@keboola/api-client 25.0.0 → 29.0.0

package/dist/auth-5HCvCsZO.cjs

@@ -0,0 +1,18 @@
+const require_createFetchClient = require("./createFetchClient-BsG719K1.cjs");
+//#region src/clients/auth.ts
+const createAuthHeaders = (auth) => {
+	if (auth.type === "sapi-token") return { [require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };
+	return {
+		[require_createFetchClient.HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,
+		[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString()
+	};
+};
+//#endregion
+Object.defineProperty(exports, "createAuthHeaders", {
+	enumerable: true,
+	get: function() {
+		return createAuthHeaders;
+	}
+});
+
+//# sourceMappingURL=auth-5HCvCsZO.cjs.map

package/dist/auth-5HCvCsZO.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-5HCvCsZO.cjs","names":["KeboolaHttpHeader","HttpHeader"],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAGA,0BAAAA,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJC,0BAAAA,WAAW,gBAAgB,UAAU,KAAK;GAC1CD,0BAAAA,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}

package/dist/auth-D2jfNlpX.js

@@ -0,0 +1,13 @@
+import { f as KeboolaHttpHeader, o as HttpHeader } from "./createFetchClient-BK0TZK-U.js";
+//#region src/clients/auth.ts
+const createAuthHeaders = (auth) => {
+	if (auth.type === "sapi-token") return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };
+	return {
+		[HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,
+		[KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString()
+	};
+};
+//#endregion
+export { createAuthHeaders as t };
+
+//# sourceMappingURL=auth-D2jfNlpX.js.map

package/dist/{chunk-EDX5D6UY.js.map → auth-D2jfNlpX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/clients/auth.ts"],"names":[],"mappings":";;;AAcO,IAAM,iBAAA,GAAoB,CAAC,IAAA,KAA+C;AAC/E,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,YAAA,EAAc,OAAO,EAAE,CAAC,iBAAA,CAAkB,iBAAiB,GAAG,IAAA,CAAK,KAAA,EAAM;AAM3F,EAAA,OAAO;AAAA,IACL,CAAC,UAAA,CAAW,aAAa,GAAG,CAAA,OAAA,EAAU,KAAK,KAAK,CAAA,CAAA;AAAA,IAChD,CAAC,iBAAA,CAAkB,UAAU,GAAG,IAAA,CAAK,UAAU,QAAA;AAAS,GAC1D;AACF","file":"chunk-EDX5D6UY.js","sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"]}
+{"version":3,"file":"auth-D2jfNlpX.js","names":[],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAG,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJ,WAAW,gBAAgB,UAAU,KAAK;GAC1C,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}

package/dist/authClient-Bgj2Ay7h.d.cts

@@ -0,0 +1,320 @@
+import { t as createOpenapiFetchClient } from "./index-CLPrlyIz.cjs";
+import { n as ClientInitOptions } from "./types-C8XiTXxi.cjs";
+import { A as CreateDeviceAuthorizationBody, F as paths, M as GetDeviceAuthorizationTokenBody, O as ApproveDeviceAuthorizationBody, P as components, _ as ExchangePatBody, b as RevokePatPath, c as RevokeSessionPath, d as InitiateSamlBody, h as CreatePatBody, i as SudoBody, l as AssertSamlBody, p as GetPkceTokenBody, r as RevokeTokenBody, x as DisableTotpPath } from "./types-2mHlPakp.cjs";
+import * as z$1 from "zod";
+//#region src/clients/auth/login/schemas.d.ts
+declare const loginInputSchema: z$1.ZodObject<{
+  email: z$1.ZodEmail;
+  password: z$1.ZodString;
+}, z$1.core.$strip>;
+declare const oidcInputSchema: z$1.ZodObject<{
+  grantType: z$1.ZodEnum<{
+    google: "google";
+    microsoft: "microsoft";
+  }>;
+  idToken: z$1.ZodString;
+}, z$1.core.$strip>;
+type LoginInput = z$1.infer<typeof loginInputSchema>;
+type OidcInput = z$1.infer<typeof oidcInputSchema>;
+declare const userSchema: z$1.ZodObject<{
+  id: z$1.ZodNumber;
+  email: z$1.ZodString;
+  name: z$1.ZodString;
+}, z$1.core.$strip>;
+declare const loginSuccessSchema: z$1.ZodObject<{
+  mfaRequired: z$1.ZodDefault<z$1.ZodLiteral<false>>;
+  accessToken: z$1.ZodString;
+  refreshToken: z$1.ZodString;
+  tokenType: z$1.ZodString;
+  expiresIn: z$1.ZodNumber;
+  sessionId: z$1.ZodString;
+  user: z$1.ZodObject<{
+    id: z$1.ZodNumber;
+    email: z$1.ZodString;
+    name: z$1.ZodString;
+  }, z$1.core.$strip>;
+}, z$1.core.$strip>;
+declare const mfaChallengeSchema: z$1.ZodObject<{
+  mfaRequired: z$1.ZodLiteral<true>;
+  mfaType: z$1.ZodString;
+  mfaToken: z$1.ZodString;
+  expiresIn: z$1.ZodNumber;
+  allowedMethods: z$1.ZodArray<z$1.ZodString>;
+}, z$1.core.$strip>;
+declare const loginResultSchema: z$1.ZodUnion<readonly [z$1.ZodObject<{
+  mfaRequired: z$1.ZodDefault<z$1.ZodLiteral<false>>;
+  accessToken: z$1.ZodString;
+  refreshToken: z$1.ZodString;
+  tokenType: z$1.ZodString;
+  expiresIn: z$1.ZodNumber;
+  sessionId: z$1.ZodString;
+  user: z$1.ZodObject<{
+    id: z$1.ZodNumber;
+    email: z$1.ZodString;
+    name: z$1.ZodString;
+  }, z$1.core.$strip>;
+}, z$1.core.$strip>, z$1.ZodObject<{
+  mfaRequired: z$1.ZodLiteral<true>;
+  mfaType: z$1.ZodString;
+  mfaToken: z$1.ZodString;
+  expiresIn: z$1.ZodNumber;
+  allowedMethods: z$1.ZodArray<z$1.ZodString>;
+}, z$1.core.$strip>]>;
+type LoginUser = z$1.infer<typeof userSchema>;
+type LoginSuccess = z$1.infer<typeof loginSuccessSchema>;
+type LoginResult = z$1.infer<typeof loginResultSchema>;
+//#endregion
+//#region src/clients/auth/mfa/schemas.d.ts
+declare const mfaCodeInputSchema: z$1.ZodObject<{
+  mfaToken: z$1.ZodString;
+  type: z$1.ZodEnum<{
+    recovery_code: "recovery_code";
+    totp: "totp";
+  }>;
+  code: z$1.ZodString;
+}, z$1.core.$strip>;
+declare const mfaWebauthnInputSchema: z$1.ZodObject<{
+  mfaToken: z$1.ZodString;
+  assertion: z$1.ZodString;
+}, z$1.core.$strip>;
+declare const totpVerifyInputSchema: z$1.ZodObject<{
+  code: z$1.ZodString;
+  revokeOtherSessions: z$1.ZodDefault<z$1.ZodBoolean>;
+}, z$1.core.$strip>;
+type MfaCodeInput = z$1.infer<typeof mfaCodeInputSchema>;
+type MfaWebauthnInput = z$1.infer<typeof mfaWebauthnInputSchema>;
+type TotpVerifyInput = z$1.input<typeof totpVerifyInputSchema>;
+//#endregion
+//#region src/clients/auth/password/schemas.d.ts
+declare const resetRequestInputSchema: z$1.ZodObject<{
+  email: z$1.ZodEmail;
+}, z$1.core.$strip>;
+declare const resetInputSchema: z$1.ZodObject<{
+  token: z$1.ZodString;
+  newPassword: z$1.ZodString;
+  revokeSessions: z$1.ZodDefault<z$1.ZodBoolean>;
+}, z$1.core.$strip>;
+declare const changeInputSchema: z$1.ZodObject<{
+  currentPassword: z$1.ZodString;
+  newPassword: z$1.ZodString;
+  revokeOtherSessions: z$1.ZodDefault<z$1.ZodBoolean>;
+}, z$1.core.$strip>;
+type ResetRequestInput = z$1.infer<typeof resetRequestInputSchema>;
+type ResetInput = z$1.input<typeof resetInputSchema>;
+type ChangePasswordInput = z$1.input<typeof changeInputSchema>;
+//#endregion
+//#region src/clients/auth/authClient.d.ts
+type AuthClientInitOptions = Omit<ClientInitOptions, 'auth'>;
+type AuthOpenApiFetchClient = ReturnType<typeof createOpenapiFetchClient<paths>>;
+declare const createAuthClient: ({ baseUrl, middlewares }: AuthClientInitOptions) => {
+  healthCheck: (signal?: AbortSignal) => Promise<unknown>;
+  login: {
+    withPassword: (input: LoginInput, signal?: AbortSignal) => Promise<{
+      mfaRequired: false;
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: {
+        id: number;
+        email: string;
+        name: string;
+      };
+    } | {
+      mfaRequired: true;
+      mfaType: string;
+      mfaToken: string;
+      expiresIn: number;
+      allowedMethods: string[];
+    }>;
+    withOidc: (input: OidcInput, signal?: AbortSignal) => Promise<{
+      mfaRequired: false;
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: {
+        id: number;
+        email: string;
+        name: string;
+      };
+    } | {
+      mfaRequired: true;
+      mfaType: string;
+      mfaToken: string;
+      expiresIn: number;
+      allowedMethods: string[];
+    }>;
+    methods: (signal?: AbortSignal) => Promise<{
+      methods: components['schemas']['LoginMethod'][];
+      restriction: 'ssoEnforced' | 'stackSsoOnly' | null;
+      emailDiscoveryEnabled: boolean;
+      signUpUrl: string | null;
+    }>;
+  };
+  mfa: {
+    verifyWithCode: (input: MfaCodeInput, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+    verifyWithWebauthn: (input: MfaWebauthnInput, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+    regenerateRecoveryCodes: (signal?: AbortSignal) => Promise<{
+      codes: string[];
+    }>;
+    totp: {
+      setup: (signal?: AbortSignal) => Promise<{
+        secret: string;
+        otpauthUri: string;
+        expiresAt: string;
+      }>;
+      verify: (input: TotpVerifyInput, signal?: AbortSignal) => Promise<{
+        id: number;
+        mfaType: string;
+        recoveryCodes?: string[] | null;
+      }>;
+      disable: (id: DisableTotpPath['id'], signal?: AbortSignal) => Promise<void>;
+    };
+  };
+  password: {
+    resetRequest: (input: ResetRequestInput, signal?: AbortSignal) => Promise<void>;
+    reset: (input: ResetInput, signal?: AbortSignal) => Promise<void>;
+    change: (input: ChangePasswordInput, signal?: AbortSignal) => Promise<void>;
+  };
+  saml: {
+    assert: (body: AssertSamlBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    } | {
+      mfaRequired: boolean;
+      mfaType: string;
+      mfaToken: string;
+      expiresIn: number;
+      allowedMethods: string[];
+      webauthn: Record<string, never> | null;
+    }>;
+    initiate: (body?: InitiateSamlBody, signal?: AbortSignal) => Promise<{
+      ssoUrl: string;
+      requestHandle: string;
+      expiresIn: number;
+    }>;
+  };
+  pat: {
+    create: (body: CreatePatBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      tokenType: string;
+      expiresIn: number;
+      pat: components['schemas']['PatItemResponse'];
+    }>;
+    exchange: (body?: ExchangePatBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      tokenType: string;
+      expiresIn: number;
+      scope: Record<string, never>;
+      readOnly: boolean;
+      parentTokenId: string;
+      parentTokenType: 'session' | 'pat';
+      expiresAt: string;
+      pat: components['schemas']['PatItemResponse'];
+    }>;
+    revoke: (id: RevokePatPath['id'], signal?: AbortSignal) => Promise<void>;
+    getAll: (signal?: AbortSignal) => Promise<{
+      items: components['schemas']['PatItemResponse'][];
+    }>;
+  };
+  device: {
+    create: (body: CreateDeviceAuthorizationBody, signal?: AbortSignal) => Promise<{
+      deviceCode: string;
+      userCode: string;
+      verificationUri: string;
+      verificationUriComplete: string;
+      expiresIn: number;
+      interval: number;
+    }>;
+    approve: (body: ApproveDeviceAuthorizationBody, signal?: AbortSignal) => Promise<{
+      status: 'approved' | 'denied';
+      idempotent: boolean;
+      decision: components['schemas']['DeviceApprovalDecision'];
+    }>;
+    getToken: (body: GetDeviceAuthorizationTokenBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+  };
+  sudo: {
+    verify: (body: SudoBody, signal?: AbortSignal) => Promise<{
+      sudoVerified: boolean;
+      sudoExpiresAt: string;
+      sudoTimeoutSeconds: number;
+    }>;
+    challenge: (signal?: AbortSignal) => Promise<{
+      challengeToken: string;
+      options: Record<string, never>;
+      expiresIn: number;
+    }>;
+  };
+  pkce: {
+    getToken: (body: GetPkceTokenBody, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+  };
+  session: {
+    getAll: (signal?: AbortSignal) => Promise<{
+      sessions?: components['schemas']['SessionItemResponse'][];
+      oauthSessions?: components['schemas']['OAuthSessionItemResponse'][];
+    }>;
+    revoke: (sessionId: RevokeSessionPath['sessionId'], signal?: AbortSignal) => Promise<void>;
+    revokeAll: (signal?: AbortSignal) => Promise<void>;
+  };
+  token: {
+    refresh: (refreshToken: string, signal?: AbortSignal) => Promise<{
+      accessToken: string;
+      refreshToken: string;
+      tokenType: string;
+      expiresIn: number;
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    }>;
+    introspect: (token?: string, signal?: AbortSignal) => Promise<{
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+      grantType: string;
+      sudoVerified: boolean;
+      createdAt: string;
+      expiresAt: string;
+      lastUsedAt?: string | null;
+      lastUsedIp?: string | null;
+      userAgent?: string | null;
+      projects: components['schemas']['ProjectAccessItem'][];
+    }>;
+    revoke: (body: RevokeTokenBody, signal?: AbortSignal) => Promise<void>;
+  };
+};
+//#endregion
+export { loginSuccessSchema as C, loginResultSchema as S, oidcInputSchema as T, LoginResult as _, ResetInput as a, OidcInput as b, resetInputSchema as c, MfaWebauthnInput as d, TotpVerifyInput as f, LoginInput as g, totpVerifyInputSchema as h, ChangePasswordInput as i, resetRequestInputSchema as l, mfaWebauthnInputSchema as m, AuthOpenApiFetchClient as n, ResetRequestInput as o, mfaCodeInputSchema as p, createAuthClient as r, changeInputSchema as s, AuthClientInitOptions as t, MfaCodeInput as u, LoginSuccess as v, mfaChallengeSchema as w, loginInputSchema as x, LoginUser as y };
+//# sourceMappingURL=authClient-Bgj2Ay7h.d.cts.map

package/dist/authClient-DOk6VKdV.js

@@ -0,0 +1,332 @@
+import { o as HttpHeader } from "./createFetchClient-BK0TZK-U.js";
+import { t as createGenericFetchClient } from "./createGenericFetchClient-CVZYekDk.js";
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-B5U1fCHS.js";
+import * as z$1 from "zod";
+//#region src/clients/auth/device/device.ts
+const createDevice = (client) => {
+	const create = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/device", { body }, { signal });
+		return data;
+	};
+	const approve = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/device/approve", { body }, { signal });
+		return data;
+	};
+	const getToken = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/device/token", { body }, { signal });
+		return data;
+	};
+	return {
+		create,
+		approve,
+		getToken
+	};
+};
+//#endregion
+//#region src/clients/auth/login/schemas.ts
+const loginInputSchema = z$1.object({
+	email: z$1.email(),
+	password: z$1.string().min(1, "Required")
+});
+const oidcInputSchema = z$1.object({
+	grantType: z$1.enum(["google", "microsoft"]),
+	idToken: z$1.string().min(1, "Required")
+});
+const userSchema = z$1.object({
+	id: z$1.number(),
+	email: z$1.string(),
+	name: z$1.string()
+});
+const loginSuccessSchema = z$1.object({
+	mfaRequired: z$1.literal(false).default(false),
+	accessToken: z$1.string(),
+	refreshToken: z$1.string(),
+	tokenType: z$1.string(),
+	expiresIn: z$1.number(),
+	sessionId: z$1.string(),
+	user: userSchema
+});
+const mfaChallengeSchema = z$1.object({
+	mfaRequired: z$1.literal(true),
+	mfaType: z$1.string(),
+	mfaToken: z$1.string(),
+	expiresIn: z$1.number(),
+	allowedMethods: z$1.array(z$1.string())
+});
+const loginResultSchema = z$1.union([loginSuccessSchema, mfaChallengeSchema]);
+//#endregion
+//#region src/clients/auth/login/login.ts
+const createLogin = (client) => {
+	const _login = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/login", { body }, { signal });
+		return data;
+	};
+	const withPassword = async (input, signal) => {
+		const { email, password } = loginInputSchema.parse(input);
+		const data = await _login({
+			grantType: "password",
+			email,
+			password
+		}, signal);
+		return loginResultSchema.parse(data);
+	};
+	const withOidc = async (input, signal) => {
+		const { grantType, idToken } = oidcInputSchema.parse(input);
+		const data = await _login({
+			grantType,
+			idToken
+		}, signal);
+		return loginResultSchema.parse(data);
+	};
+	const methods = async (signal) => {
+		const { data } = await client.get("/v1/auth/methods", {}, { signal });
+		return data;
+	};
+	return {
+		withPassword,
+		withOidc,
+		methods
+	};
+};
+//#endregion
+//#region src/clients/auth/mfa/schemas.ts
+const mfaCodeInputSchema = z$1.object({
+	mfaToken: z$1.string(),
+	type: z$1.enum(["totp", "recovery_code"]),
+	code: z$1.string().min(1, "Required")
+});
+const mfaWebauthnInputSchema = z$1.object({
+	mfaToken: z$1.string(),
+	assertion: z$1.string()
+});
+const totpVerifyInputSchema = z$1.object({
+	code: z$1.string().min(1, "Required"),
+	revokeOtherSessions: z$1.boolean().default(false)
+});
+//#endregion
+//#region src/clients/auth/mfa/mfa.ts
+const createMfa = (client) => {
+	const _verify = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/mfa", { body }, { signal });
+		return data;
+	};
+	const verifyWithCode = async (input, signal) => {
+		const { mfaToken, type, code } = mfaCodeInputSchema.parse(input);
+		return _verify({
+			mfaToken,
+			type,
+			code
+		}, signal);
+	};
+	const verifyWithWebauthn = async (input, signal) => {
+		const { mfaToken, assertion } = mfaWebauthnInputSchema.parse(input);
+		return _verify({
+			mfaToken,
+			type: "webauthn",
+			assertion
+		}, signal);
+	};
+	const regenerateRecoveryCodes = async (signal) => {
+		const { data } = await client.post("/v1/auth/mfa/recovery-codes", {}, { signal });
+		return data;
+	};
+	return {
+		verifyWithCode,
+		verifyWithWebauthn,
+		regenerateRecoveryCodes,
+		totp: {
+			setup: async (signal) => {
+				const { data } = await client.post("/v1/auth/mfa/totp", {}, { signal });
+				return data;
+			},
+			verify: async (input, signal) => {
+				const body = totpVerifyInputSchema.parse(input);
+				const { data } = await client.post("/v1/auth/mfa/totp/verify", { body }, { signal });
+				return data;
+			},
+			disable: async (id, signal) => {
+				await client.delete("/v1/auth/mfa/totp/{id}", { path: { id } }, { signal });
+			}
+		}
+	};
+};
+//#endregion
+//#region src/clients/auth/password/schemas.ts
+const resetRequestInputSchema = z$1.object({ email: z$1.email() });
+const resetInputSchema = z$1.object({
+	token: z$1.string().min(1, "Required"),
+	newPassword: z$1.string().min(1, "Required"),
+	revokeSessions: z$1.boolean().default(true)
+});
+const changeInputSchema = z$1.object({
+	currentPassword: z$1.string().min(1, "Required"),
+	newPassword: z$1.string().min(1, "Required"),
+	revokeOtherSessions: z$1.boolean().default(true)
+});
+//#endregion
+//#region src/clients/auth/password/password.ts
+const createPassword = (client) => {
+	const resetRequest = async (input, signal) => {
+		const body = resetRequestInputSchema.parse(input);
+		await client.post("/v1/auth/password/reset-request", { body }, { signal });
+	};
+	const reset = async (input, signal) => {
+		const body = resetInputSchema.parse(input);
+		await client.post("/v1/auth/password/reset", { body }, { signal });
+	};
+	const change = async (input, signal) => {
+		const body = changeInputSchema.parse(input);
+		await client.post("/v1/auth/password/change", { body }, { signal });
+	};
+	return {
+		resetRequest,
+		reset,
+		change
+	};
+};
+//#endregion
+//#region src/clients/auth/pat/pat.ts
+const createPat = (client) => {
+	const getAll = async (signal) => {
+		const { data } = await client.get("/v1/auth/pat", {}, { signal });
+		return data;
+	};
+	const create = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/pat", { body }, { signal });
+		return data;
+	};
+	const exchange = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/pat/exchange", { body }, { signal });
+		return data;
+	};
+	const revoke = async (id, signal) => {
+		await client.delete("/v1/auth/pat/{id}", { path: { id } }, { signal });
+	};
+	return {
+		create,
+		exchange,
+		revoke,
+		getAll
+	};
+};
+//#endregion
+//#region src/clients/auth/pkce/pkce.ts
+const createPkce = (client) => {
+	const getToken = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/pkce/token", { body }, { signal });
+		return data;
+	};
+	return { getToken };
+};
+//#endregion
+//#region src/clients/auth/saml/saml.ts
+const createSaml = (client) => {
+	const assert = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/saml/assert", { body }, { signal });
+		return data;
+	};
+	const initiate = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/saml/initiate", { body }, { signal });
+		return data;
+	};
+	return {
+		assert,
+		initiate
+	};
+};
+//#endregion
+//#region src/clients/auth/session/session.ts
+const createSession = (client) => {
+	const getAll = async (signal) => {
+		const { data } = await client.get("/v1/auth/sessions", {}, { signal });
+		return data;
+	};
+	const revoke = async (sessionId, signal) => {
+		await client.delete("/v1/auth/sessions/{sessionId}", { path: { sessionId } }, { signal });
+	};
+	const revokeAll = async (signal) => {
+		await client.delete("/v1/auth/sessions", {}, { signal });
+	};
+	return {
+		getAll,
+		revoke,
+		revokeAll
+	};
+};
+//#endregion
+//#region src/clients/auth/sudo/sudo.ts
+const createSudo = (client) => {
+	const verify = async (body, signal) => {
+		const { data } = await client.post("/v1/auth/sudo", { body }, { signal });
+		return data;
+	};
+	const challenge = async (signal) => {
+		const { data } = await client.post("/v1/auth/sudo/challenge", {}, { signal });
+		return data;
+	};
+	return {
+		verify,
+		challenge
+	};
+};
+//#endregion
+//#region src/clients/auth/token/token.ts
+const createToken = (client) => {
+	const refresh = async (refreshToken, signal) => {
+		const { data } = await client.post("/v1/auth/token/refresh", { body: { refreshToken } }, { signal });
+		return data;
+	};
+	/**
+	* Introspects an authenticated session token.
+	*
+	* @param token - Optional token to introspect (`Authorization: Bearer`); a middleware-set header wins.
+	*/
+	const introspect = async (token, signal) => {
+		const { data } = await client.get("/v1/auth/token/introspect", {}, {
+			signal,
+			headers: token ? { [HttpHeader.AUTHORIZATION]: `Bearer ${token}` } : void 0
+		});
+		return data;
+	};
+	const revoke = async (body, signal) => {
+		await client.post("/v1/auth/token/revoke", { body }, { signal });
+	};
+	return {
+		refresh,
+		introspect,
+		revoke
+	};
+};
+//#endregion
+//#region src/clients/auth/authClient.ts
+const createAuthClient = ({ baseUrl, middlewares }) => {
+	const client = createOpenapiFetchClient({
+		baseUrl,
+		middlewares
+	});
+	const genericClient = createGenericFetchClient({
+		baseUrl,
+		middlewares
+	});
+	const healthCheck = async (signal) => {
+		const { data } = await genericClient.get("/health-check", {}, { signal });
+		return data;
+	};
+	return {
+		healthCheck,
+		login: createLogin(client),
+		mfa: createMfa(client),
+		password: createPassword(client),
+		saml: createSaml(client),
+		pat: createPat(client),
+		device: createDevice(client),
+		sudo: createSudo(client),
+		pkce: createPkce(client),
+		session: createSession(client),
+		token: createToken(client)
+	};
+};
+//#endregion
+export { mfaCodeInputSchema as a, loginInputSchema as c, mfaChallengeSchema as d, oidcInputSchema as f, resetRequestInputSchema as i, loginResultSchema as l, changeInputSchema as n, mfaWebauthnInputSchema as o, resetInputSchema as r, totpVerifyInputSchema as s, createAuthClient as t, loginSuccessSchema as u };
+
+//# sourceMappingURL=authClient-DOk6VKdV.js.map