM,GAAG;AACV,SAAM,IAAI,oBACR,oBACA,sCAAsC,eAAe,EAAE,GACxD;;AAGL,SAAO;;AAQT,QAAO,oBAAoB,aALV,gBAAgB,YAAY;AAE3C,SAAO,iBADe,MAAM,kBAAkB,EACP,WAAW,KAAK;GACvD,CAE+C;;AAGnD,eAAe,iBACb,eACA,WACA,MACgB;CAChB,MAAM,WAAW,MAAM,MAAM,eAAe;EAC1C,QAAQ;EACR,SAAS;GACP,eAAe,SAAS;GACxB,gBAAgB;GACjB;EACD;EACD,CAAC;AACF,KAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,QAAM,IAAI,oBACR,wBACA,oCAAoC,SAAS,OAAO,UAAU,CAAC,IAAI,OACpE;;CAEH,MAAM,SAAS,oBAAoB,MAAM,MAAM,SAAS,MAAM,CAAC;CAC/D,MAAM,SACJ,OAAO,eAAe,SAClB,IAAI,KAAK,KAAK,KAAK,GAAG,OAAO,aAAa,IAAK,GAC/C;AACN,QAAO;EACL,OAAO,OAAO;EACd,GAAI,OAAO,eAAe,UAAa,EAAC,MAAM,OAAO,YAAW;EAChE,GAAI,WAAW,UAAa,EAAC,QAAO;EACrC;;AAGH,MAAM,sBAAsB,EAAE,OAAO;CACnC,cAAc,EAAE,QAAQ;CACxB,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,YAAY,EAAE,QAAQ,CAAC,UAAU;CAClC,CAAC;AAEF,SAAS,eAAe,GAAoB;AAC1C,KAAI,aAAa,MACf,QAAO,EAAE;AAEX,QAAO,OAAO,EAAE"}

package/dist/credentials/pat.d.ts

@@ -1,7 +1,6 @@
-/**
- * Personal Access Token (PAT) credentials for the Databricks SDK.
- */
-import type { Credentials } from '../auth';
+import { Credentials } from "../auth.js";
+
+//#region src/credentials/pat.d.ts
 /**
  * Creates a Credentials that can be used to authenticate with a Personal
  * Access Token.
@@ -11,5 +10,7 @@ import type { Credentials } from '../auth';
  * @throws PatCredentialsError with code `TOKEN_REQUIRED` if the token is empty
  *   after trimming, or `TOKEN_MALFORMED` if it contains internal whitespace.
  */
-export declare function newPatCredentials(token: string): Credentials;
+declare function newPatCredentials(token: string): Credentials;
+//#endregion
+export { newPatCredentials };
 //# sourceMappingURL=pat.d.ts.map

package/dist/credentials/pat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pat.d.ts","sourceRoot":"","sources":["../../src/credentials/pat.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAS,MAAM,SAAS,CAAC;AAIjD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAc5D"}
+{"version":3,"file":"pat.d.ts","names":[],"sources":["../../src/credentials/pat.ts"],"mappings":";;;;;;;;;;;;iBAiBgB,iBAAA,CAAkB,KAAA,WAAgB,WAAA"}

package/dist/credentials/pat.js

@@ -1,40 +1,36 @@
+import { PatCredentialsError } from "./errors.js";
+
+//#region src/credentials/pat.ts
 /**
- * Personal Access Token (PAT) credentials for the Databricks SDK.
- */
-import { PatCredentialsError } from './errors';
-/**
- * Creates a Credentials that can be used to authenticate with a Personal
- * Access Token.
- *
- * @param token - The personal access token.
- * @returns Credentials for PAT authentication.
- * @throws PatCredentialsError with code `TOKEN_REQUIRED` if the token is empty
- *   after trimming, or `TOKEN_MALFORMED` if it contains internal whitespace.
- */
-export function newPatCredentials(token) {
-    const trimmed = token.trim();
-    if (trimmed === '') {
-        throw new PatCredentialsError('TOKEN_REQUIRED', 'token is required');
-    }
-    // Internal whitespace would corrupt the header even after trimming, so
-    // reject it rather than silently producing a malformed `Bearer` value.
-    if (/\s/.test(trimmed)) {
-        throw new PatCredentialsError('TOKEN_MALFORMED', 'token must not contain whitespace');
-    }
-    return new PatCredentials(trimmed);
-}
-class PatCredentials {
-    token;
-    constructor(token) {
-        this.token = token;
-    }
-    name() {
-        return 'pat';
-    }
-    authHeaders() {
-        return Promise.resolve([
-            { key: 'Authorization', value: `Bearer ${this.token}` },
-        ]);
-    }
+* Creates a Credentials that can be used to authenticate with a Personal
+* Access Token.
+*
+* @param token - The personal access token.
+* @returns Credentials for PAT authentication.
+* @throws PatCredentialsError with code `TOKEN_REQUIRED` if the token is empty
+*   after trimming, or `TOKEN_MALFORMED` if it contains internal whitespace.
+*/
+function newPatCredentials(token) {
+	const trimmed = token.trim();
+	if (trimmed === "") throw new PatCredentialsError("TOKEN_REQUIRED", "token is required");
+	if (/\s/.test(trimmed)) throw new PatCredentialsError("TOKEN_MALFORMED", "token must not contain whitespace");
+	return new PatCredentials(trimmed);
 }
+var PatCredentials = class {
+	constructor(token) {
+		this.token = token;
+	}
+	name() {
+		return "pat";
+	}
+	authHeaders() {
+		return Promise.resolve([{
+			key: "Authorization",
+			value: `Bearer ${this.token}`
+		}]);
+	}
+};
+
+//#endregion
+export { newPatCredentials };
 //# sourceMappingURL=pat.js.map

package/dist/credentials/pat.js.map

@@ -1 +1 @@
-{"version":3,"file":"pat.js","sourceRoot":"","sources":["../../src/credentials/pat.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAC,mBAAmB,EAAC,MAAM,UAAU,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IACvE,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,cAAc;IACW;IAA7B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,IAAI;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW;QACT,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,EAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAC;SACtD,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"pat.js","names":[],"sources":["../../src/credentials/pat.ts"],"sourcesContent":["/**\n * Personal Access Token (PAT) credentials for the Databricks SDK.\n */\n\nimport type {Credentials, Header} from '../auth';\n\nimport {PatCredentialsError} from './errors';\n\n/**\n * Creates a Credentials that can be used to authenticate with a Personal\n * Access Token.\n *\n * @param token - The personal access token.\n * @returns Credentials for PAT authentication.\n * @throws PatCredentialsError with code `TOKEN_REQUIRED` if the token is empty\n *   after trimming, or `TOKEN_MALFORMED` if it contains internal whitespace.\n */\nexport function newPatCredentials(token: string): Credentials {\n  const trimmed = token.trim();\n  if (trimmed === '') {\n    throw new PatCredentialsError('TOKEN_REQUIRED', 'token is required');\n  }\n  // Internal whitespace would corrupt the header even after trimming, so\n  // reject it rather than silently producing a malformed `Bearer` value.\n  if (/\\s/.test(trimmed)) {\n    throw new PatCredentialsError(\n      'TOKEN_MALFORMED',\n      'token must not contain whitespace'\n    );\n  }\n  return new PatCredentials(trimmed);\n}\n\nclass PatCredentials implements Credentials {\n  constructor(private readonly token: string) {}\n\n  name(): string {\n    return 'pat';\n  }\n\n  authHeaders(): Promise<Header[]> {\n    return Promise.resolve([\n      {key: 'Authorization', value: `Bearer ${this.token}`},\n    ]);\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,SAAgB,kBAAkB,OAA4B;CAC5D,MAAM,UAAU,MAAM,MAAM;AAC5B,KAAI,YAAY,GACd,OAAM,IAAI,oBAAoB,kBAAkB,oBAAoB;AAItE,KAAI,KAAK,KAAK,QAAQ,CACpB,OAAM,IAAI,oBACR,mBACA,oCACD;AAEH,QAAO,IAAI,eAAe,QAAQ;;AAGpC,IAAM,iBAAN,MAA4C;CAC1C,YAAY,AAAiB,OAAe;EAAf;;CAE7B,OAAe;AACb,SAAO;;CAGT,cAAiC;AAC/B,SAAO,QAAQ,QAAQ,CACrB;GAAC,KAAK;GAAiB,OAAO,UAAU,KAAK;GAAQ,CACtD,CAAC"}

package/dist/credentials/u2m.d.ts

@@ -1,23 +1,18 @@
-/**
- * Databricks CLI ("U2M") credentials. Obtains access tokens by shelling out
- * to the `databricks` CLI binary (>= 0.100.0). The CLI must have been logged
- * in ahead of time via `databricks auth login`.
- *
- * Node.js only. Not exported from the browser entry point.
- */
-import type { TokenCredentials } from '../auth';
+import { TokenCredentials } from "../auth.js";
+
+//#region src/credentials/u2m.d.ts
 /** Options for the Databricks CLI auth strategy. */
-export interface U2mCredentialsOptions {
-    /**
-     * The Databricks CLI profile name, as configured via `databricks auth
-     * login`.
-     */
-    profile: string;
-    /**
-     * Path to the `databricks` CLI binary. If omitted, the binary is searched
-     * for in `PATH`.
-     */
-    cliPath?: string;
+interface U2mCredentialsOptions {
+  /**
+   * The Databricks CLI profile name, as configured via `databricks auth
+   * login`.
+   */
+  profile: string;
+  /**
+   * Path to the `databricks` CLI binary. If omitted, the binary is searched
+   * for in `PATH`.
+   */
+  cliPath?: string;
 }
 /**
  * Creates a TokenCredentials that obtains Databricks access tokens by
@@ -27,5 +22,7 @@ export interface U2mCredentialsOptions {
  * @throws U2mCredentialsError when `profile` is empty, or when the CLI cannot
  * be located, is out of date, or fails to return a usable token.
  */
-export declare function newU2mCredentials(options: U2mCredentialsOptions): TokenCredentials;
+declare function newU2mCredentials(options: U2mCredentialsOptions): TokenCredentials;
+//#endregion
+export { U2mCredentialsOptions, newU2mCredentials };
 //# sourceMappingURL=u2m.d.ts.map

package/dist/credentials/u2m.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"u2m.d.ts","sourceRoot":"","sources":["../../src/credentials/u2m.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,KAAK,EAAQ,gBAAgB,EAAC,MAAM,SAAS,CAAC;AAarD,oDAAoD;AACpD,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,qBAAqB,GAC7B,gBAAgB,CAMlB"}
+{"version":3,"file":"u2m.d.ts","names":[],"sources":["../../src/credentials/u2m.ts"],"mappings":";;;AAoDA;AAAA,UAtBiB,qBAAA;;;;;EAKf,OAAA;EAmBiB;;;;EAbjB,OAAA;AAAA;;;;;;;;;iBAWc,iBAAA,CACd,OAAA,EAAS,qBAAA,GACR,gBAAA"}